mlsanityData to 7 Oct 2026

Corpus Poisoning via Approximate Greedy Gradient Descent

arXiv 2406.05087 ↗First posted 7 Jun 2024cs.IRcited by 21

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Dense retrievers are widely used in information retrieval and have also been successfully extended to other knowledge intensive areas such as language models, e.g., Retrieval-Augmented Generation (RAG) systems. Unfortunately, they have recently been shown to be vulnerable to corpus poisoning attacks in which a malicious user injects a small fraction of adversarial passages into the retrieval corpus to trick the system into returning these passages among the top-ranked results for a broad set of user queries. Further study is needed to understand the extent to which these attacks could limit the deployment of dense retrievers in real-world applications. In this work, we propose Approximate Greedy Gradient Descent (AGGD), a new attack on dense retrieval systems based on the widely used HotFlip method for efficiently generating adversarial passages. We demonstrate that AGGD can select a higher quality set of token-level perturbations than HotFlip by replacing its random token sampling with a more structured search. Experimentally, we show that our method achieves a high attack success rate on several datasets and using several retrievers, and can generalize to unseen queries and new domains. Notably, our method is extremely effective in attacking the ANCE retrieval model, achieving attack success rates that are 15.24% and 17.44% higher on the NQ and MS MARCO datasets, respectively, compared to HotFlip. Additionally, we demonstrate AGGD's potential to replace HotFlip in other adversarial attacks, such as knowledge poisoning of RAG systems.

Key facts. Cited by 21 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 33 of its 49 references that are in the map. First posted on arXiv 7 Jun 2024.

Builds on

33 of 49 references.

References · 33

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,895
  5. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,126
  6. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  7. 2021Improving language models by retrieving from trillions of tokenscited by 1,278
  8. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  9. 2022LaMDA: Language Models for Dialog Applicationscited by 1,218
  10. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  11. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  12. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
21 more
  1. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  2. 2019Latent Retrieval for Weakly Supervised Open Domain Question Answeringcited by 691
  3. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  4. 2020Fact or Fiction: Verifying Scientific Claimscited by 546
  5. 2020SPECTER: Document-level Representation Learning using Citation-informed Transformerscited by 426
  6. 2020RocketQA: An Optimized Training Approach to Dense Passage Retrieval for Open-Domain Question Answeringcited by 410
  7. 2023Hard Prompts Made Easy: Gradient-Based Discrete Optimization for Prompt Tuning and Discoverycited by 329
  8. 2020Pretrained Transformers for Text Ranking: BERT and Beyondcited by 266
  9. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  10. 2022Dense Text Retrieval based on Pretrained Language Models: A Surveycited by 136
  11. 2019Learning Dense Representations for Entity Retrievalcited by 122
  12. 2016Learning to Match Using Local and Distributed Representations of Text for Web Searchcited by 68
  13. 2020Universal Adversarial Attacks with Natural Triggers for Text Classificationcited by 50
  14. 2020Adversarial Semantic Collisionscited by 42
  15. 2023Making LLMs Worth Every Penny: Resource-Limited Text Classification in Bankingcited by 36
  16. 2023Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Methodcited by 29
  17. 2019Targeted Mismatch Adversarial Attack: Query with a Flower to Retrieve the Towercited by 26
  18. 2020One word at a time: adversarial attacks on retrieval modelscited by 23
  19. 2020Humpty Dumpty: Controlling Word Meanings via Corpus Poisoningcited by 17
  20. 2024Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggerscited by 13
  21. 2022Fast and Light-Weight Answer Text Retrieval in Dialogue Systemscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 5; 2026: 15.

21 papers.

Sort:

By area:

  1. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 17
  2. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attackscited by 14
  3. 2026VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commitcited by 13
  4. 2025Unsupervised Corpus Poisoning Attacks in Continuous Space for Dense Retrievalcited by 11
  5. 2025Reproducing HotFlip for Corpus Poisoning Attacks in Dense Retrievalcited by 7
  6. 2025RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbationscited by 4
  7. 2026Retrieval Collapses When AI Pollutes the Webcited by 4
  8. 2025Hoist with His Own Petard: Inducing Guardrails to Facilitate Denial-of-Service Attacks on Retrieval-Augmented Generation of LLMscited by 3
  9. 2026Multimodal Generative Engine Optimization: Rank Manipulation for Vision-Language Model Rankerscited by 3
  10. 2026The Synthetic Web: Adversarially-Curated Mini-Internets for Diagnosing Epistemic Weaknesses of Language Agentscited by 3
  11. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  12. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoningcited by 2
9 more
  1. 2026SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoningcited by 1
  2. 2026On the Robustness of LLM-Based Dense Retrievers: A Systematic Analysis of Generalizability and Stabilitycited by 0
  3. 2026Hypencoder Revisited: Reproducibility and Analysis of Non-Linear Scoring for First-Stage Retrievalcited by 0
  4. 2026Led to Mislead: Adversarial Content Injection for Attacks on Neural Ranking Modelscited by 0
  5. 2026Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attributioncited by 0
  6. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 0
  7. 2026VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Modelscited by 0
  8. 2026Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agentscited by 0
  9. 2026Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search
  2. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  3. 2026ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning
  4. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
  5. 2025Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attack
  6. 2026When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines
  7. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  8. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation