mlsanityData to 7 Oct 2026

Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models

arXiv 2407.13757 ↗First posted 18 Jul 2024cs.CL cs.AI cs.CRcited by 11

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) is applied to solve hallucination problems and real-time constraints of large language models, but it also induces vulnerabilities against retrieval corruption attacks. Existing research mainly explores the unreliability of RAG in white-box and closed-domain QA tasks. In this paper, we aim to reveal the vulnerabilities of Retrieval-Enhanced Generative (RAG) models when faced with black-box attacks for opinion manipulation. We explore the impact of such attacks on user cognition and decision-making, providing new insight to enhance the reliability and security of RAG models. We manipulate the ranking results of the retrieval model in RAG with instruction and use these results as data to train a surrogate model. By employing adversarial retrieval attack methods to the surrogate model, black-box transfer attacks on RAG are further realized. Experiments conducted on opinion datasets across multiple topics show that the proposed attack strategy can significantly alter the opinion polarity of the content generated by RAG. This demonstrates the model's vulnerability and, more importantly, reveals the potential negative impact on user cognition and decision-making, making it easier to mislead users into accepting incorrect or biased information.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 21 of its 29 references that are in the map. First posted on arXiv 18 Jul 2024.

Builds on

21 of 29 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  2. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  3. 2024Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applications26 Apr
  4. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr

Other references · 17

  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  4. 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  6. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
  7. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 320
  8. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  9. 2021Unsupervised Corpus Aware Language Model Pre-training for Dense Passage Retrievalcited by 203
  10. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  11. 2024Weak-to-Strong Jailbreaking on Large Language Modelscited by 100
  12. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
5 more
  1. 2022PRADA: Practical Black-Box Adversarial Attacks against Neural Ranking Modelscited by 44
  2. 2020Adversarial Semantic Collisionscited by 42
  3. 2022Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Modelscited by 37
  4. 2023Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Methodcited by 29
  5. 2023MAWSEO: Adversarial Wiki Search Poisoning for Illicit Online Promotioncited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 9; 2026: 2.

11 papers.

  1. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  2. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 35
  3. 2025GraphRAG under Firecited by 23
  4. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  5. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surfacecited by 8
  6. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Modelscited by 6
  7. 2025Securing RAG: A Risk Assessment and Mitigation Frameworkcited by 3
  8. 2025Safety Degradation in AI Agentscited by 2
  9. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  10. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  11. 2026Mapping the RAG Landscape: A Four Axis Taxonomy of Efficiency, Defense, Interactivity, and Reasoningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models
  2. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
  3. 2025Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs
  4. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
  5. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models
  6. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  7. 2026Influence Factors on RAG Poisoning
  8. 2025Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems