mlsanityData to 14 Oct 2026

Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models

arXiv 2410.14479 ↗First posted 18 Oct 2024cs.CR cs.LGcited by 22

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Large Language Models (LLMs) have demonstrated remarkable capabilities in generating coherent text but remain limited by the static nature of their training data. Retrieval Augmented Generation (RAG) addresses this issue by combining LLMs with up-to-date information retrieval, but also expand the attack surface of the system. This paper investigates prompt injection attacks on RAG, focusing on malicious objectives beyond misinformation, such as inserting harmful links, promoting unauthorized services, and initiating denial-of-service behaviors. We build upon existing corpus poisoning techniques and propose a novel backdoor attack aimed at the fine-tuning process of the dense retriever component. Our experiments reveal that corpus poisoning can achieve significant attack success rates through the injection of a small number of compromised documents into the retriever corpus. In contrast, backdoor attacks demonstrate even higher success rates but necessitate a more complex setup, as the victim must fine-tune the retriever using the attacker poisoned dataset.

Key facts. Cited by 22 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 22 of its 37 references that are in the map. First posted on arXiv 18 Oct 2024.

Builds on

22 of 37 references.

References · 22

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  3. 2020Extracting Training Data from Large Language Modelscited by 2,189
  4. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  5. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  6. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,252
  7. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  8. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  9. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
  10. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  11. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
  12. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 183
10 more
  1. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 113
  2. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
  3. 2024Self-Introspective Decoding: Alleviating Hallucinations for Large Vision-Language Modelscited by 94
  4. 2021Hidden Backdoors in Human-Centric Language Modelscited by 90
  5. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  6. 2024The Dawn After the Dark: An Empirical Study on Factuality Hallucination in Large Language Modelscited by 88
  7. 2019Understanding Top-k Sparsification in Distributed Deep Learningcited by 56
  8. 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 56
  9. 2024Privacy Backdoors: Stealing Data with Corrupted Pretrained Modelscited by 22
  10. 2024Backdoor Attacks on Dense Retrieval via Public and Unintentional Triggerscited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 11; 2026: 11.

22 papers.

Sort:

By area:

  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 126
  2. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  3. 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 48
  4. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 31
  5. 2025Agentic AI Security: Threats, Defenses, Evaluation, and Open Challengescited by 28
  6. 2025A Comprehensive Survey on Trustworthiness in Reasoning with Large Language Modelscited by 25
  7. 2025Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystemcited by 16
  8. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  9. 2025Prompt Injection Detection and Mitigation via AI Multi-Agent NLP Frameworkscited by 15
  10. 2025Prompt Injection 2.0: Hybrid AI Threatscited by 13
  11. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systemscited by 7
  12. 2025Ranking Free RAG: Replacing Re-ranking with Selection in RAG for Sensitive Domainscited by 5
10 more
  1. 2025Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defensescited by 2
  2. 2025LLM in the Middle: A Systematic Review of Threats and Mitigations to Real-World LLM-based Systemscited by 1
  3. 2025CourtGuard: A Local, Multiagent Prompt Injection Classifiercited by 1
  4. 2026Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidencecited by 1
  5. 2026RADAR: Defending RAG Dynamically against Retrieval Corruptioncited by 1
  6. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
  7. 2026CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generationcited by 1
  8. 2026Personalization Meets Safety:Mechanisms,Risks,and Mitigations in Personalized LLMscited by 0
  9. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systemscited by 0
  10. 2026Backdoor in the Loop: Compromising Agentic Search via Malicious Retrieverscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors
  2. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  3. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  4. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  5. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation
  6. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  7. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models
  8. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models