mlsanityData to 7 Oct 2026

Poison-RAG: Adversarial Data Poisoning Attacks on Retrieval-Augmented Generation in Recommender Systems

arXiv 2501.11759 ↗First posted 20 Jan 2025cs.IRcited by 32

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

This study presents Poison-RAG, a framework for adversarial data poisoning attacks targeting retrieval-augmented generation (RAG)-based recommender systems. Poison-RAG manipulates item metadata, such as tags and descriptions, to influence recommendation outcomes. Using item metadata generated through a large language model (LLM) and embeddings derived via the OpenAI API, we explore the impact of adversarial poisoning attacks on provider-side, where attacks are designed to promote long-tail items and demote popular ones. Two attack strategies are proposed: local modifications, which personalize tags for each item using BERT embeddings, and global modifications, applying uniform tags across the dataset. Experiments conducted on the MovieLens dataset in a black-box setting reveal that local strategies improve manipulation effectiveness by up to 50%, while global strategies risk boosting already popular items. Results indicate that popular items are more susceptible to attacks, whereas long-tail items are harder to manipulate. Approximately 70% of items lack tags, presenting a cold-start challenge; data augmentation and synthesis are proposed as potential defense mechanisms to enhance RAG-based systems' resilience. The findings emphasize the need for robust metadata management to safeguard recommendation frameworks. Code and data are available at https://github.com/atenanaz/Poison-RAG.

Key facts. Cited by 32 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 11 of its 15 references that are in the map. First posted on arXiv 20 Jan 2025.

Builds on

11 of 15 references.

Closest ancestors · 5

Same direction, newest first

  1. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation27 Jun
  2. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  3. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  4. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  5. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 6

  1. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 450
  2. 2023How Can Recommender Systems Benefit from Large Language Models: A Surveycited by 141
  3. 2024A Review of Modern Recommender Systems Using Generative Models (Gen-RecSys)cited by 58
  4. 2024Understanding Biases in ChatGPT-based Recommender Systems: Provider Fairness, Temporal Stability, and Recencycited by 27
  5. 2024CFaiRLLM: Consumer Fairness Evaluation in Large-Language Model Recommender Systemcited by 18
  6. 2024Recommendation with Generative Modelscited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 19; 2026: 13.

32 papers.

Sort:

By area:

  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 125
  2. 2025G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systemscited by 56
  3. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  4. 2025BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attackscited by 37
  5. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 12
  6. 2025Toward Holistic Evaluation of Recommender Systems Powered by Generative Modelscited by 11
  7. 2025Scaling Beyond Context: A Survey of Multimodal Retrieval-Augmented Generation for Document Understandingcited by 9
  8. 2025Stealthy LLM-Driven Data Poisoning Attacks Against Embedding-Based Retrieval-Augmented Recommender Systemscited by 8
  9. 2025Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMscited by 8
  10. 2025Takedown: How It's Done in Modern Coding Agent Exploitscited by 6
  11. 2025Ranking Free RAG: Replacing Re-ranking with Selection in RAG for Sensitive Domainscited by 5
  12. 2025Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domaincited by 5
20 more
  1. 2026INFA-Guard: Mitigating Malicious Propagation via Infection-Aware Safeguarding in LLM-Based Multi-Agent Systemscited by 5
  2. 2026Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skillscited by 4
  3. 2025Preventing Rogue Agents Improves Multi-Agent Collaborationcited by 3
  4. 2025Across Programming Language Silos: A Study on Cross-Lingual Retrieval-augmented Code Generationcited by 3
  5. 2025RAG-VisualRec: An Open Resource for Vision- and Text-Enhanced Retrieval-Augmented Generation in Recommendationcited by 3
  6. 2026Stateless Yet Not Forgetful: Implicit Memory as a Hidden Channel in LLMscited by 3
  7. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generationcited by 2
  8. 2025Fine-Grained Privacy Extraction from Retrieval-Augmented Generation Systems via Knowledge Asymmetry Exploitationcited by 2
  9. 2025AC-LoRA: (Almost) Training-Free Access Control-Aware Multi-Modal LLMscited by 1
  10. 2026RADAR: Defending RAG Dynamically against Retrieval Corruptioncited by 1
  11. 2026SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systemscited by 1
  12. 2026Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systemscited by 1
  13. 2026AutoRAS: Learning Robust Agentic Systems with Primitive Representationscited by 1
  14. 2026When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systemscited by 1
  15. 2025Provably Secure Retrieval-Augmented Generationcited by 0
  16. 2026BadSKP: Backdoor Attacks on Knowledge Graph-Enhanced LLMs with Soft Promptscited by 0
  17. 2026One Polluted Page Is Enough: Evaluating Web Content Pollution in LLM Recommenderscited by 0
  18. 2026OpenEvoShield: Dual Non-Stationary Continual Defense for Open-World Multi-Agent System Attackscited by 0
  19. 2026Privacy-Preserving Topology-Guided Safety for LLM-Based Multi-Agent Systems via Federated Graph Learningcited by 0
  20. 2026RAG-Safety-Bench: Reliable Evaluation of Retrieval-Augmented LLM Safetycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Influence Factors on RAG Poisoning
  2. 2025Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems
  3. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
  4. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems
  5. 2025Retrieval-Augmented Review Generation for Poisoning Recommender Systems
  6. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation
  7. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  8. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models