mlsanityData to 14 Oct 2026

Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models

arXiv 2502.01386 ↗First posted 3 Feb 2025cs.CL cs.CR cs.IRcited by 33

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) systems based on Large Language Models (LLMs) have become essential for tasks such as question answering and content generation. However, their increasing impact on public opinion and information dissemination has made them a critical focus for security research due to inherent vulnerabilities. Previous studies have predominantly addressed attacks targeting factual or single-query manipulations. In this paper, we address a more practical scenario: topic-oriented adversarial opinion manipulation attacks on RAG models, where LLMs are required to reason and synthesize multiple perspectives, rendering them particularly susceptible to systematic knowledge poisoning. Specifically, we propose Topic-FlipRAG, a two-stage manipulation attack pipeline that strategically crafts adversarial perturbations to influence opinions across related queries. This approach combines traditional adversarial ranking attack techniques and leverages the extensive internal relevant knowledge and reasoning capabilities of LLMs to execute semantic-level perturbations. Experiments show that the proposed attacks effectively shift the opinion of the model's outputs on specific topics, significantly impacting user information perception. Current mitigation methods cannot effectively defend against such attacks, highlighting the necessity for enhanced safeguards for RAG systems, and offering crucial insights for LLM security research.

Key facts. Cited by 33 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 47 of its 56 references that are in the map. First posted on arXiv 3 Feb 2025.

Builds on

47 of 56 references.

Closest ancestors · 8

Same direction, newest first

  1. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
  2. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models30 Oct
  3. 2024Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks9 Aug
  4. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  5. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  6. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models22 May
  7. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr
  8. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 39

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  4. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  5. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  6. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
  7. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  8. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  9. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  10. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 849
  11. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  12. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
27 more
  1. 2024Retrieval-Augmented Generation for AI-Generated Content: A Surveycited by 354
  2. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  3. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  4. 2022Demystifying Prompts in Language Models via Perplexity Estimationcited by 216
  5. 2021Unsupervised Corpus Aware Language Model Pre-training for Dense Passage Retrievalcited by 203
  6. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 183
  7. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
  8. 2023WebGLM: Towards An Efficient Web-Enhanced Question Answering System with Human Preferencescited by 100
  9. 2023Backdoor Attacks for In-Context Learning with Language Modelscited by 96
  10. 2025The Alternative Annotator Test for LLM-as-a-Judge: How to Statistically Justify Replacing Human Annotators with LLMscited by 74
  11. 2023Search-in-the-Chain: Interactively Enhancing Large Language Models with Search for Knowledge-intensive Taskscited by 73
  12. 2024Retrieval-Augmented Generation for Natural Language Processing: A Surveycited by 71
  13. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  14. 2022PRADA: Practical Black-Box Adversarial Attacks against Neural Ranking Modelscited by 44
  15. 2020Adversarial Semantic Collisionscited by 42
  16. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 40
  17. 2023Stealthy and Persistent Unalignment on Large Language Models via Backdoor Injectionscited by 39
  18. 2022Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Modelscited by 37
  19. 2023Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Methodcited by 29
  20. 2025RbFT: Robust Fine-tuning for Retrieval-Augmented Generation against Retrieval Defectscited by 27
  21. 2020One word at a time: adversarial attacks on retrieval modelscited by 23
  22. 2023Topic-oriented Adversarial Attacks against Black-box Neural Ranking Modelscited by 18
  23. 2023Towards Imperceptible Document Manipulations against Neural Ranking Modelscited by 18
  24. 2024MRAG: A Modular Retrieval Framework for Time-Sensitive Question Answeringcited by 17
  25. 2018Ranking Robustness Under Adversarial Document Manipulationscited by 15
  26. 2024Multi-granular Adversarial Attacks against Black-box Neural Ranking Modelscited by 14
  27. 2024Advancing Annotation of Stance in Social Media Posts: A Comparative Analysis of Large Language Models and Crowd Sourcingcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 10; 2026: 23.

33 papers.

Sort:

By area:

  1. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 18
  2. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Searchcited by 18
  3. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generationcited by 11
  4. 2025RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learningcited by 5
  5. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systemscited by 5
  6. 2025MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attackscited by 4
  7. 2026Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interactioncited by 4
  8. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3
  9. 2025Epistemic Bias Injection: Manipulating LLM Opinion via Selective Context Retrievalcited by 2
  10. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  11. 2026When AI reviews science: Can we trust the referee?cited by 2
  12. 2026Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systemscited by 2
21 more
  1. 2026Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAGcited by 2
  2. 2025MillStone: How Open-Minded Are LLMs?cited by 1
  3. 2025RobustMask: Certified Robustness against Adversarial Neural Ranking Attack via Randomized Maskingcited by 1
  4. 2026RADAR: Defending RAG Dynamically against Retrieval Corruptioncited by 1
  5. 2026DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generationcited by 1
  6. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
  7. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 1
  8. 2026Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systemscited by 1
  9. 2025Provably Secure Retrieval-Augmented Generationcited by 0
  10. 2026Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generationcited by 0
  11. 2026FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruptioncited by 0
  12. 2026CleanBase: Detecting Malicious Documents in RAG Knowledge Databasescited by 0
  13. 2026Led to Mislead: Adversarial Content Injection for Attacks on Neural Ranking Modelscited by 0
  14. 2026Catching the Infection Before It Spreads: Foresight-Guided Defense in Multi-Agent Systemscited by 0
  15. 2026BiRD: A Bidirectional Ranking Defense Mechanism for Retrieval Augmented Generationcited by 0
  16. 2026Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attributioncited by 0
  17. 2026Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerabilitycited by 0
  18. 2026Eliciting Intrinsic Hallucinations in LLMs via Semantically Equivalent Adversarial Attackscited by 0
  19. 2026CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documentscited by 0
  20. 2026The Corroboration Illusion: When More News Makes LLM Forecasts Less Truecited by 0
  21. 2026Poisoned into Action: Context Attacks on Typed Decision Workflowscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models
  2. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
  3. 2025AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt
  4. 2024Ranking Manipulation for Conversational Search Engines
  5. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  6. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
  7. 2025Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems
  8. 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems