mlsanityData to 14 Oct 2026

Traceback of Poisoning Attacks to Retrieval-Augmented Generation

arXiv 2504.21668 ↗First posted 30 Apr 2025cs.CR cs.IR cs.LGcited by 28

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Large language models (LLMs) integrated with retrieval-augmented generation (RAG) systems improve accuracy by leveraging external knowledge sources. However, recent research has revealed RAG's susceptibility to poisoning attacks, where the attacker injects poisoned texts into the knowledge database, leading to attacker-desired responses. Existing defenses, which predominantly focus on inference-time mitigation, have proven insufficient against sophisticated attacks. In this paper, we introduce RAGForensics, the first traceback system for RAG, designed to identify poisoned texts within the knowledge database that are responsible for the attacks. RAGForensics operates iteratively, first retrieving a subset of texts from the database and then utilizing a specially crafted prompt to guide an LLM in detecting potential poisoning texts. Empirical evaluations across multiple datasets demonstrate the effectiveness of RAGForensics against state-of-the-art poisoning attacks. This work pioneers the traceback of poisoned texts in RAG systems, providing a practical and promising defense mechanism to enhance their security. Our code is available at: https://github.com/zhangbl6618/RAG-Responsibility-Attribution

Key facts. Cited by 28 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 29 of its 41 references that are in the map. First posted on arXiv 30 Apr 2025.

Builds on

29 of 41 references.

Closest ancestors · 4

Same direction, newest first

  1. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  2. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  3. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  4. 2024Certifiably Robust RAG against Retrieval Corruption24 May

Other references · 25

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  4. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  5. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  7. 2021Improving language models by retrieving from trillions of tokenscited by 1,293
  8. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
  9. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  10. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  11. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
  12. 2023Benchmarking Large Language Models in Retrieval-Augmented Generationcited by 312
13 more
  1. 2017Certified Defenses for Data Poisoning Attackscited by 303
  2. 2024The Power of Noise: Redefining Retrieval for RAG Systemscited by 281
  3. 2018Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learningcited by 225
  4. 2020Blind Backdoors in Deep Learning Modelscited by 182
  5. 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 135
  6. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 134
  7. 2024Evaluating Retrieval Quality in Retrieval-Augmented Generationcited by 90
  8. 2024Byzantine-Robust Decentralized Federated Learningcited by 48
  9. 2021Poison Forensics: Traceback of Data Poisoning Attacks in Neural Networkscited by 40
  10. 2022AFLGuard: Byzantine-robust Asynchronous Federated Learningcited by 29
  11. 2025Do We Really Need to Design New Byzantine-robust Aggregation Rules?cited by 15
  12. 2024Poisoning Attacks on Federated Learning-based Wireless Traffic Predictioncited by 10
  13. 2024Reconstruction of Differentially Private Text Sanitization via Large Language Modelscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 6; 2026: 22.

28 papers.

Sort:

By area:

  1. 2025Secure Retrieval-Augmented Generation against Poisoning Attackscited by 19
  2. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 18
  3. 2025Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generationcited by 12
  4. 2026Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memorycited by 9
  5. 2025AttnTrace: Contextual Attribution of Prompt Injection and Knowledge Corruptioncited by 7
  6. 2025NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledgecited by 7
  7. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systemscited by 7
  8. 2026AC4A: Access Control for Agentscited by 5
  9. 2026Beware What You Autocomplete: Forensic Attribution of Backdoored Code Completionscited by 4
  10. 2026BenchOverflow: Measuring Overflow in Large Language Models via Plain-Text Promptscited by 3
  11. 2025Medusa: Cross-Modal Transferable Adversarial Attacks on Multimodal Medical Retrieval-Augmented Generationcited by 2
  12. 2026ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoningcited by 2
16 more
  1. 2026Patcher: Post-Hoc Patching of Backdoored Large Language Modelscited by 2
  2. 2026Who Broke the System? Failure Localization in LLM-Based Multi-Agent Systemscited by 2
  3. 2026KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generationcited by 1
  4. 2026ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Coveringcited by 1
  5. 2026RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systemscited by 1
  6. 2026Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidencecited by 1
  7. 2026DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generationcited by 1
  8. 2026Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directionscited by 1
  9. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systemscited by 0
  10. 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
  11. 2026Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injectioncited by 0
  12. 2026Evaluating Agentic Code Repair Capabilities in Distributed Systemscited by 0
  13. 2026ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attackscited by 0
  14. 2026Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectivescited by 0
  15. 2026InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generationcited by 0
  16. 2026The Corroboration Illusion: When More News Makes LLM Forecasts Less Truecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  2. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
  3. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
  4. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
  5. 2026Influence Factors on RAG Poisoning
  6. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis
  7. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems
  8. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation