mlsanityData to 14 Oct 2026

The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems

arXiv 2505.18583 ↗First posted 24 May 2025cs.IRcited by 10

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

We explore adversarial attacks against retrieval-augmented generation (RAG) systems to identify their vulnerabilities. We focus on generating human-imperceptible adversarial examples and introduce a novel imperceptible retrieve-to-generate attack against RAG. This task aims to find imperceptible perturbations that retrieve a target document, originally excluded from the initial top-k candidate set, in order to influence the final answer generation. To address this task, we propose ReGENT, a reinforcement learning-based framework that tracks interactions between the attacker and the target RAG and continuously refines attack strategies based on relevance-generation-naturalness rewards. Experiments on newly constructed factual and non-factual question-answering benchmarks demonstrate that ReGENT significantly outperforms existing attack methods in misleading RAG systems with small imperceptible text perturbations.

Key facts. Cited by 10 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 32 of its 39 references that are in the map. First posted on arXiv 24 May 2025.

Builds on

32 of 39 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  2. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr

Other references · 30

  1. 2017Proximal Policy Optimization Algorithmscited by 15,215
  2. 2024The Llama 3 Herd of Modelscited by 14,715
  3. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  4. 2024Qwen2.5 Technical Reportcited by 4,942
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  7. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
  8. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  9. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  10. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
  11. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  12. 2022Atlas: Few-shot Learning with Retrieval Augmented Language Modelscited by 952
18 more
  1. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  2. 2023In-Context Retrieval-Augmented Language Modelscited by 702
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  4. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 491
  5. 2021Unsupervised Corpus Aware Language Model Pre-training for Dense Passage Retrievalcited by 203
  6. 2022DocPrompting: Generating Code by Retrieving the Docscited by 153
  7. 2023A Multi-Task Embedder For Retrieval Augmented LLMscited by 64
  8. 2022Tevatron: An Efficient and Flexible Toolkit for Dense Retrievalcited by 47
  9. 2022PRADA: Practical Black-Box Adversarial Attacks against Neural Ranking Modelscited by 44
  10. 2022Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Modelscited by 37
  11. 2023Black-box Adversarial Attacks against Dense Retrieval Models: A Multi-view Contrastive Learning Methodcited by 29
  12. 2024SmartRAG: Jointly Learn RAG-Related Tasks From the Environment Feedbackcited by 19
  13. 2023Topic-oriented Adversarial Attacks against Black-box Neural Ranking Modelscited by 18
  14. 2024Robust Neural Information Retrieval: An Adversarial and Out-of-distribution Perspectivecited by 15
  15. 2024Multi-granular Adversarial Attacks against Black-box Neural Ranking Modelscited by 14
  16. 2023Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Offcited by 7
  17. 2024Attack-in-the-Chain: Bootstrapping Large Language Models for Attacks Against Black-box Neural Ranking Modelscited by 6
  18. 2024On the Robustness of Generative Information Retrieval Modelscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 8.

10 papers.

  1. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  2. 2025RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbationscited by 4
  3. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3
  4. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  5. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 1
  6. 2026CodePoisonRAG: Knowledge Poisoning Attacks on Retrieval-Augmented Code Generationcited by 1
  7. 2026BiRD: A Bidirectional Ranking Defense Mechanism for Retrieval Augmented Generationcited by 0
  8. 2026Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerabilitycited by 0
  9. 2026Eliciting Intrinsic Hallucinations in LLMs via Semantically Equivalent Adversarial Attackscited by 0
  10. 2026Micro-Collaborative Poisoning: A Distributed Attack on RAG Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
  2. 2025AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt
  3. 2026SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
  4. 2025DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection
  5. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  6. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models
  7. 2026RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
  8. 2024Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models