mlsanityData to 7 Oct 2026

CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models

arXiv 2505.19864 ↗First posted 26 May 2025cs.CRcited by 17

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by incorporating external knowledge, but its openness introduces vulnerabilities that can be exploited by poisoning attacks. Existing poisoning methods for RAG systems have limitations, such as poor generalization and lack of fluency in adversarial texts. In this paper, we propose CPA-RAG, a black-box adversarial framework that generates query-relevant texts capable of manipulating the retrieval process to induce target answers. The proposed method integrates prompt-based text generation, cross-guided optimization through multiple LLMs, and retriever-based scoring to construct high-quality adversarial samples. We conduct extensive experiments across multiple datasets and LLMs to evaluate its effectiveness. Results show that the framework achieves over 90% attack success when the top-k retrieval setting is 5, matching white-box performance, and maintains a consistent advantage of approximately 5 percentage points across different top-k values. It also outperforms existing black-box baselines by 14.5 percentage points under various defense strategies. Furthermore, our method successfully compromises a commercial RAG system deployed on Alibaba's BaiLian platform, demonstrating its practical threat in real-world applications. These findings underscore the need for more robust and secure RAG frameworks to defend against poisoning attacks.

Key facts. Cited by 17 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 39 of its 51 references that are in the map. First posted on arXiv 26 May 2025.

Builds on

39 of 51 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems28 Feb
  2. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  3. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  4. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr

Other references · 35

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  5. 2024Qwen2.5 Technical Reportcited by 4,713
  6. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  7. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  9. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  10. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,411
  11. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  12. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
23 more
  1. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
  2. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 450
  3. 2024InternLM2 Technical Reportcited by 391
  4. 2024Benchmarking Retrieval-Augmented Generation for Medicinecited by 326
  5. 2023Benchmarking Large Language Models in Retrieval-Augmented Generationcited by 307
  6. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  7. 2024LegalBench-RAG: A Benchmark for Retrieval-Augmented Generation in the Legal Domaincited by 113
  8. 2023An LLM can Fool Itself: A Prompt-Based Adversarial Attackcited by 111
  9. 2024Evaluating Retrieval Quality in Retrieval-Augmented Generationcited by 90
  10. 2025MedRAG: Enhancing Retrieval-augmented Generation with Knowledge Graph-Elicited Reasoning for Healthcare Copilotcited by 83
  11. 2024Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attackscited by 78
  12. 2024CBR-RAG: Case-Based Reasoning for Retrieval Augmented Generation in LLMs for Legal Question Answeringcited by 70
  13. 2023Enhancing Financial Sentiment Analysis via Retrieval Augmented Large Language Modelscited by 67
  14. 2024LLMmap: Fingerprinting For Large Language Modelscited by 56
  15. 2024CRUD-RAG: A Comprehensive Chinese Benchmark for Retrieval-Augmented Generation of Large Language Modelscited by 50
  16. 2024Financial Report Chunking for Effective Retrieval Augmented Generationcited by 46
  17. 2024An LLM-Assisted Easy-to-Trigger Backdoor Attack on Code Completion Models: Injecting Disguised Vulnerabilities against Strong Detectioncited by 32
  18. 2025Removal of Hallucination on Hallucination: Debate-Augmented RAGcited by 29
  19. 2025Investigating Language Preference of Multilingual RAG Systemscited by 22
  20. 2024CLERC: A Dataset for Legal Case Retrieval and Retrieval-Augmented Analysis Generationcited by 18
  21. 2023Retrieval-augmented Multilingual Knowledge Editingcited by 13
  22. 2025Multilingual Retrieval-Augmented Generation for Knowledge-Intensive Taskcited by 12
  23. 2025Improving Multilingual Retrieval-Augmented Language Models through Dialectic Reasoning Argumentationscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 5; 2026: 12.

17 papers.

Sort:

By area:

  1. 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 44
  2. 2025RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learningcited by 5
  3. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3
  4. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarkscited by 3
  5. 2025Quantitative Certification of Agentic Tool Selectioncited by 2
  6. 2026Distributed Denial of Science: How Indirect Data Poisoning of AI Systems Can Industrialize Scientific Fraudcited by 2
  7. 2025Bilevel Optimization for Covert Memory Tampering in Heterogeneous Multi-Agent Architectures (XAMT)cited by 1
  8. 2026RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systemscited by 1
  9. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
  10. 2025Quantifying Document Impact in RAG-LLMscited by 0
  11. 2026RefineRAG: Word-Level Poisoning Attacks via Retriever-Guided Text Refinementcited by 0
  12. 2026When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelinescited by 0
5 more
  1. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denialcited by 0
  2. 2026Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injectioncited by 0
  3. 2026RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generationcited by 0
  4. 2026ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attackscited by 0
  5. 2026From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  2. 2026Influence Factors on RAG Poisoning
  3. 2026PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems
  4. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  5. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  6. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
  7. 2025Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems
  8. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models