mlsanityData to 14 Oct 2026

DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection

arXiv 2507.15042 ↗First posted 20 Jul 2025cs.AI cs.IRcited by 5

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Adversarial prompt attacks can significantly alter the reliability of Retrieval-Augmented Generation (RAG) systems by re-ranking them to produce incorrect outputs. In this paper, we present a novel method that applies Differential Evolution (DE) to optimize adversarial prompt suffixes for RAG-based question answering. Our approach is gradient-free, treating the RAG pipeline as a black box and evolving a population of candidate suffixes to maximize the retrieval rank of a targeted incorrect document to be closer to real world scenarios. We conducted experiments on the BEIR QA datasets to evaluate attack success at certain retrieval rank thresholds under multiple retrieving applications. Our results demonstrate that DE-based prompt optimization attains competitive (and in some cases higher) success rates compared to GGPP to dense retrievers and PRADA to sparse retrievers, while using only a small number of tokens (<=5 tokens) in the adversarial suffix. Furthermore, we introduce a readability-aware suffix construction strategy, validated by a statistically significant reduction in MLM negative log-likelihood with Welch's t-test. Through evaluations with a BERT-based adversarial suffix detector, we show that DE-generated suffixes evade detection, yielding near-chance detection accuracy.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 23 of its 34 references that are in the map. First posted on arXiv 20 Jul 2025.

Builds on

23 of 34 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025CtrlRAG: Black-box Document Poisoning Attacks for Retrieval-Augmented Generation of Large Language Models10 Mar

Other references · 22

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  4. 2018FEVER: a large-scale dataset for Fact Extraction and VERificationcited by 1,375
  5. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,252
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  7. 2017One pixel attack for fooling deep neural networkscited by 582
  8. 2020Fact or Fiction: Verifying Scientific Claimscited by 554
  9. 2019Release Strategies and the Social Impacts of Language Modelscited by 513
  10. 2023Detecting Language Model Attacks with Perplexitycited by 431
  11. 2024Generative Representational Instruction Tuningcited by 233
  12. 2023EvoPrompt: Connecting LLMs with Evolutionary Algorithms Yields Powerful Prompt Optimizerscited by 193
10 more
  1. 2024Automatic and Universal Prompt Injection Attacks against Large Language Modelscited by 119
  2. 2024Enhancing LLM Factual Accuracy with RAG to Counter Hallucinations: A Case Study on Domain-Specific Queries in Private Knowledge-Basescited by 77
  3. 2022Black-box Prompt Learning for Pre-trained Language Modelscited by 70
  4. 2024Arctic-Embed: Scalable, Efficient, and Accurate Text Embedding Modelscited by 61
  5. 2025Harnessing the Universal Geometry of Embeddingscited by 55
  6. 2022PRADA: Practical Black-Box Adversarial Attacks against Neural Ranking Modelscited by 44
  7. 2023Token-Level Adversarial Prompt Detection Based on Perplexity Measures and Contextual Informationcited by 33
  8. 2024Goal-guided Generative Prompt Injection Attack on Large Language Modelscited by 24
  9. 2024Prompt Perturbation in Retrieval-Augmented Generation based Large Language Modelscited by 18
  10. 2024Targeting the Core: A Simple and Effective Method to Attack RAG-based Agents via Direct LLM Manipulationcited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 4.

5 papers.

  1. 2025Evaluating the Robustness of Retrieval-Augmented Generation to Adversarial Evidence in the Health Domaincited by 6
  2. 2026ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Modelscited by 5
  3. 2026RADAR: Defending RAG Dynamically against Retrieval Corruptioncited by 1
  4. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
  5. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systemscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
  2. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
  3. 2025AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt
  4. 2025The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems
  5. 2025Adversarial Threat Vectors and Risk Mitigation for Retrieval-Augmented Generation Systems
  6. 2026RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
  7. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  8. 2026SentAttack: A Sentence-Level Black-Box Adversarial Attack Method for Dense Retrieval Models