mlsanityData to 7 Oct 2026

EmoRAG: Evaluating RAG Robustness to Symbolic Perturbations

arXiv 2512.01335 ↗First posted 1 Dec 2025cs.CR cs.AI cs.CLcited by 3

On the map: Retrieval-augmented generation → RAG robustness and adaptive retrieval

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) systems are increasingly central to robust AI, enhancing large language model (LLM) faithfulness by incorporating external knowledge. However, our study unveils a critical, overlooked vulnerability: their profound susceptibility to subtle symbolic perturbations, particularly through near-imperceptible emoticon tokens such as "(@_@)" that can catastrophically mislead retrieval, termed EmoRAG. We demonstrate that injecting a single emoticon into a query makes it nearly 100% likely to retrieve semantically unrelated texts that contain a matching emoticon. Our extensive experiment across general question-answering and code domains, using a range of state-of-the-art retrievers and generators, reveals three key findings: (I) Single-Emoticon Disaster: Minimal emoticon injections cause maximal disruptions, with a single emoticon almost 100% dominating RAG output. (II) Positional Sensitivity: Placing an emoticon at the beginning of a query can cause severe perturbation, with F1-Scores exceeding 0.92 across all datasets. (III) Parameter-Scale Vulnerability: Counterintuitively, models with larger parameters exhibit greater vulnerability to the interference. We provide an in-depth analysis to uncover the underlying mechanisms of these phenomena. Furthermore, we raise a critical concern regarding the robustness assumption of current RAG systems, envisioning a threat scenario where an adversary exploits this vulnerability to manipulate the RAG system. We evaluate standard defenses and find them insufficient against EmoRAG. To address this, we propose targeted defenses, analyzing their strengths and limitations in mitigating emoticon-based perturbations. Finally, we outline future directions for building robust RAG systems.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in RAG robustness and adaptive retrieval, one of 15 directions in Retrieval-augmented generation. Builds on 43 of its 77 references that are in the map. First posted on arXiv 1 Dec 2025.

Builds on

43 of 77 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflection17 Oct
  2. 2021End-to-End Training of Multi-Document Reader and Retriever for Open-Domain Question Answering9 Jun

Other references · 41

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  3. 2019BART: Denoising Sequence-to-Sequence Pre-training for Natural Language Generation, Translation, and Comprehensioncited by 5,874
  4. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  5. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,126
  6. 2022Survey of Hallucination in Natural Language Generationcited by 2,056
  7. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  9. 2020CodeBERT: A Pre-Trained Model for Programming and Natural Languagescited by 1,286
  10. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  11. 2022Interleaving Retrieval with Chain-of-Thought Reasoning for Knowledge-Intensive Multi-Step Questionscited by 911
  12. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
29 more
  1. 2020How Much Knowledge Can You Pack Into the Parameters of a Language Model?cited by 713
  2. 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 705
  3. 2022MTEB: Massive Text Embedding Benchmarkcited by 623
  4. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  6. 2023C-Pack: Packed Resources For General Chinese Embeddingscited by 556
  7. 2023Active Retrieval Augmented Generationcited by 506
  8. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  9. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 479
  10. 2020SPECTER: Document-level Representation Learning using Citation-informed Transformerscited by 426
  11. 2020RocketQA: An Optimized Training Approach to Dense Passage Retrieval for Open-Domain Question Answeringcited by 410
  12. 2024Retrieval-Augmented Generation for AI-Generated Content: A Surveycited by 352
  13. 2023Improving Text Embeddings with Large Language Modelscited by 295
  14. 2020Overview of the TREC 2019 deep learning trackcited by 282
  15. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  16. 2022Demystifying Prompts in Language Models via Perplexity Estimationcited by 215
  17. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  18. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 144
  19. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  20. 2023WikiChat: Stopping the Hallucination of Large Language Model Chatbots by Few-Shot Grounding on Wikipediacited by 67
  21. 2021UnitedQA: A Hybrid Approach for Open Domain Question Answeringcited by 42
  22. 2023Unsupervised Dense Retrieval with Relevance-Aware Contrastive Pre-Trainingcited by 35
  23. 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Modelscited by 31
  24. 2022What Are You Token About? Dense Retrieval as Distributions Over the Vocabularycited by 28
  25. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Modelscited by 27
  26. 2022Decoupled Context Processing for Context Augmented Language Modelingcited by 24
  27. 2023QASiNa: Religious Domain Question Answering using Sirah Nabawiyahcited by 14
  28. 2023PORE: Provably Robust Recommender Systems against Data Poisoning Attackscited by 9
  29. 2024FCert: Certifiably Robust Few-Shot Classification in the Era of Foundation Modelscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  2. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
  3. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Out of Style: RAG's Fragility to Linguistic Variation
  2. 2025Evaluating the Retrieval Robustness of Large Language Models
  3. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations
  4. 2024Astute RAG: Overcoming Imperfect Retrieval Augmentation and Knowledge Conflicts for Large Language Models
  5. 2026Mapping the RAG Landscape: A Four Axis Taxonomy of Efficiency, Defense, Interactivity, and Reasoning
  6. 2024The Power of Noise: Redefining Retrieval for RAG Systems
  7. 2025Retrieval-Augmented Generation: A Comprehensive Survey of Architectures, Enhancements, and Robustness Frontiers
  8. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks