RefineRAG: Word-Level Poisoning Attacks via Retriever-Guided Text Refinement
On the map: Retrieval-augmented generation → Privacy and security of RAG
Abstract (arXiv)
Retrieval-Augmented Generation (RAG) significantly enhances Large Language Models (LLMs), but simultaneously exposes a critical vulnerability to knowledge poisoning attacks. Existing attack methods like PoisonedRAG remain detectable due to coarse-grained separate-and-concatenate strategies. To bridge this gap, we propose RefineRAG, a novel framework that treats poisoning as a holistic word-level refinement problem. It operates in two stages: Macro Generation produces toxic seeds guaranteed to induce target answers, while Micro Refinement employs a retriever-in-the-loop optimization to maximize retrieval priority without compromising naturalness. Evaluations on NQ and MSMARCO demonstrate that RefineRAG achieves state-of-the-art effectiveness, securing a 90% Attack Success Rate on NQ, while registering the lowest grammar errors and repetition rates among all baselines. Crucially, our proxy-optimized attacks successfully transfer to black-box victim systems, highlighting a severe practical threat.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 18 of its 27 references that are in the map. First posted on arXiv 8 Apr 2026.
Builds on
18 of 27 references.
Closest ancestors · 2
Same direction, newest first
- 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models26 May
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb
Other references · 16
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,411
- 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
- 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
- 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
- 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 663
- 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
- 2023Benchmarking Large Language Models in Retrieval-Augmented Generationcited by 307
4 more
- 2024Evaluating Retrieval Quality in Retrieval-Augmented Generationcited by 90
- 2024Financial Report Chunking for Effective Retrieval Augmented Generationcited by 46
- 2023QASiNa: Religious Domain Question Answering using Sirah Nabawiyahcited by 14
- 2024MeTMaP: Metamorphic Testing for Detecting False Vector Matching Problems in LLM Augmented Generationcited by 4
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
- 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
- 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation
- 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
- 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
- 2026When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines
- 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems
- 2025DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)