mlsanityData to 7 Oct 2026

A Wolf in Sheep's Clothing: Targeted Routing Hijacking in Federated RAG

arXiv 2605.28112 ↗First posted 27 May 2026cs.CR cs.CL cs.IRcited by 0

Not on the map. Why?

Abstract (arXiv)

Federated Retrieval-Augmented Generation (FedRAG) is attractive for privacy-sensitive applications because full local corpora remain on clients. As a result, routing must rely on client-provided semantic profiles, creating a new opportunity for manipulation. We introduce Routing Hijacking, a routing-stage attack in which a malicious client forges its profile to attract target queries despite having irrelevant underlying data. We show that this vulnerability is severe. Across three representative FedRAG routing architectures, Routing Hijacking consistently misroutes target queries and leads to downstream disruptions and failures, including missing evidence, poisoning, incorrect answers, and hallucinations. In a controlled MedQA-USMLE stress test, we further show that poisoned retrieved evidence can mislead models across scales, leading to incorrect answers, hallucinations, and sycophantic failures. Existing defenses do not close this gap: encrypted routing preserves the exploited ranking, and Byzantine-robust Federated Learning (FL) rules transfer poorly to heterogeneous routing profiles. To address this gap, we propose a trust-aware post-routing framework that reweights clients using returned-evidence feedback, including retrieval relevance, profile consistency, and cross-client agreement; online experiments show that it suppresses persistent hijacking over recurring queries and transfers to a learned neural router. Our findings establish routing integrity as a security challenge in FedRAG and highlight the need for stronger defenses for secure federated retrieval.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 14 of its 28 references that are in the map. First posted on arXiv 27 May 2026.

Builds on

14 of 28 references.

References · 14

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  4. 2020What Disease does this Patient Have? A Large-scale Open Domain Question Answering Dataset from Medical Examscited by 1,324
  5. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 698
  6. 2020Byzantine-Robust Learning on Heterogeneous Datasets via Bucketingcited by 125
  7. 2025Medical Hallucinations in Foundation Models and Their Impact on Healthcarecited by 89
  8. 2022On the Adversarial Robustness of Mixture of Expertscited by 27
  9. 2024C-FedRAG: A Confidential Federated Retrieval-Augmented Generation Systemcited by 19
  10. 2023Byzantine-Robust Learning on Heterogeneous Data via Gradient Splittingcited by 13
  11. 2025Optimizing Robustness and Accuracy in Mixture of Experts: A Dual-Model Approachcited by 8
  12. 2024ReSLLM: Large Language Models are Strong Resource Selectors for Federated Searchcited by 7
2 more
  1. 2025Privacy-Preserving Federated Embedding Learning for Localized Retrieval-Augmented Generationcited by 7
  2. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  2. 2026An Efficient and Privacy-Preserving Architecture for Cross-Institutional Collaborative RAG
  3. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  4. 2026Private Anytime Selective-Risk Certification for Federated Retrieval-Augmented Generation: Guarantees and Empirical Limits
  5. 2026Mind the Hook: Source-Level Auditing of Privacy Defenses in Retrieval-Augmented Generation
  6. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models
  7. 2026FedWeave: Rethinking the Unit of Specialization in Heterogeneous Federated MoE-LoRA
  8. 2025Federated Retrieval-Augmented Generation: A Systematic Mapping Study