mlsanityData to 7 Oct 2026

Document-Authored Control-Signal Impersonation: A Low-Cost Indirect Prompt Attack on RAG Safety Boundaries

arXiv 2606.09005 ↗First posted 8 Jun 2026cs.CR cs.CLcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-augmented generation (RAG) systems often serialize user queries, retrieved documents, metadata, system labels, and task instructions into one natural-language prompt. We study a source-authority boundary failure in this design: attacker-authored retrieved text can impersonate metadata, provenance, authority, or disclosure-policy signals that appear control-relevant to the model. We call this pattern Document-Authored Control-Signal Impersonation (DACSI). DACSI is a non-imperative, metadata-like payload subclass within indirect prompt injection. Its central lesson is simple: document-authored labels are data, not policy. Command-style injection asks the model to ignore, override, or violate policy; DACSI asks whether untrusted document text can be misattributed as an authorized control signal when RAG prompt rendering collapses trusted and untrusted text into the same natural-language channel. We evaluate DACSI across six model settings, prompt-pressure levels, injection baselines, signal taxonomies, RAG-mediated pipelines, system-control probes, a source-authority attribution probe, and synthetic canary formats. We interpret the evidence by model regime rather than as six equal replications: DeepSeek V4 Pro and Qwen3.5-397B provide the cleanest positive lift, DeepSeek V4 Flash is a high-susceptibility setting, GPT-5.5 and Gemini 3.1 Pro Low are strong-boundary probes with selected residual risks, and GLM-4.7 is a saturated leakage boundary case. Across these regimes, DACSI warrants separate evaluation because it uses a command-free metadata/provenance/policy surface, follows a RAG-specific source-authority path, and responds to source/channel separation. The source-authority probe is behavioral attribution evidence, not proof of an internal mechanism.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 26 of its 28 references that are in the map. First posted on arXiv 8 Jun 2026.

Builds on

26 of 28 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 25

  1. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,383
  2. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  3. 2023Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formattingcited by 778
  4. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  5. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  6. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 476
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
  8. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 325
  9. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 237
  10. 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
  11. 2024FaithEval: Can Your Language Model Stay Faithful to Context, Even If "The Moon is Made of Marshmallows"cited by 85
  12. 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 70
13 more
  1. 2024Sufficient Context: A New Lens on Retrieval Augmented Generation Systemscited by 69
  2. 2023Learning to Retrieve In-Context Examples for Large Language Modelscited by 60
  3. 2024Revisiting Demonstration Selection Strategies in In-Context Learningcited by 57
  4. 2025Benchmarking Prompt Sensitivity in Large Language Modelscited by 38
  5. 2023How are Prompts Different in Terms of Sensitivity?cited by 34
  6. 2025FaithfulRAG: Fact-Level Conflict Modeling for Context-Faithful Retrieval-Augmented Generationcited by 27
  7. 2024Model Internals-based Answer Attribution for Trustworthy Retrieval-Augmented Generationcited by 25
  8. 2025Flaw or Artifact? Rethinking Prompt Sensitivity in Evaluating LLMscited by 23
  9. 2025ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Datacited by 17
  10. 2025Resisting Contextual Interference in RAG via Parametric-Knowledge Reinforcementcited by 11
  11. 2024Assessing "Implicit" Retrieval Robustness of Large Language Modelscited by 9
  12. 2024A Reality Check on Context Utilisation for Retrieval-Augmented Generationcited by 9
  13. 2024Synchronous Faithfulness Monitoring for Trustworthy Retrieval-Augmented Generationcited by 6

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  2. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions
  3. 2025The Hidden Threat in Plain Text: Attacking RAG Data Loaders
  4. 2024Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks
  5. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  6. 2025The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems
  7. 2026A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
  8. 2026RAG-CT: Mitigating Privacy Risks on Retrieval-Augmented Generation Systems via Scanning Prompt Distribution