mlsanityData to 7 Oct 2026

Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution

arXiv 2606.25721 ↗First posted 24 Jun 2026cs.CR cs.CL cs.IRcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate model outputs through malicious retrieved documents. Existing detection methods typically rely on auxiliary classifiers or additional LLM-based verification, introducing substantial computational overhead. We present TRACE, a lightweight detection framework that identifies poisoning attacks by tracing answer-related tokens through token influence attribution. TRACE first discovers recurrent high-influence keywords across retrieved documents and then performs a secondary verification to confirm their influence on model predictions. Experiments on three QA benchmarks and six LLMs demonstrate strong detection performance while simultaneously uncovering attacker-specified target answers.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 32 of its 40 references that are in the map. First posted on arXiv 24 Jun 2026.

Builds on

32 of 40 references.

Closest ancestors · 22

Same direction, newest first

  1. 2026Addressing Corpus Knowledge Poisoning Attacks on RAG Using Sparse Attention4 Feb
  2. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation30 Dec
  3. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks28 Oct
  4. 2025RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbations13 Oct
  5. 2025ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking11 Oct
  6. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search27 Sep
  7. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
  8. 2025GRADA: Graph-based Reranking against Adversarial Documents Attack12 May
  9. 2025CtrlRAG: Black-box Document Poisoning Attacks for Retrieval-Augmented Generation of Large Language Models10 Mar
  10. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models3 Feb
  11. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model28 Jan
  12. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
10 more
  1. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation1 Jan
  2. 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks21 Dec
  3. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis28 Nov
  4. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  5. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  6. 2024Corpus Poisoning via Approximate Greedy Gradient Descent7 Jun
  7. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  8. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  9. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr
  10. 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning13 Feb

Other references · 10

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  2. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  3. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  4. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  5. 2025Phi-4-Mini Technical Report: Compact yet Powerful Multimodal Language Models via Mixture-of-LoRAscited by 491
  6. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
  7. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  8. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 100
  9. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 12
  10. 2025RAGuard: A Novel Approach for in-context Safe Retrieval Augmented Generation for LLMscited by 5

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
  2. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation
  3. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
  4. 2025Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection
  5. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  6. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
  7. 2026RefineRAG: Word-Level Poisoning Attacks via Retriever-Guided Text Refinement
  8. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial