MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG
On the map: Retrieval-augmented generation → Privacy and security of RAG
also in 2 more
Abstract (arXiv)
Multimodal agentic retrieval-augmented generation (RAG) systems expand the attack surface beyond prompt injection to include text poisoning, image injection, direct-query attacks, and orchestrator-level tool manipulation. Existing red-teaming approaches are typically surface-specific and often recycle known attack templates; on text-poisoning benchmarks we measure 73-84% exact duplication. We present MIRROR, a unified cross-surface framework that performs memory-guided Monte Carlo tree search while conditioning candidate generation on retrieved context under an explicit novelty constraint. A deterministic Novelty Gate rejects any candidate matching the retrieval set under normalized comparison, allowing retrieval to inform search priors without enabling prompt copying. Across four attack surfaces on a multimodal agentic RAG target, MIRROR attains 76% ASR on image poisoning compared with 52% for baselines, 97% ASR on orchestrator attacks at half the query cost, and the lowest cross-surface variance (coefficient of variation 0.47). In contrast, specialized baselines collapse across surfaces: suffix optimization reaches 79% ASR on text poisoning but 1% on direct queries. We release ART-SafeBench with 41,815 in-package records and runtime adapters yielding 41,991+ total records across four surfaces.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 20 of its 23 references that are in the map. First posted on arXiv 25 Jun 2026.
Builds on
20 of 23 references.
Closest ancestors · 5
Same direction, newest first
- 2026CODE: A Contradiction-Based Deliberation Extension Framework for Overthinking Attacks on Retrieval-Augmented Generation19 Jan
- 2026SD-RAG: A Prompt-Injection-Resilient Framework for Selective Disclosure in Retrieval-Augmented Generation16 Jan
- 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool3 Jul
- 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models22 May
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb
Other references · 15
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
- 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
- 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 398
3 more
- 2025RainbowPlus: Enhancing Adversarial Prompt Generation via Evolutionary Quality-Diversity Searchcited by 11
- 2026Digital Red Queen: Adversarial Program Evolution in Core War with LLMscited by 7
- 2025MUSE: MCTS-Driven Red Teaming Framework for Enhanced Multi-Turn Dialogue Safety in Large Language Modelscited by 4
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
- 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases
- 2026KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems
- 2026Backdoor in the Loop: Compromising Agentic Search via Malicious Retrievers
- 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
- 2026MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents
- 2026SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
- 2026Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generation