mlsanityData to 7 Oct 2026

Walking the Embedding Space: Datastore Extraction from Multimodal RAG

arXiv 2610.01871 ↗First posted 1 Oct 2026cs.CR cs.AIcited by 0

On the map: Multimodal LLMs / vision-language models → Document understanding and multimodal RAG also fits: MLLM jailbreaks and adversarial robustness

also in 2 more
Abstract (arXiv)

Multimodal Retrieval-Augmented Generation (MRAG) has emerged as a reliable and cost-effective technique of grounding the generative capabilities of Multimodal Large Language Models (MLLMs) into relevant, up-to-date, external knowledge. Despite presenting several benefits, such as reducing hallucinatory behavior, they also introduce new attack surfaces, including leakage of private information and vulnerabilities against data extraction attacks. In this paper, we introduce immrag, an adaptive and automatic data extraction attack procedure operating in a black box setting against image-returning MRAG, a configuration in which the retrieved visual artifact is itself the response. Each query blends an attacker-held shadow image with an image already recovered from the system, and relevance-weighted resampling steers subsequent queries towards regions of the embedding space that still yield novel retrievals. Unlike current extraction attacks that aim to persuade the model towards data leakage by placing a malicious query as a textual prompt, immrag embeds the malicious instructions inside a user-given input image. We evaluate immrag on three plausible and distinct real-world scenarios: medical assistant, document-focused helper and general purpose tool. The experiments involve the study of the effectiveness of the attack on multiple CLIP-family retrievers, as well as the impact of various generators. A single 2500-query run reconstructs up to 611 distinct radiology images, 566 document scans and 416 general-purpose images under local-feature correspondence, and reaches up to 5.6× as many distinct datastore items as a non-adaptive baseline. Our results show the urgent need for safeguards specifically designed for multimodal data.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Document understanding and multimodal RAG, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 26 of its 55 references that are in the map. First posted on arXiv 1 Oct 2026.

Builds on

26 of 55 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024Enhanced Multimodal RAG-LLM for Accurate Visual Question Answering30 Dec

Other references · 25

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2020Extracting Training Data from Large Language Modelscited by 2,144
  3. 2020DocVQA: A Dataset for VQA on Document Imagescited by 1,288
  4. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  5. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 368
  6. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  7. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 260
  8. 2023Using an LLM to Help With Code Understandingcited by 222
  9. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  10. 2024Lumina-mGPT: Illuminate Flexible Photorealistic Text-to-Image Generation with Multimodal Generative Pretrainingcited by 148
  11. 2024MMed-RAG: Versatile Multimodal RAG System for Medical Vision Language Modelscited by 84
  12. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76
13 more
  1. 2024A Survey on LLM-based Code Generation for Low-Resource and Domain-Specific Programming Languagescited by 65
  2. 2024INVESTORBENCH: A Benchmark for Financial Decision-Making Tasks with LLM-based Agentcited by 62
  3. 2023Assessing Prompt Injection Risks in 200+ Custom GPTscited by 49
  4. 2023Making LLMs Worth Every Penny: Resource-Limited Text Classification in Bankingcited by 36
  5. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  6. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generationcited by 26
  7. 2024REALM: RAG-Driven Enhancement of Multimodal Electronic Health Records Analysis via Large Language Modelscited by 21
  8. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Basescited by 17
  9. 2021AutoLAW: Augmented Legal Reasoning through Legal Precedent Predictioncited by 14
  10. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generationcited by 12
  11. 2025Beyond Text: Unveiling Privacy Vulnerabilities in Multi-modal Retrieval-Augmented Generationcited by 5
  12. 2025HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generationcited by 3
  13. 2026Do Multimodal RAG Systems Leak Data? A Comprehensive Evaluation of Membership Inference and Image Caption Retrieval Attackscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generation
  2. 2026DSPrompt: Dynamic Soft Prompt Defense Against M-RAG Corruption
  3. 2025MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systems
  4. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  5. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors
  6. 2026Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
  7. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models
  8. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks