The paper introduces DirBucket, a provider-side semantic watermarking system designed to audit document reuse in third‑party retrieval‑augmented generation (RAG) marketplaces. By embedding watermarks as meaning‑preserving paraphrases biased toward provider‑specific directions, DirBucket enables black‑box detection of unauthorized document reuse while maintaining retrieval quality. Experiments on mixed‑provider benchmarks show DirBucket consistently detects non‑compliance within 23 answers, resists adversarial laundering, and transfers effectively to real‑world corpora.
By Alexandr Goultiaev Tolstokorov, Kyriakos Mouratidis, Javad Dogani, Nikolaos Laoutaris
arXiv:2606. 11265v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate downstream model outputs through malicious knowledge injection.
By Xi Nie, Hongwei Li, Shenghao Wu, Mingxuan Li, Jiachen Li, Wenbo Jiang
RAGSentinel is a training‑free, label‑free defense designed for black‑box retrieval‑augmented generation systems. It employs a surrogate encoder to detect hidden‑state shifts caused by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. The method is proven to recover a poison‑free majority context under honest‑majority and representation‑separation assumptions, and experiments show it keeps attack success rates low while maintaining accuracy across multiple datasets, LLM families, and adaptive attacks.
By Yueyang Quan, Anjun Gao, Yufei Xia, Minghong Fang, Zhuqing Liu
arXiv:2609.00470v1 Announce Type: new
Abstract: Retrieval-Augmented Generation (RAG) grounds large language models in external corpora, but implicit trust in retrieved documents creates a critical at...
By Muhaimin Bin Munir, Akib Jawad Ononto, Nazia Shehnaz Joynab, Bhavani Thuraisingham, Latifur Khan
arXiv:2502.10673v2 Announce Type: replace-cross
Abstract: Retrieval-Augmented Generation (RAG) has become an effective method for enhancing large language models (LLMs) with up-to-date knowledge. How...
By Yepeng Liu, Xuandong Zhao, Dawn Song, Yuheng Bu
arXiv:2606.17467v3 Announce Type: replace-cross
Abstract: Prompt injection defenses evaluated on synthetic benchmarks do not generalize to real enterprise documents, which are longer, denser, and int...
By Aaditya Pai
arXiv:2609.07075v1 Announce Type: new
Abstract: Retrieval-augmented generation (RAG) is commonly evaluated by whether the final answer is correct. That test is insufficient: an answer can match its r...
By Ramon Gonzalez, Antonio Diaz
arXiv:2608. 28389v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers.
By Jaewon Jung, Haizhong Zheng, Hongsun Jang, Jaeyong Song, Beidi Chen, Jinho Lee
arXiv:2508. 09105v3 Announce Type: replace Abstract: Retrieval-Augmented Generation (RAG) and its Multimodal Retrieval-Augmented Generation (MRAG) significantly improve the knowledge coverage and contextual understanding of Large Language Models (LLMs) by introducing external knowledge sources.
By Shixuan Sun, Siyuan Liang, Jianjie Huang, Jingzhi Li, Xiaochun Cao
arXiv:2607. 26339v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence.
By Pushkal Kumar, Tucker Nielson, Tanish Kolhe, Shubham Zala, Vincent Li
arXiv:2603. 22934v3 Announce Type: replace Abstract: Retrieval-Augmented Generation (RAG) improves large language model applications by grounding generation in retrieved evidence, but also introduces corpus poisoning as a new attack surface.
By Xiangyu Yin, Yi Qi, Chih-Hong Cheng
VerTox is a framework that turns corpus poisoning of neural ranking models into a verifiable reward‑guided reinforcement learning problem. By fine‑tuning compact large language models with reward shaping that couples ranking distortion and factual corruption, VerTox generates fluent, low‑perplexity adversarial documents that frequently outrank target items across multiple ranking architectures, including a commercial embedding model. Experiments show near‑perfect attack success and significant degradation of downstream retrieval‑augmented generation performance.
By Zhiqi Huang, Vivek Datla, Zhichao Xu, Puxuan Yu, Vivek Srikumar, Alfy Samuel