arXiv:2608.21230v1 Announce Type: cross Abstract: Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measu...
arXiv:2609.00470v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) grounds large language models in external corpora, but implicit trust in retrieved documents creates a critical at...
The paper surveys 118 retrieval‑augmented generation (RAG) defense studies, categorizing them by the specific protection endpoint rather than the claimed goal or mechanism. It introduces a seven‑family taxonomy covering content disclosure, privacy proxies, access control, corpus‑use detection, and pipeline integrity, and reports high inter‑annotator agreement (kappa = 0.867). The survey highlights gaps: most studies target non‑primary endpoints, rely on generic QA datasets and non‑adaptive attacks, and fail to prevent private‑fact recovery even when verbatim copying is blocked.
TriShieldRAG introduces a three‑layered defense for Retrieval‑Augmented Generation: an Ingest Guard that screens documents, a Retrieval Scorer that re‑ranks based on trust, and a Cross‑LLM Consensus that validates evidence across three models. Against the original PoisonedRAG attack on the 2.68M‑passage Natural Questions corpus, the framework reduces attack success from about 79% to 1%. However, adaptive attacks that only alter document formatting can bypass the Ingest Guard and still achieve high success rates, revealing limits of layered defenses that rely on the same retrieved evidence.
The paper introduces Trustworthy RAG, an evaluation agent designed to detect misinformation and knowledge poisoning in Retrieval-Augmented Generation systems. It combines natural language inference verification, a five-signal poison detector, and a weighted Trust Index to assess the reliability of retrieved content. Experiments on multiple LLMs show high accuracy and precision, with the agent effectively blocking unsafe advice in a secure-coding assistant scenario.
The paper introduces MONOLOGUE, a single‑document poisoning framework that uses logic hijacking to subtly alter Retrieval‑Augmented Generation (RAG) outputs without overt contradictions. Instead of directly refuting facts, MONOLOGUE frames updates as authoritative historical corrections, embedding counterfactuals into a grounded narrative. The method refines payloads offline through local multi‑dimensional gated optimization, combining text quality audits with surrogate behavioral verification, and demonstrates superior attack efficacy across multiple benchmarks, retrieval backends, and open‑weight generators.
arXiv:2607. 23838v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) lets a large language model answer questions using documents retrieved from an external knowledge base at query time.
CiteVQA is a benchmark that evaluates multimodal large language models on both answering document questions and providing element‑level bounding‑box citations for the evidence used. It contains 1,897 questions across 711 PDFs in seven domains and two languages, with ground‑truth citations generated via an automated pipeline and strict quality control. The evaluation metric, Strict Attributed Accuracy (SAA), rewards a prediction only when both the answer and the cited region are correct, revealing widespread attribution hallucination in current models.
arXiv:2609.22223v1 Announce Type: cross Abstract: Long-form factuality verification is commonly implemented as a static decompose-search-verify pipeline, with separately prompted modules processing c...
DeepSafe‑SciHazard introduces a real‑world‑grounded benchmark for measuring scientific safety risks, comprising 2,400 hazardous and 600 oversafety questions across 12 disciplines. It defines a decomposed harm scoring system, DeHarm‑Score, that evaluates query severity, refusal behavior, and response‑level risk, further breaking down harm into executability and net‑new risk. An expert‑validation study shows DeHarm‑Score aligns 90.17% better with expert judgments than the best baseline, and the benchmark reveals that deep research agents score 32.3% higher on mean DeHarm‑Score than standard LLMs, highlighting a critical blind spot in current safety defenses.
arXiv:2607. 29677v1 Announce Type: new Abstract: Enterprise workflows increasingly rely on agents for \emph{schema-guided extraction}: given a document and a user-defined schema, the agent faithfully follows the schema to produce the correct output with source evidence as grounding metadata.
arXiv:2605.23175v2 Announce Type: replace-cross Abstract: Proprietary large language models (LLMs) face risks of intellectual property (IP) violation, as adversaries can replicate an LLM by collectin...