Rent‑a‑RAG introduces DirBucket, a provider‑side semantic watermarking system that embeds documents with meaning‑preserving paraphrases biased toward secret directions, allowing black‑box auditing of document reuse in multi‑provider retrieval‑augmented generation (RAG). The method consistently detects non‑compliance on a challenging benchmark, achieving strong target detection with no false positives and surviving adversarial post‑answer laundering. DirBucket’s detection transfers unchanged to real‑world corpora in clinical, cyber‑threat‑intelligence, and legal domains, demonstrating that embedding‑space watermarking can make third‑party RAG document reuse statistically auditable.
arXiv:2606. 11265v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate downstream model outputs through malicious knowledge injection.
By Xi Nie, Hongwei Li, Shenghao Wu, Mingxuan Li, Jiachen Li, Wenbo Jiang
arXiv:2609.00470v1 Announce Type: new
Abstract: Retrieval-Augmented Generation (RAG) grounds large language models in external corpora, but implicit trust in retrieved documents creates a critical at...
By Muhaimin Bin Munir, Akib Jawad Ononto, Nazia Shehnaz Joynab, Bhavani Thuraisingham, Latifur Khan
arXiv:2502.10673v2 Announce Type: replace-cross
Abstract: Retrieval-Augmented Generation (RAG) has become an effective method for enhancing large language models (LLMs) with up-to-date knowledge. How...
By Yepeng Liu, Xuandong Zhao, Dawn Song, Yuheng Bu
arXiv:2606.17467v3 Announce Type: replace-cross
Abstract: Prompt injection defenses evaluated on synthetic benchmarks do not generalize to real enterprise documents, which are longer, denser, and int...
By Aaditya Pai
RAGSentinel is a training‑free, label‑free defense designed for black‑box retrieval‑augmented generation systems. It employs a surrogate encoder to detect hidden‑state shifts caused by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. The method is proven to recover a poison‑free majority context under honest‑majority and representation‑separation assumptions, and experiments show it keeps attack success rates low while maintaining accuracy across multiple datasets, LLM families, and adaptive attacks.
By Yueyang Quan, Anjun Gao, Yufei Xia, Minghong Fang, Zhuqing Liu
arXiv:2608. 28389v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers.
By Jaewon Jung, Haizhong Zheng, Hongsun Jang, Jaeyong Song, Beidi Chen, Jinho Lee
arXiv:2609.07075v1 Announce Type: new
Abstract: Retrieval-augmented generation (RAG) is commonly evaluated by whether the final answer is correct. That test is insufficient: an answer can match its r...
By Ramon Gonzalez, Antonio Diaz
arXiv:2508. 09105v3 Announce Type: replace Abstract: Retrieval-Augmented Generation (RAG) and its Multimodal Retrieval-Augmented Generation (MRAG) significantly improve the knowledge coverage and contextual understanding of Large Language Models (LLMs) by introducing external knowledge sources.
By Shixuan Sun, Siyuan Liang, Jianjie Huang, Jingzhi Li, Xiaochun Cao
arXiv:2607. 26339v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence.
By Pushkal Kumar, Tucker Nielson, Tanish Kolhe, Shubham Zala, Vincent Li
arXiv:2604. 19047v2 Announce Type: replace-cross Abstract: Existing QA benchmarks typically assume distinct documents with minimal overlap, yet real-world retrieval-augmented generation (RAG) systems operate on corpora such as financial reports, legal codes, and patents, where information is highly redundant and documents exhibit strong inter-document similarity.
By Hanjun Cho, Jay-Yoon Lee
arXiv:2603. 22934v3 Announce Type: replace Abstract: Retrieval-Augmented Generation (RAG) improves large language model applications by grounding generation in retrieved evidence, but also introduces corpus poisoning as a new attack surface.
By Xiangyu Yin, Yi Qi, Chih-Hong Cheng