RAGSentinel is a training‑free, label‑free defense designed for black‑box retrieval‑augmented generation systems. It employs a surrogate encoder to detect hidden‑state shifts caused by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. The method is proven to recover a poison‑free majority context under honest‑majority and representation‑separation assumptions, and experiments show it keeps attack success rates low while maintaining accuracy across multiple datasets, LLM families, and adaptive attacks.
By Yueyang Quan, Anjun Gao, Yufei Xia, Minghong Fang, Zhuqing Liu
arXiv:2603. 22934v3 Announce Type: replace Abstract: Retrieval-Augmented Generation (RAG) improves large language model applications by grounding generation in retrieved evidence, but also introduces corpus poisoning as a new attack surface.
By Xiangyu Yin, Yi Qi, Chih-Hong Cheng
The paper introduces the Hop-Decayed Influence (HDI) attack, which targets auxiliary schema-level structures—semantic summaries, hierarchical edges, and pre-computed scores—used in GraphRAG pipelines for retrieval prioritisation. By propagating query-aware influence, HDI identifies high-impact targets and corrupts a minuscule fraction (as low as 0.016%) of these structures, achieving an 88–94% success rate across HotpotQA and 2WikiMultiHopQA benchmarks on Microsoft GraphRAG and HippoRAG2 architectures. The modifications affect up to six queries each, yielding a 1:N amplification that instance-level attacks cannot achieve, and they evade perplexity and paraphrase defenses with over 99% evasion, exposing a structural blind spot in current GraphRAG defenses.
By Jisung Park, John Le, Heath Cooper
The paper introduces S‑GAP, a stealthy graph attack primitive that unifies textual and structural perturbations into a single coherent attack intent for Graph Large Language Models (GraphLLMs). By iteratively refining the semantic content of the GAP through a multi‑agent framework, S‑GAP achieves higher attack success rates and produces more relationally plausible perturbations compared to existing methods. Experiments on four datasets and three GraphLLMs demonstrate an average 7.02% improvement in attack success rate, revealing significant vulnerabilities in current GraphLLMs.
By Wenda Li, Tongya Zheng, Shunyu Liu, Hanyang Yuan, Kaixuan Chen, Yu Wang, Yuchen Ying, Haoze Jiang, Huan Li, Gang Chen, Zujie Ren
arXiv:2607. 23838v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) lets a large language model answer questions using documents retrieved from an external knowledge base at query time.
By Susil Kumar Mohanty, Rohit Patel, Kosuru Yuvaraj, Jeenal Chaudhary, Disha Singhania
arXiv:2604. 08304v3 Announce Type: replace-cross Abstract: Retrieval-augmented generation (RAG) extends large language models (LLMs) with external knowledge, but this access path also introduces security risks that existing work often conflates with inherent LLM flaws.
By Yuming Xu, Mingtao Zhang, Zhuohan Ge, Haoyang Li, Nicole Hu, Yongqi Zhang, Zhiyuan Wen, Jason Chen Zhang, Qing Li, Lei Chen