First reported arxiv.org
Research · latest
First reported · updated · 2 reports aclanthology.org
MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Knowledge Poisoning Attacks
MM-PoisonRAG is a research paper presenting local and global knowledge poisoning attacks that disrupt multimodal retrieval-augmented generation (RAG) in multimodal large language models (MLLMs). The work demonstrates how MLLMs' reliance on retrieval exposes them to poisoned knowledge injected into the retrieval corpus, manipulating generated outputs. Details →First reported arxiv.org
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
The paper "Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection" presents RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization. Experiments on CIC-UNSW-NB15 show recovery under knowledge poisoning and reduced label-flip success under prompt injection when using multi-document retrieval. Details →First reported · updated · 2 reports acm.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
A SIGIR paper presents SilentRetrieval, a two-stage RAG data-poisoning attack that uses Coordinated Beam Search and Context-Adaptive Trigger Generation to craft fluent, low-perplexity adversarial documents that remain retrievable and hijack answers, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, and retaining 74.2% HR@10 at a 0.016% poisoning ratio on a 21M-passage corpus. The work also evaluates combined retrieval- and generation-side defenses (reducing ASR-LLM to ~21-25%) and proposes detection via document-level attention collapse. Details →First reported arxiv.org
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse
Researchers from University of Technology Sydney and collaborators present D-SCAN (Document-level Signal Collapse Analysis), a lightweight framework that detects RAG poisoning attacks by monitoring an internal signature they call 'Attention Collapse'—where a generator's attention entropy decreases and concentrates on injected adversarial documents. The paper shows that output-side signals like perplexity fail because poisoned outputs can exhibit lower perplexity (false confidence), and that D-SCAN can detect attacks even when they do not alter the final answer, with code released on GitHub. Details →First reported arxiv.org
When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAG
Researchers present TabooRAG, a blocking attack against Retrieval-Augmented Generation systems that exploits what they call 'alignment homogeneity'—shared refusal criteria across safety-aligned LLMs—to craft poisoned documents that cause models to refuse benign queries. Rather than injecting instructions, TabooRAG builds query-relevant risk context in a surrogate environment and transfers it to unknown target systems, achieving state-of-the-art attack success across nine LLMs and three datasets with a 67.3% relative gain over baselines even after prompt-injection filtering. Details →First reported icml.cc
ICML Poster Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
"Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors," an ICML 2026 poster by Yen-Shan Chen and colleagues, presents a RAG data-poisoning technique that uses transferable attention-steering "attractors" to manipulate retrieval-augmented generation systems. The abstract is truncated, but the work is framed as a scalable, transferable poisoning attack against RAG pipelines. Details →First reported arxiv.org
Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?
A paper by Yimeng Chen, Nathanaël Denis, Roberto Di Pietro and Jürgen Schmidhuber formalizes 'self-state attacks,' in which a self-hosted AI agent is compromised by corruption of its own memory and configuration files via legitimate OS system calls. The authors characterize a four-axis attack space rendered as a 23-cell matrix with 43 concrete file operations, evaluate a layered OS-level defense against injected activity traces, and find that four attack cells (concentrated on memory-file writes) remain structurally indistinguishable at the OS level. Details →First reported sciencedirect.com
A systematic analysis of LLM backdoor-integrated cyberattacks: Feasibility, impact factors, and realistic case studies in agent systems
A peer-reviewed study in Applied Soft Computing proposes an LLM backdoor-integrated cyberattack framework with a five-stage attack flow, from poisoned data construction to final execution, and empirically validates it across 5 LLM-based agent configurations and multiple models in realistic scenarios including flight control and database interaction. The authors analyze how backdoor vulnerabilities in LLMs propagate into agent systems and identify six key factors affecting attack success. Details →First reported arxiv.org
The Injection Paradox: Brand-Level Suppression in Safety-Trained LLM Recommendations via RAG Context Injection
The paper 'The Injection Paradox' by Hyunseok Paeng documents a reproducible failure mode in RAG-based LLM recommendation systems where indirect prompt injections embedded in retrieved documents backfire, suppressing the injected brand below its injection-free baseline. In safety-trained Claude models (e.g., Claude Opus 4.6), a single injected document drops the target brand from a 54% baseline to zero top-2 recommendations and propagates suppression to the brand's uninjected documents, while GPT models instead show increased recommendations. The authors note this enables a reverse-attack scenario where an adversary injects a competitor's documents to suppress that competitor, and release code, prompts, and results. Details →First reported arxiv.org
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
A research paper by Gulshan Saleem and colleagues presents a three-layer middleware framework to defend RAG-based chatbots against both direct and indirect prompt injection, combining input screening, a provenance-based instruction hierarchy during context assembly, and output auditing. Evaluated on 5,080 samples across GPT-4o, Llama 3, and Mistral 7B, the framework reduced Attack Success Rate from 71.4% to 11.3% while maintaining a 4.8% false positive rate and 61.2 ms median latency overhead. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector