Research · curated 15 Jul 2026
Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
CareAttack reveals a practical AI supply-chain attack surface because most RAG systems rely on open-source retrieval models whose parameters can be silently edited to inject malicious knowledge without detectable corpus tampering.
CareAttack is a model-centric attack framework that edits the parameters of open-source dense retrievers (Qwen3-Embedding-0.6B and BGE-M3) to promote malicious passages into the top-k retrieved evidence of RAG systems, bypassing detectable corpus-manipulation approaches. Evaluated on three benchmark datasets, it uses conflict-aware retriever editing and attack-preserving anchor repair to inject malicious knowledge for batches of target prompts while preserving behavior on non-target prompts; code is published.