Research
PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization | Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval
Publication date not yet evaluated · Added · 4 reports acm.org
Page published
Coverage timeline
Why it matters
RAG corpus poisoning that stays fluent and evades perplexity filters lets attackers steer LLM answers at very low poisoning ratios (0.016% in a 21M-passage corpus), undermining the integrity of retrieval-augmented deployments defenders increasingly rely on.
A SIGIR 2025 research paper (titled PR-Attack, describing a method called SilentRetrieval) presents a two-stage data-poisoning attack that hijacks Retrieval-Augmented Generation systems using adversarially crafted but fluent documents. It combines Coordinated Beam Search to keep poisoned host documents retrievable while constraining perplexity and Context-Adaptive Trigger Generation to fuse triggers with content, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, with cross-model and cross-retriever transfer including ColBERT and commercial embedding models.