{"id":"https://openalex.org/W4403663670","doi":"https://doi.org/10.48550/arxiv.2409.08045","title":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking","display_name":"Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreaking","publication_year":2024,"publication_date":"2024-09-12","ids":{"openalex":"https://openalex.org/W4403663670","doi":"https://doi.org/10.48550/arxiv.2409.08045"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2409.08045","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.08045","pdf_url":"https://arxiv.org/pdf/2409.08045","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2409.08045","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5113135611","display_name":"Stav Cohen","orcid":"https://orcid.org/0009-0002-8397-2560","observed_orcids":["https://orcid.org/0009-0002-8397-2560"]},"institutions":[{"id":"https://openalex.org/I174306211","display_name":"Technion \u2013 Israel Institute of Technology","ror":"https://ror.org/03qryx823","country_code":"IL","type":"education","lineage":["https://openalex.org/I174306211"]},{"id":"https://openalex.org/I4405261073","display_name":"Cornell Tech","ror":"https://ror.org/04qscbg47","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295","https://openalex.org/I4405261073"]}],"countries":["IL","US"],"is_corresponding":false,"raw_author_name":"Cohen, Stav","raw_affiliation_strings":["Technion -Israel Institute of Technology , Intuit , Cornell Tech"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technion -Israel Institute of Technology , Intuit , Cornell Tech","institution_ids":["https://openalex.org/I174306211","https://openalex.org/I4405261073"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033439559","display_name":"Ron Bitton","orcid":"https://orcid.org/0000-0001-8942-9783","observed_orcids":["https://orcid.org/0000-0001-8942-9783"]},"institutions":[{"id":"https://openalex.org/I174306211","display_name":"Technion \u2013 Israel Institute of Technology","ror":"https://ror.org/03qryx823","country_code":"IL","type":"education","lineage":["https://openalex.org/I174306211"]},{"id":"https://openalex.org/I4405261073","display_name":"Cornell Tech","ror":"https://ror.org/04qscbg47","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295","https://openalex.org/I4405261073"]}],"countries":["IL","US"],"is_corresponding":false,"raw_author_name":"Bitton, Ron","raw_affiliation_strings":["Technion -Israel Institute of Technology , Intuit , Cornell Tech"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technion -Israel Institute of Technology , Intuit , Cornell Tech","institution_ids":["https://openalex.org/I174306211","https://openalex.org/I4405261073"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5054769926","display_name":"Ben Nassi","orcid":"https://orcid.org/0000-0003-3453-2120","observed_orcids":["https://orcid.org/0000-0003-3453-2120"]},"institutions":[{"id":"https://openalex.org/I174306211","display_name":"Technion \u2013 Israel Institute of Technology","ror":"https://ror.org/03qryx823","country_code":"IL","type":"education","lineage":["https://openalex.org/I174306211"]},{"id":"https://openalex.org/I4405261073","display_name":"Cornell Tech","ror":"https://ror.org/04qscbg47","country_code":"US","type":"education","lineage":["https://openalex.org/I205783295","https://openalex.org/I4405261073"]}],"countries":["IL","US"],"is_corresponding":false,"raw_author_name":"Nassi, Ben","raw_affiliation_strings":["Technion -Israel Institute of Technology , Intuit , Cornell Tech"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Technion -Israel Institute of Technology , Intuit , Cornell Tech","institution_ids":["https://openalex.org/I174306211","https://openalex.org/I4405261073"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":45,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/jailbreaking","display_name":"jailbreaking","score":0.7910000085830688},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.6710000038146973},{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.8949999809265137},{"id":"https://openalex.org/keywords/membership-inference-attacks","display_name":"membership inference attacks","score":0.9570000171661377},{"id":"https://openalex.org/keywords/data-poisoning-attacks","display_name":"data poisoning","score":0.8939999938011169},{"id":"https://openalex.org/keywords/computer-worms","display_name":"computer worms","score":0.7120000123977661},{"id":"https://openalex.org/keywords/adversarial-prompts","display_name":"adversarial prompts","score":0.7760000228881836},{"id":"https://openalex.org/keywords/embeddings","display_name":"embeddings","score":0.7179999947547913},{"id":"https://openalex.org/keywords/chatbots","display_name":"chatbots","score":0.4690000116825104},{"id":"https://openalex.org/keywords/guardrails","display_name":"guardrails","score":0.7559999823570251},{"id":"https://openalex.org/keywords/data-privacy","display_name":"data privacy","score":0.36399999260902405}],"concepts":[{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.7685715556144714},{"id":"https://openalex.org/C148220186","wikidata":"https://www.wikidata.org/wiki/Q7111912","display_name":"Outcome (game theory)","level":2,"score":0.7377322316169739},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.6466351747512817},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4671423137187958},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3735584318637848},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34161576628685},{"id":"https://openalex.org/C205649164","wikidata":"https://www.wikidata.org/wiki/Q1071","display_name":"Geography","level":0,"score":0.2482084035873413},{"id":"https://openalex.org/C58640448","wikidata":"https://www.wikidata.org/wiki/Q42515","display_name":"Cartography","level":1,"score":0.20665767788887024},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.1684069037437439},{"id":"https://openalex.org/C144237770","wikidata":"https://www.wikidata.org/wiki/Q747534","display_name":"Mathematical economics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2409.08045","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.08045","pdf_url":"https://arxiv.org/pdf/2409.08045","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2409.08045","doi":"https://doi.org/10.48550/arxiv.2409.08045","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2409.08045","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2409.08045","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2409.08045","pdf_url":"https://arxiv.org/pdf/2409.08045","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4403663670.pdf","grobid_xml":"https://content.openalex.org/works/W4403663670.grobid-xml"},"referenced_works_count":21,"referenced_works":["https://openalex.org/W3016473712","https://openalex.org/W4384390290","https://openalex.org/W4385374425","https://openalex.org/W4385681674","https://openalex.org/W4387389797","https://openalex.org/W4387559087","https://openalex.org/W4389072033","https://openalex.org/W4391801218","https://openalex.org/W4392012779","https://openalex.org/W4392425374","https://openalex.org/W4393284699","https://openalex.org/W4398795271","https://openalex.org/W4399317088","https://openalex.org/W4399354120","https://openalex.org/W4399553840","https://openalex.org/W4402264152","https://openalex.org/W4405181600","https://openalex.org/W4405181744","https://openalex.org/W4407938156","https://openalex.org/W4408353799","https://openalex.org/W4415800818"],"related_works":["https://openalex.org/W4392538361","https://openalex.org/W4404352866","https://openalex.org/W4399991306","https://openalex.org/W4415981883","https://openalex.org/W7161783429","https://openalex.org/W4407308219","https://openalex.org/W7204018931","https://openalex.org/W7172315782","https://openalex.org/W7172272125","https://openalex.org/W4399317088"],"abstract_inverted_index":{"In":[0,29,119],"this":[1],"paper,":[2,35,125],"we":[3,36,126,259],"show":[4,37,98,127],"that":[5,38,99,128,166],"with":[6],"the":[7,17,30,34,67,74,77,80,87,90,94,105,109,113,120,124,132,147,176,190,197,200,223,226,231,234,236,241,246,251,256,270],"ability":[8],"to":[9,51,62,145,183,264],"jailbreak":[10],"a":[11,57,116,141,152,168,172,185,204,213],"GenAI":[12,95,149,214],"model,":[13],"attackers":[14,39,100,129],"can":[15,40,101,130],"escalate":[16,41,131],"outcome":[18,60],"of":[19,33,76,82,89,104,115,123,134,155,171,192,199,206,216,225,233,245,253],"attacks":[20,45,50,138],"against":[21],"RAG-based":[22,266],"GenAI-powered":[23,143,217],"applications":[24],"in":[25,108,202,255],"severity":[26],"and":[27,46,79,93,178,188,220,243,250,261,268],"scale.":[28],"first":[31],"part":[32,122],"RAG":[42,47,52,114,135,191],"membership":[43],"inference":[44,267],"entity":[48],"extraction":[49,54,72,209],"documents":[53],"attacks,":[55],"forcing":[56,151],"more":[58],"severe":[59],"compared":[61],"existing":[63],"attacks.":[64],"We":[65,97,195],"evaluate":[66,196],"results":[68],"obtained":[69],"from":[70,139],"three":[71],"methods,":[73],"influence":[75],"type":[78,242],"size":[81,88,232,244],"five":[83],"embeddings":[84,247],"algorithms":[85],"employed,":[86,249],"provided":[91],"context,":[92,235],"engine.":[96],"extract":[102],"80%-99.8%":[103],"data":[106,136,208],"stored":[107],"database":[110],"used":[111],"by":[112,160,230],"Q&A":[117],"chatbot.":[118],"second":[121],"scale":[133,154],"poisoning":[137],"compromising":[140,146],"single":[142],"application":[144,182],"entire":[148],"ecosystem,":[150],"greater":[153],"damage.":[156],"This":[157],"is":[158,228],"done":[159],"crafting":[161],"an":[162],"adversarial":[163,237],"self-replicating":[164,238],"prompt":[165,239],"triggers":[167],"chain":[169,205],"reaction":[170],"computer":[173],"worm":[174,201,227],"within":[175,212],"ecosystem":[177,215],"forces":[179],"each":[180],"affected":[181,229],"perform":[184],"malicious":[186],"activity":[187],"compromise":[189],"additional":[193],"applications.":[194],"performance":[198,224],"creating":[203],"confidential":[207],"about":[210],"users":[211],"email":[218],"assistants":[219],"analyze":[221,262],"how":[222],"used,":[240],"algorithm":[248],"number":[252],"hops":[254],"propagation.":[257],"Finally,":[258],"review":[260],"guardrails":[263],"protect":[265],"discuss":[269],"tradeoffs.":[271]},"counts_by_year":[{"year":2026,"cited_by_count":24},{"year":2025,"cited_by_count":20},{"year":2024,"cited_by_count":1}],"updated_date":"2026-11-10T11:39:43.021295","created_date":"2024-10-23T00:00:00"}