{"id":"https://openalex.org/W4412376959","doi":"https://doi.org/10.1145/3726302.3730058","title":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","display_name":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","publication_year":2025,"publication_date":"2025-07-13","ids":{"openalex":"https://openalex.org/W4412376959","doi":"https://doi.org/10.1145/3726302.3730058"},"language":"en","primary_location":{"id":"doi:10.1145/3726302.3730058","doi":"https://doi.org/10.1145/3726302.3730058","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3726302.3730058","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","source":{"id":"https://openalex.org/S4363608773","display_name":"International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5115594043","display_name":"Yang Jiao","orcid":"https://orcid.org/0000-0001-9468-1000","observed_orcids":["https://orcid.org/0000-0001-9468-1000"]},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Jiao","raw_affiliation_strings":["Tongji University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9468-1000","affiliations":[{"raw_affiliation_string":"Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100382658","display_name":"Xiaodong Wang","orcid":"https://orcid.org/0000-0002-2945-9240","observed_orcids":["https://orcid.org/0000-0002-2945-9240"]},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaodong Wang","raw_affiliation_strings":["Columbia University, New York, NY, USA"],"raw_orcid":"https://orcid.org/0000-0002-2945-9240","affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100420873","display_name":"Kai Yang","orcid":"https://orcid.org/0000-0002-5983-198X","observed_orcids":["https://orcid.org/0000-0002-5983-198X"]},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Yang","raw_affiliation_strings":["Tongji University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-5983-198X","affiliations":[{"raw_affiliation_string":"Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":5.9453,"has_fulltext":true,"cited_by_count":6,"citation_normalized_percentile":{"value":0.96682355,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"656","last_page":"667"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.9800000190734863},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.7200000286102295},{"id":"https://openalex.org/keywords/backdoor-attacks","display_name":"backdoor attacks","score":0.8059999942779541},{"id":"https://openalex.org/keywords/prompt-injection","display_name":"prompt injection","score":0.5450000166893005},{"id":"https://openalex.org/keywords/backdoor-triggers","display_name":"backdoor triggers","score":0.6819999814033508},{"id":"https://openalex.org/keywords/bi-level-optimization","display_name":"bi-level optimization","score":0.9049999713897705},{"id":"https://openalex.org/keywords/attack-stealth","display_name":"attack stealth","score":0.8050000071525574},{"id":"https://openalex.org/keywords/llm-security","display_name":"LLM security","score":0.6259999871253967},{"id":"https://openalex.org/keywords/hallucinations","display_name":"hallucinations","score":0.609000027179718}],"concepts":[{"id":"https://openalex.org/C3309286","wikidata":"https://www.wikidata.org/wiki/Q4907693","display_name":"Bilevel optimization","level":3,"score":0.8946176767349243},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7829189896583557},{"id":"https://openalex.org/C137836250","wikidata":"https://www.wikidata.org/wiki/Q984063","display_name":"Optimization problem","level":2,"score":0.23463517427444458},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.22452819347381592}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1145/3726302.3730058","doi":"https://doi.org/10.1145/3726302.3730058","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3726302.3730058","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","source":{"id":"https://openalex.org/S4363608773","display_name":"International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2504.07717","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2504.07717","pdf_url":"https://arxiv.org/pdf/2504.07717","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2504.07717","doi":"https://doi.org/10.48550/arxiv.2504.07717","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2504.07717","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1145/3726302.3730058","doi":"https://doi.org/10.1145/3726302.3730058","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3726302.3730058","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","source":{"id":"https://openalex.org/S4363608773","display_name":"International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G4377131734","display_name":null,"funder_award_id":"12371519","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5975532895","display_name":"\u9762\u5411\u5220\u9664\u4fe1\u9053\u7684\u6781\u5316\u7801\u8bd1\u7801\u7b97\u6cd5\u7406\u8bba\u4e0e\u8bef\u7801\u6027\u80fd\u7814\u7a76","funder_award_id":"61771013","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322449","display_name":"Tongji University","ror":"https://ror.org/03rc6as71"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4412376959.pdf","grobid_xml":"https://content.openalex.org/works/W4412376959.grobid-xml"},"referenced_works_count":63,"referenced_works":["https://openalex.org/W1528703258","https://openalex.org/W1978583881","https://openalex.org/W2889787757","https://openalex.org/W2899708929","https://openalex.org/W2912924812","https://openalex.org/W2990138404","https://openalex.org/W2997072274","https://openalex.org/W3035367371","https://openalex.org/W3152844947","https://openalex.org/W3158635868","https://openalex.org/W3165542705","https://openalex.org/W3170720259","https://openalex.org/W3202650012","https://openalex.org/W4210693780","https://openalex.org/W4284668485","https://openalex.org/W4284673705","https://openalex.org/W4284707459","https://openalex.org/W4319793479","https://openalex.org/W4365211555","https://openalex.org/W4365799947","https://openalex.org/W4367628274","https://openalex.org/W4386076300","https://openalex.org/W4389518888","https://openalex.org/W4389519591","https://openalex.org/W4389519982","https://openalex.org/W4389523893","https://openalex.org/W4391974622","https://openalex.org/W4392487838","https://openalex.org/W4392903596","https://openalex.org/W4392904091","https://openalex.org/W4393147129","https://openalex.org/W4393147313","https://openalex.org/W4393157467","https://openalex.org/W4393160110","https://openalex.org/W4393161188","https://openalex.org/W4395443988","https://openalex.org/W4399807068","https://openalex.org/W4400484832","https://openalex.org/W4400524868","https://openalex.org/W4400525546","https://openalex.org/W4400527475","https://openalex.org/W4400528650","https://openalex.org/W4400529080","https://openalex.org/W4401508509","https://openalex.org/W4401856724","https://openalex.org/W4401863775","https://openalex.org/W4401864009","https://openalex.org/W4402264157","https://openalex.org/W4402264526","https://openalex.org/W4402671843","https://openalex.org/W4402683786","https://openalex.org/W4402683967","https://openalex.org/W4403422209","https://openalex.org/W4404780727","https://openalex.org/W4404782248","https://openalex.org/W4404783401","https://openalex.org/W4404783755","https://openalex.org/W6600424091","https://openalex.org/W6600504320","https://openalex.org/W6602641848","https://openalex.org/W6805611657","https://openalex.org/W6890025973","https://openalex.org/W7133190639"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2479207418","https://openalex.org/W4237041411","https://openalex.org/W1588628884","https://openalex.org/W1994745260","https://openalex.org/W2382404424","https://openalex.org/W2012267561","https://openalex.org/W3018909868"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"have":[4,57],"demonstrated":[5],"remarkable":[6],"performance":[7],"across":[8,223],"a":[9,42,80,146,152,164,205,210,234,241],"wide":[10],"range":[11],"of":[12,62,83,155,231,244,268],"applications,":[13],"e.g.,":[14],"medical":[15],"question-answering,":[16],"mathematical":[17],"sciences,":[18],"and":[19,32,112,127,134,196,219,226,247,264],"code":[20],"generation.":[21],"However,":[22],"they":[23,94,114],"also":[24,51],"exhibit":[25],"inherent":[26],"limitations,":[27],"such":[28,273],"as":[29,41,98,204],"outdated":[30],"knowledge":[31,91,160],"susceptibility":[33],"to":[34,45,119,177,181,214,252],"hallucinations.":[35],"Retrieval-Augmented":[36],"Generation":[37],"(RAG)":[38],"has":[39],"emerged":[40],"promising":[43],"paradigm":[44],"address":[46,137],"these":[47,138],"issues,":[48,139],"but":[49],"it":[50],"introduces":[52,151],"new":[53],"vulnerabilities.":[54],"Recent":[55],"efforts":[56],"focused":[58],"on":[59,116],"the":[60,90,99,159,168,172,175,200,229,258,266],"security":[61],"RAG-based":[63,270],"LLMs,":[64],"yet":[65],"existing":[66,253],"attack":[67,144,149,201,236],"methods":[68],"face":[69],"three":[70],"critical":[71],"challenges:":[72],"(1)":[73],"their":[74,110,132],"effectiveness":[75,133,195,230],"declines":[76],"sharply":[77],"when":[78],"only":[79],"limited":[81,242],"number":[82,154,243],"poisoned":[84,121,156,217,245],"texts":[85,157,218,246],"can":[86],"be":[87],"injected":[88],"into":[89,158],"database":[92,161],"(2)":[93],"lack":[95],"sufficient":[96],"stealth,":[97],"attacks":[100],"are":[101],"often":[102],"detectable":[103],"by":[104,262],"anomaly":[105],"detection":[106],"systems,":[107],"which":[108,130],"compromises":[109],"effectiveness,":[111],"(3)":[113],"rely":[115],"heuristic":[117],"approaches":[118],"generate":[120,178],"texts,":[122],"lacking":[123],"formal":[124],"optimization":[125,207,212],"frameworks":[126],"theoretic":[128],"guarantees,":[129],"limits":[131],"applicability.":[135],"To":[136],"we":[140],"propose":[141],"coordinated":[142],"Prompt-RAG":[143],"(PR-attack),":[145],"novel":[147],"optimization-driven":[148],"that":[150],"small":[153],"while":[162,184],"embedding":[163],"backdoor":[165],"trigger":[166,173],"within":[167],"prompt.":[169],"When":[170],"activated,":[171],"causes":[174],"LLM":[176],"pre-designed":[179],"responses":[180],"targeted":[182],"queries,":[183],"maintaining":[185],"normal":[186],"behavior":[187],"in":[188],"other":[189],"contexts.":[190],"This":[191],"ensures":[192],"both":[193],"high":[194,235],"stealth.":[197],"We":[198],"formulate":[199],"generation":[202],"process":[203],"bilevel":[206],"problem":[208],"leveraging":[209],"principled":[211],"framework":[213],"develop":[215],"optimal":[216],"triggers.":[220],"Extensive":[221],"experiments":[222],"diverse":[224],"LLMs":[225,271],"datasets":[227],"demonstrate":[228],"PR-Attack,":[232],"achieving":[233],"success":[237],"rate":[238],"even":[239],"with":[240],"significantly":[248],"improved":[249],"stealth":[250],"compared":[251],"methods.":[254],"These":[255],"results":[256],"highlight":[257],"potential":[259],"risks":[260],"posed":[261],"PR-Attack":[263],"emphasize":[265],"importance":[267],"securing":[269],"against":[272],"threats.":[274]},"counts_by_year":[{"year":2026,"cited_by_count":4},{"year":2025,"cited_by_count":2}],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2025-10-10T00:00:00"}