{"id":"https://openalex.org/W7204018931","doi":null,"title":"MARAGE: Multi-Model Adversarial Attack for Retrieval-Augmented Generation Database Extraction","display_name":"MARAGE: Multi-Model Adversarial Attack for Retrieval-Augmented Generation Database Extraction","publication_year":2026,"publication_date":"2026-06-01","ids":{"openalex":"https://openalex.org/W7204018931"},"language":"en","primary_location":{"id":"pmh:oai:utoronto.scholaris.ca:1807/153796","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/1807/153796","pdf_url":"https://utoronto.scholaris.ca/bitstreams/53b7be12-020c-4c25-9bbc-8c52118d1036/download","source":{"id":"https://openalex.org/S4306400261","display_name":"TSpace (University of Toronto)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I185261750","host_organization_name":"University of Toronto","host_organization_lineage":["https://openalex.org/I185261750"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"},"volume":null,"type":"dissertation","is_traditional":true,"indexed_in":[],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://utoronto.scholaris.ca/bitstreams/53b7be12-020c-4c25-9bbc-8c52118d1036/download","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5147815801","display_name":"Xiao HU","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I185261750","display_name":"University of Toronto","ror":"https://ror.org/03dbr7087","country_code":"CA","type":"education","lineage":["https://openalex.org/I185261750"]}],"countries":["CA"],"is_corresponding":true,"raw_author_name":"HU, Xiao","raw_affiliation_strings":["Department of Electrical and Computer Engineering University of Toronto 2026","Master of Applied Science"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering University of Toronto 2026","institution_ids":["https://openalex.org/I185261750"]},{"raw_affiliation_string":"Master of Applied Science","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5147815801"],"corresponding_institution_ids":["https://openalex.org/I185261750"],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.0007999999797903001,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/retrieval-augmented-generation","display_name":"retrieval-augmented generation","score":0.9860000014305115},{"id":"https://openalex.org/keywords/adversarial-attacks","display_name":"adversarial attacks","score":0.7409999966621399},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.6940000057220459},{"id":"https://openalex.org/keywords/hallucinations","display_name":"hallucinations","score":0.4009999930858612},{"id":"https://openalex.org/keywords/multi-model-optimization","display_name":"multi-model optimization","score":0.8080000281333923},{"id":"https://openalex.org/keywords/cross-model-transferability","display_name":"cross-model transfer","score":0.7760000228881836}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8464999794960022},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.669700026512146},{"id":"https://openalex.org/C157486923","wikidata":"https://www.wikidata.org/wiki/Q1376436","display_name":"String (physics)","level":2,"score":0.6474999785423279},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.6122999787330627},{"id":"https://openalex.org/C81917197","wikidata":"https://www.wikidata.org/wiki/Q628760","display_name":"Selection (genetic algorithm)","level":2,"score":0.5985000133514404},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5407000184059143},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.41290000081062317},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3928000032901764},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.33550000190734863},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.31130000948905945},{"id":"https://openalex.org/C137836250","wikidata":"https://www.wikidata.org/wiki/Q984063","display_name":"Optimization problem","level":2,"score":0.30869999527931213},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3021000027656555},{"id":"https://openalex.org/C195807954","wikidata":"https://www.wikidata.org/wiki/Q1662562","display_name":"Information extraction","level":2,"score":0.2930999994277954},{"id":"https://openalex.org/C2777466982","wikidata":"https://www.wikidata.org/wiki/Q5227287","display_name":"Data extraction","level":3,"score":0.2827000021934509},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2818000018596649},{"id":"https://openalex.org/C2987595161","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Optimization algorithm","level":2,"score":0.2759999930858612}],"mesh":[],"locations_count":1,"locations":[{"id":"pmh:oai:utoronto.scholaris.ca:1807/153796","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/1807/153796","pdf_url":"https://utoronto.scholaris.ca/bitstreams/53b7be12-020c-4c25-9bbc-8c52118d1036/download","source":{"id":"https://openalex.org/S4306400261","display_name":"TSpace (University of Toronto)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I185261750","host_organization_name":"University of Toronto","host_organization_lineage":["https://openalex.org/I185261750"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"}],"best_oa_location":{"id":"pmh:oai:utoronto.scholaris.ca:1807/153796","doi":null,"is_oa":true,"landing_page_url":"https://hdl.handle.net/1807/153796","pdf_url":"https://utoronto.scholaris.ca/bitstreams/53b7be12-020c-4c25-9bbc-8c52118d1036/download","source":{"id":"https://openalex.org/S4306400261","display_name":"TSpace (University of Toronto)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I185261750","host_organization_name":"University of Toronto","host_organization_lineage":["https://openalex.org/I185261750"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Thesis"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7204018931.pdf","grobid_xml":"https://content.openalex.org/works/W7204018931.grobid-xml"},"referenced_works_count":56,"referenced_works":["https://openalex.org/W1816313093","https://openalex.org/W2247585390","https://openalex.org/W2514713644","https://openalex.org/W2587741066","https://openalex.org/W2792643794","https://openalex.org/W2897105542","https://openalex.org/W2899663614","https://openalex.org/W2909544278","https://openalex.org/W2938704169","https://openalex.org/W2949650786","https://openalex.org/W2963469388","https://openalex.org/W2973430807","https://openalex.org/W2995082892","https://openalex.org/W2996336810","https://openalex.org/W2998353611","https://openalex.org/W3015883388","https://openalex.org/W3027879771","https://openalex.org/W3037932933","https://openalex.org/W3086007799","https://openalex.org/W3152956381","https://openalex.org/W3168867926","https://openalex.org/W3183146492","https://openalex.org/W3209632425","https://openalex.org/W4226271314","https://openalex.org/W4229005866","https://openalex.org/W4309674289","https://openalex.org/W4318719586","https://openalex.org/W4379468930","https://openalex.org/W4385374425","https://openalex.org/W4385714201","https://openalex.org/W4386270999","https://openalex.org/W4387561528","https://openalex.org/W4388979610","https://openalex.org/W4388994251","https://openalex.org/W4389518671","https://openalex.org/W4389761608","https://openalex.org/W4391800708","https://openalex.org/W4391801218","https://openalex.org/W4392012779","https://openalex.org/W4392425374","https://openalex.org/W4399932275","https://openalex.org/W4399991306","https://openalex.org/W4401023556","https://openalex.org/W4401306886","https://openalex.org/W4401857375","https://openalex.org/W4403702563","https://openalex.org/W4404652639","https://openalex.org/W4405181744","https://openalex.org/W4408353799","https://openalex.org/W4414037010","https://openalex.org/W4415799193","https://openalex.org/W4416035746","https://openalex.org/W4416379250","https://openalex.org/W7131811874","https://openalex.org/W7133208539","https://openalex.org/W7133225282"],"related_works":["https://openalex.org/W4407308219","https://openalex.org/W4404352866","https://openalex.org/W4415981883","https://openalex.org/W7161783429","https://openalex.org/W4399991306","https://openalex.org/W7155064308","https://openalex.org/W7166830555","https://openalex.org/W7154538810","https://openalex.org/W7172030722","https://openalex.org/W4404652639"],"abstract_inverted_index":{"Retrieval-Augmented":[0],"Generation":[1],"(RAG)":[2],"mitigates":[3],"hallucinations":[4],"in":[5,151,197],"Large":[6],"Language":[7],"Models":[8],"using":[9],"externally":[10],"retrieved":[11,19,51,81,102],"data.":[12,52,104,200],"Although":[13],"useful,":[14],"RAG":[15,31,61,103,141,180,185,199],"can":[16],"expose":[17],"the":[18,28,42,78,84,101,136,152,189,211,217,223],"data":[20],"to":[21,36,93,96,135,221],"extraction":[22,48,63],"attacks.":[23],"Previous":[24],"work":[25],"has":[26,34],"demonstrated":[27],"feasibility":[29],"of":[30,41,49,80,100,140,225],"extraction,":[32],"but":[33],"failed":[35],"simultaneously":[37],"ensure":[38],"high-coverage":[39,67],"retrieval":[40],"entire":[43],"knowledge":[44],"database":[45,62],"and":[46,155,173,179,215],"verbatim":[47,98],"lengthy":[50,138],"In":[53],"this":[54,121],"paper,":[55],"we":[56,69,128,143,213],"propose":[57,70],"MARAGE,":[58],"an":[59,89,183],"optimization-based":[60,174],"attack.":[64],"To":[65,124,133,201],"obtain":[66],"retrieval,":[68],"a":[71,111],"semantic-aware":[72],"query":[73,95],"selection":[74],"strategy":[75],"which":[76,147],"optimizes":[77],"diversity":[79],"chunks":[82],"from":[83],"database.":[85],"We":[86,105,115,157],"then":[87],"employ":[88],"adversarial":[90],"string":[91],"appended":[92],"each":[94],"force":[97],"output":[99],"generate":[106],"these":[107],"strings":[108],"by":[109,193],"leveraging":[110],"continuous":[112],"optimization":[113,153,160],"framework.":[114],"integrate":[116],"three":[117],"key":[118],"innovations":[119],"into":[120],"framework:":[122],"(1)":[123],"enhance":[125],"cross-model":[126],"transferability,":[127],"utilize":[129],"multi-model":[130],"optimization,":[131],"(2)":[132],"adapt":[134],"uniquely":[137],"target":[139],"databases,":[142],"introduce":[144],"Primacy":[145],"weighting,":[146],"prioritizes":[148],"initial":[149],"tokens":[150],"target,":[154],"(3)":[156],"use":[158],"Perplexity-constrained":[159],"for":[161],"evading":[162],"state-of-the-art":[163],"defenses.":[164],"Evaluations":[165],"show":[166],"that":[167],"MARAGE":[168,187,206],"consistently":[169],"outperforms":[170,188],"both":[171],"manual":[172,190],"baselines":[175],"across":[176],"multiple":[177],"LLMs":[178],"databases.":[181],"On":[182],"end-to-end":[184],"pipeline,":[186],"attack":[191],"baseline":[192],"329":[194],"\u00b1":[195],"165%":[196],"extracting":[198],"shed":[202],"light":[203],"on":[204],"why":[205],"is":[207],"more":[208],"effective":[209],"than":[210],"baselines,":[212],"probe":[214],"analyze":[216],"model\u2019s":[218],"internal":[219],"state":[220],"isolate":[222],"benefit":[224],"our":[226],"approach.":[227]},"counts_by_year":[],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2026-08-23T00:00:00"}