{"id":"https://openalex.org/W4415981883","doi":"https://doi.org/10.1109/tifs.2026.3705326","title":"External Data Extraction Attacks Against Retrieval-Augmented Large Language Models","display_name":"External Data Extraction Attacks Against Retrieval-Augmented Large Language Models","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W4415981883","doi":"https://doi.org/10.1109/tifs.2026.3705326"},"language":"en","primary_location":{"id":"doi:10.1109/tifs.2026.3705326","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3705326","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2510.02964","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042628946","display_name":"Yu He","orcid":"https://orcid.org/0000-0003-1323-4730"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yu He","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0009-3247-9806","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100606726","display_name":"Yifei Chen","orcid":"https://orcid.org/0000-0002-6001-4899"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yifei Chen","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0009-4989-3317","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100346332","display_name":"Yiming Li","orcid":"https://orcid.org/0000-0002-2258-265X"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Yiming Li","raw_affiliation_strings":["College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore"],"raw_orcid":"https://orcid.org/0000-0002-2258-265X","affiliations":[{"raw_affiliation_string":"College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025609529","display_name":"Shuo Shao","orcid":"https://orcid.org/0000-0003-2872-795X"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shuo Shao","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0003-3482-4975","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102004889","display_name":"Qi Liao","orcid":"https://orcid.org/0000-0001-6796-104X"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Leyi Qi","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0009-0008-8703-3345","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007335290","display_name":"Boheng Li","orcid":"https://orcid.org/0000-0001-9921-7215"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Boheng Li","raw_affiliation_strings":["College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-9921-7215","affiliations":[{"raw_affiliation_string":"College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5108378610","display_name":"Dacheng Tao","orcid":null},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Dacheng Tao","raw_affiliation_strings":["College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-7225-5449","affiliations":[{"raw_affiliation_string":"College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5043524348","display_name":"Zhan Qin","orcid":"https://orcid.org/0000-0001-7872-6969"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhan Qin","raw_affiliation_strings":["State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"],"raw_orcid":"https://orcid.org/0000-0001-7872-6969","affiliations":[{"raw_affiliation_string":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.01633312,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"21","issue":null,"first_page":"5864","last_page":"5879"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.6396999955177307,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.6396999955177307,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10181","display_name":"Natural Language Processing Techniques","score":0.048900000751018524,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.033399999141693115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.6344000101089478},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.6083999872207642},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5620999932289124},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.4514999985694885},{"id":"https://openalex.org/keywords/information-extraction","display_name":"Information extraction","score":0.4007999897003174},{"id":"https://openalex.org/keywords/knowledge-base","display_name":"Knowledge base","score":0.37880000472068787},{"id":"https://openalex.org/keywords/data-extraction","display_name":"Data extraction","score":0.36890000104904175}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7954000234603882},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.6344000101089478},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.6083999872207642},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5620999932289124},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.4514999985694885},{"id":"https://openalex.org/C195807954","wikidata":"https://www.wikidata.org/wiki/Q1662562","display_name":"Information extraction","level":2,"score":0.4007999897003174},{"id":"https://openalex.org/C4554734","wikidata":"https://www.wikidata.org/wiki/Q593744","display_name":"Knowledge base","level":2,"score":0.37880000472068787},{"id":"https://openalex.org/C2777466982","wikidata":"https://www.wikidata.org/wiki/Q5227287","display_name":"Data extraction","level":3,"score":0.36890000104904175},{"id":"https://openalex.org/C207685749","wikidata":"https://www.wikidata.org/wiki/Q2088941","display_name":"Domain knowledge","level":2,"score":0.3476000130176544},{"id":"https://openalex.org/C120567893","wikidata":"https://www.wikidata.org/wiki/Q1582085","display_name":"Knowledge extraction","level":2,"score":0.3467000126838684},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.34290000796318054},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.32330000400543213},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.302700012922287},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30070000886917114},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29820001125335693},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2750999927520752},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2624000012874603},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.25859999656677246},{"id":"https://openalex.org/C2781170535","wikidata":"https://www.wikidata.org/wiki/Q30587856","display_name":"Noisy data","level":2,"score":0.25850000977516174},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.2554999887943268}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/tifs.2026.3705326","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2026.3705326","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2510.02964","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2510.02964","pdf_url":"https://arxiv.org/pdf/2510.02964","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2510.02964","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2510.02964","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2510.02964","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2510.02964","pdf_url":"https://arxiv.org/pdf/2510.02964","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1254977544","display_name":null,"funder_award_id":"2024C01169","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2183328864","display_name":null,"funder_award_id":"U2441240","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G659122245","display_name":null,"funder_award_id":"62441238","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G8798340151","display_name":null,"funder_award_id":"2024C01169","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4415981883.pdf","grobid_xml":"https://content.openalex.org/works/W4415981883.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"In":[0,101],"recent":[1],"years,":[2],"RAG":[3,21,34,63,225,236],"has":[4],"emerged":[5],"as":[6,175],"a":[7,84,123,157],"key":[8],"paradigm":[9],"for":[10,182,242,255],"enhancing":[11],"large":[12],"language":[13],"models":[14,209],"(LLMs).":[15],"By":[16],"integrating":[17],"externally":[18],"retrieved":[19],"information,":[20],"alleviates":[22],"issues":[23],"like":[24],"outdated":[25],"knowledge":[26,51,73],"and,":[27],"crucially,":[28],"insufficient":[29],"domain":[30],"expertise.":[31],"While":[32],"effective,":[33],"introduces":[35],"new":[36],"risks":[37,58],"of":[38,232],"external":[39],"data":[40,48,162,234],"extraction":[41,132],"attacks":[42,142,248],"(EDEAs),":[43],"where":[44],"sensitive":[45],"or":[46],"copyrighted":[47],"in":[49],"its":[50],"base":[52],"may":[53],"be":[54,144],"extracted":[55],"verbatim.":[56],"These":[57],"are":[59],"particularly":[60],"acute":[61],"when":[62],"is":[64,218],"used":[65],"to":[66,110,177,199,257],"customize":[67],"specialized":[68,179],"LLM":[69],"applications":[70],"with":[71],"private":[72],"bases.":[74],"Despite":[75],"initial":[76],"studies":[77],"exploring":[78],"these":[79],"risks,":[80],"they":[81],"often":[82],"lack":[83],"formalized":[85],"framework,":[86,153],"robust":[87],"attack":[88],"performance,":[89],"and":[90,121,136,159,184,196,217],"comprehensive":[91,108],"evaluation,":[92],"leaving":[93],"critical":[94],"questions":[95],"about":[96],"real-world":[97],"EDEA":[98],"feasibility":[99],"unanswered.":[100],"this":[102,152,258],"paper,":[103],"we":[104,154],"present":[105],"the":[106,233,243],"first":[107,117,244],"study":[109],"formalize":[111],"EDEAs":[112,120],"against":[113,221],"retrieval-augmented":[114],"LLMs.":[115],"We":[116],"formally":[118],"define":[119],"propose":[122],"unified":[124],"framework":[125],"decomposing":[126],"their":[127],"design":[128],"into":[129],"three":[130],"components:":[131],"instruction,":[133],"jailbreak":[134,180],"operator,":[135],"retrieval":[137,203],"trigger,":[138],"under":[139],"which":[140],"prior":[141],"can":[143],"considered":[145],"instances":[146],"within":[147],"our":[148],"framework.":[149],"Guided":[150],"by":[151,238],"develop":[155],"SECRET:":[156],"Scalable":[158],"EffeCtive":[160],"exteRnal":[161],"Extraction":[163],"aTtack.":[164],"Specifically,":[165],"SECRET":[166,212,228],"incorporates":[167],"(1)":[168],"an":[169,188],"adaptive":[170,189],"optimization":[171],"process":[172],"using":[173],"LLMs":[174],"optimizers":[176],"generate":[178,201],"prompts":[181],"EDEAs,":[183],"(2)":[185],"cluster-focused":[186],"triggering,":[187],"strategy":[190],"that":[191,211],"alternates":[192],"between":[193],"global":[194],"exploration":[195],"local":[197],"exploitation":[198],"efficiently":[200],"effective":[202,220],"triggers.":[204],"Extensive":[205],"evaluations":[206],"across":[207],"4":[208],"reveal":[210],"significantly":[213],"outperforms":[214],"previous":[215],"attacks,":[216],"highly":[219],"all":[222],"16":[223],"tested":[224],"instances.":[226],"Notably,":[227],"successfully":[229],"extracts":[230],"35%":[231],"from":[235],"powered":[237],"Claude":[239],"3.7":[240],"Sonnet":[241],"time,":[245],"whereas":[246],"other":[247],"yield":[249],"0%":[250],"extraction.":[251],"Our":[252],"findings":[253],"call":[254],"attention":[256],"emerging":[259],"threat.":[260]},"counts_by_year":[],"updated_date":"2026-06-27T06:13:17.587685","created_date":"2025-10-10T00:00:00"}