{"id":"https://openalex.org/W4412376959","doi":"https://doi.org/10.1145/3726302.3730058","title":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","display_name":"PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization","publication_year":2025,"publication_date":"2025-07-13","ids":{"openalex":"https://openalex.org/W4412376959","doi":"https://doi.org/10.1145/3726302.3730058"},"language":"en","primary_location":{"id":"doi:10.1145/3726302.3730058","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3726302.3730058","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5115594043","display_name":"Yang Jiao","orcid":"https://orcid.org/0000-0001-9468-1000"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yang Jiao","raw_affiliation_strings":["Tongji University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0001-9468-1000","affiliations":[{"raw_affiliation_string":"Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100382658","display_name":"Xiaodong Wang","orcid":"https://orcid.org/0000-0002-2945-9240"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiaodong Wang","raw_affiliation_strings":["Columbia University, New York, NY, USA"],"raw_orcid":"https://orcid.org/0000-0002-2945-9240","affiliations":[{"raw_affiliation_string":"Columbia University, New York, NY, USA","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100420873","display_name":"Kai Yang","orcid":"https://orcid.org/0000-0002-5983-198X"},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Yang","raw_affiliation_strings":["Tongji University, Shanghai, China"],"raw_orcid":"https://orcid.org/0000-0002-5983-198X","affiliations":[{"raw_affiliation_string":"Tongji University, Shanghai, China","institution_ids":["https://openalex.org/I116953780"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":4,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"656","last_page":"667"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.9927999973297119,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/bilevel-optimization","display_name":"Bilevel optimization","score":0.8946176767349243},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7829189896583557},{"id":"https://openalex.org/keywords/optimization-problem","display_name":"Optimization problem","score":0.23463517427444458},{"id":"https://openalex.org/keywords/algorithm","display_name":"Algorithm","score":0.22452819347381592}],"concepts":[{"id":"https://openalex.org/C3309286","wikidata":"https://www.wikidata.org/wiki/Q4907693","display_name":"Bilevel optimization","level":3,"score":0.8946176767349243},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7829189896583557},{"id":"https://openalex.org/C137836250","wikidata":"https://www.wikidata.org/wiki/Q984063","display_name":"Optimization problem","level":2,"score":0.23463517427444458},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.22452819347381592}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3726302.3730058","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3726302.3730058","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3726302.3730058","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3726302.3730058","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3726302.3730058","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G4377131734","display_name":null,"funder_award_id":"12371519","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5975532895","display_name":"\u9762\u5411\u5220\u9664\u4fe1\u9053\u7684\u6781\u5316\u7801\u8bd1\u7801\u7b97\u6cd5\u7406\u8bba\u4e0e\u8bef\u7801\u6027\u80fd\u7814\u7a76","funder_award_id":"61771013","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322449","display_name":"Tongji University","ror":"https://ror.org/03rc6as71"},{"id":"https://openalex.org/F4320335787","display_name":"Fundamental Research Funds for the Central Universities","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4412376959.pdf","grobid_xml":"https://content.openalex.org/works/W4412376959.grobid-xml"},"referenced_works_count":66,"referenced_works":["https://openalex.org/W1528703258","https://openalex.org/W1978583881","https://openalex.org/W2889787757","https://openalex.org/W2899708929","https://openalex.org/W2912924812","https://openalex.org/W2990138404","https://openalex.org/W2997072274","https://openalex.org/W3035367371","https://openalex.org/W3152844947","https://openalex.org/W3170572542","https://openalex.org/W3202650012","https://openalex.org/W3212019149","https://openalex.org/W3213825583","https://openalex.org/W4210693780","https://openalex.org/W4284668485","https://openalex.org/W4284673705","https://openalex.org/W4284707459","https://openalex.org/W4310415871","https://openalex.org/W4319793479","https://openalex.org/W4365211555","https://openalex.org/W4365799947","https://openalex.org/W4367628274","https://openalex.org/W4386076300","https://openalex.org/W4389518888","https://openalex.org/W4389519591","https://openalex.org/W4389519982","https://openalex.org/W4389523893","https://openalex.org/W4391974622","https://openalex.org/W4392487838","https://openalex.org/W4392903596","https://openalex.org/W4392904091","https://openalex.org/W4393147129","https://openalex.org/W4393147313","https://openalex.org/W4393157467","https://openalex.org/W4393160110","https://openalex.org/W4393161188","https://openalex.org/W4395443988","https://openalex.org/W4399807068","https://openalex.org/W4400484832","https://openalex.org/W4400524868","https://openalex.org/W4400525546","https://openalex.org/W4400527475","https://openalex.org/W4400528650","https://openalex.org/W4400529080","https://openalex.org/W4401508509","https://openalex.org/W4401856724","https://openalex.org/W4401863775","https://openalex.org/W4401864009","https://openalex.org/W4402264157","https://openalex.org/W4402264526","https://openalex.org/W4402671843","https://openalex.org/W4402683786","https://openalex.org/W4402683967","https://openalex.org/W4403422209","https://openalex.org/W4404780727","https://openalex.org/W4404782248","https://openalex.org/W4404783401","https://openalex.org/W4404783755","https://openalex.org/W6600424091","https://openalex.org/W6600504320","https://openalex.org/W6602641848","https://openalex.org/W6796020952","https://openalex.org/W6797196285","https://openalex.org/W6805611657","https://openalex.org/W6846250077","https://openalex.org/W6890025973"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2479207418","https://openalex.org/W4237041411","https://openalex.org/W1588628884","https://openalex.org/W1994745260","https://openalex.org/W2382404424","https://openalex.org/W2012267561","https://openalex.org/W3018909868"],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"have":[4,57],"demonstrated":[5],"remarkable":[6],"performance":[7],"across":[8,223],"a":[9,42,80,146,152,164,205,210,234,241],"wide":[10],"range":[11],"of":[12,62,83,155,231,244,268],"applications,":[13],"e.g.,":[14],"medical":[15],"question-answering,":[16],"mathematical":[17],"sciences,":[18],"and":[19,32,112,127,134,196,219,226,247,264],"code":[20],"generation.":[21],"However,":[22],"they":[23,94,114],"also":[24,51],"exhibit":[25],"inherent":[26],"limitations,":[27],"such":[28,273],"as":[29,41,98,204],"outdated":[30],"knowledge":[31,91,160],"susceptibility":[33],"to":[34,45,119,177,181,214,252],"hallucinations.":[35],"Retrieval-Augmented":[36],"Generation":[37],"(RAG)":[38],"has":[39],"emerged":[40],"promising":[43],"paradigm":[44],"address":[46,137],"these":[47,138],"issues,":[48,139],"but":[49],"it":[50],"introduces":[52,151],"new":[53],"vulnerabilities.":[54],"Recent":[55],"efforts":[56],"focused":[58],"on":[59,116],"the":[60,90,99,159,168,172,175,200,229,258,266],"security":[61],"RAG-based":[63,270],"LLMs,":[64],"yet":[65],"existing":[66,253],"attack":[67,144,149,201,236],"methods":[68],"face":[69],"three":[70],"critical":[71],"challenges:":[72],"(1)":[73],"their":[74,110,132],"effectiveness":[75,133,195,230],"declines":[76],"sharply":[77],"when":[78],"only":[79],"limited":[81,242],"number":[82,154,243],"poisoned":[84,121,156,217,245],"texts":[85,157,218,246],"can":[86],"be":[87],"injected":[88],"into":[89,158],"database":[92,161],"(2)":[93],"lack":[95],"sufficient":[96],"stealth,":[97],"attacks":[100],"are":[101],"often":[102],"detectable":[103],"by":[104,262],"anomaly":[105],"detection":[106],"systems,":[107],"which":[108,130],"compromises":[109],"effectiveness,":[111],"(3)":[113],"rely":[115],"heuristic":[117],"approaches":[118],"generate":[120,178],"texts,":[122],"lacking":[123],"formal":[124],"optimization":[125,207,212],"frameworks":[126],"theoretic":[128],"guarantees,":[129],"limits":[131],"applicability.":[135],"To":[136],"we":[140],"propose":[141],"coordinated":[142],"Prompt-RAG":[143],"(PR-attack),":[145],"novel":[147],"optimization-driven":[148],"that":[150],"small":[153],"while":[162,184],"embedding":[163],"backdoor":[165],"trigger":[166,173],"within":[167],"prompt.":[169],"When":[170],"activated,":[171],"causes":[174],"LLM":[176],"pre-designed":[179],"responses":[180],"targeted":[182],"queries,":[183],"maintaining":[185],"normal":[186],"behavior":[187],"in":[188],"other":[189],"contexts.":[190],"This":[191],"ensures":[192],"both":[193],"high":[194,235],"stealth.":[197],"We":[198],"formulate":[199],"generation":[202],"process":[203],"bilevel":[206],"problem":[208],"leveraging":[209],"principled":[211],"framework":[213],"develop":[215],"optimal":[216],"triggers.":[220],"Extensive":[221],"experiments":[222],"diverse":[224],"LLMs":[225,271],"datasets":[227],"demonstrate":[228],"PR-Attack,":[232],"achieving":[233],"success":[237],"rate":[238],"even":[239],"with":[240],"significantly":[248],"improved":[249],"stealth":[250],"compared":[251],"methods.":[254],"These":[255],"results":[256],"highlight":[257],"potential":[259],"risks":[260],"posed":[261],"PR-Attack":[263],"emphasize":[265],"importance":[267],"securing":[269],"against":[272],"threats.":[274]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}