{"id":"https://openalex.org/W7168382191","doi":"https://doi.org/10.1145/3805712.3809904","title":"When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse","display_name":"When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse","publication_year":2026,"publication_date":"2026-07-15","ids":{"openalex":"https://openalex.org/W7168382191","doi":"https://doi.org/10.1145/3805712.3809904"},"language":null,"primary_location":{"id":"doi:10.1145/3805712.3809904","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805712.3809904","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3805712.3809904","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5140931323","display_name":"Yingtao Ren","orcid":"https://orcid.org/0000-0003-2035-4845"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yingtao Ren","raw_affiliation_strings":["University of Technology Sydney, Sydney, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0003-2035-4845","affiliations":[{"raw_affiliation_string":"University of Technology Sydney, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140920279","display_name":"Ziyi Zhao","orcid":"https://orcid.org/0000-0003-3537-8065"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Ziyi Zhao","raw_affiliation_strings":["University of Technology Sydney, Sydney, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0003-3537-8065","affiliations":[{"raw_affiliation_string":"University of Technology Sydney, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140890148","display_name":"Yiwei Fu","orcid":"https://orcid.org/0009-0000-1637-6764"},"institutions":[{"id":"https://openalex.org/I20231570","display_name":"Peking University","ror":"https://ror.org/02v51f717","country_code":"CN","type":"education","lineage":["https://openalex.org/I20231570"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yiwei Fu","raw_affiliation_strings":["Peking University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0000-1637-6764","affiliations":[{"raw_affiliation_string":"Peking University, Beijing, China","institution_ids":["https://openalex.org/I20231570"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140807172","display_name":"Xiao Luo","orcid":"https://orcid.org/0000-0002-7987-3714"},"institutions":[{"id":"https://openalex.org/I135310074","display_name":"University of Wisconsin\u2013Madison","ror":"https://ror.org/01y2jtd41","country_code":"US","type":"education","lineage":["https://openalex.org/I135310074"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xiao Luo","raw_affiliation_strings":["University of Wisconsin - Madison, Madison, Wisconsin, USA"],"raw_orcid":"https://orcid.org/0000-0002-7987-3714","affiliations":[{"raw_affiliation_string":"University of Wisconsin - Madison, Madison, Wisconsin, USA","institution_ids":["https://openalex.org/I135310074"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140955149","display_name":"Yu-Cheng Chang","orcid":"https://orcid.org/0000-0001-9244-0318"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yu-Cheng Chang","raw_affiliation_strings":["University of Technology Sydney, Sydney, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0001-9244-0318","affiliations":[{"raw_affiliation_string":"University of Technology Sydney, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I114017466"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5140826306","display_name":"Chin-Teng Lin","orcid":"https://orcid.org/0000-0001-8371-8197"},"institutions":[{"id":"https://openalex.org/I114017466","display_name":"University of Technology Sydney","ror":"https://ror.org/03f0f6041","country_code":"AU","type":"education","lineage":["https://openalex.org/I114017466"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Chin-Teng Lin","raw_affiliation_strings":["University of Technology Sydney, Sydney, NSW, Australia"],"raw_orcid":"https://orcid.org/0000-0001-8371-8197","affiliations":[{"raw_affiliation_string":"University of Technology Sydney, Sydney, NSW, Australia","institution_ids":["https://openalex.org/I114017466"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"4080","last_page":"4086"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":null,"topics":[],"keywords":[{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.669700026512146},{"id":"https://openalex.org/keywords/poison-control","display_name":"Poison control","score":0.25450000166893005},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.2533000111579895},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.2282000035047531}],"concepts":[{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.669700026512146},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.44279998540878296},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.35899999737739563},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3224000036716461},{"id":"https://openalex.org/C3017944768","wikidata":"https://www.wikidata.org/wiki/Q1450463","display_name":"Poison control","level":2,"score":0.25450000166893005},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.2533000111579895},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.2513999938964844},{"id":"https://openalex.org/C46312422","wikidata":"https://www.wikidata.org/wiki/Q11024","display_name":"Communication","level":1,"score":0.23029999434947968},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2282000035047531},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.2273000031709671}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3805712.3809904","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805712.3809904","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3805712.3809904","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3805712.3809904","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":18,"referenced_works":["https://openalex.org/W2889787757","https://openalex.org/W3099700870","https://openalex.org/W3115947671","https://openalex.org/W3190126809","https://openalex.org/W4388886073","https://openalex.org/W4389519449","https://openalex.org/W4401857375","https://openalex.org/W4404534210","https://openalex.org/W4412377123","https://openalex.org/W4412886655","https://openalex.org/W4412888639","https://openalex.org/W4415800619","https://openalex.org/W4416034285","https://openalex.org/W4416034470","https://openalex.org/W4416034722","https://openalex.org/W4416822368","https://openalex.org/W7133235880","https://openalex.org/W7166815917"],"related_works":[],"abstract_inverted_index":{"Retrieval-augmented":[0],"generation":[1],"(RAG)":[2],"is":[3,159],"indispensable":[4],"for":[5],"enhancing":[6],"large":[7],"language":[8],"models.":[9],"However,":[10],"RAGs":[11],"are":[12,22],"increasingly":[13],"susceptible":[14],"to":[15,24,40,128,153],"poisoning":[16],"attacks,":[17],"in":[18,93,101],"which":[19],"adversarial":[20],"documents":[21],"injected":[23],"manipulate":[25],"generator":[26,80],"outputs.":[27],"Previous":[28],"methods":[29],"rely":[30],"on":[31,106,110,134],"output-side":[32],"signals":[33],"such":[34,42],"as":[35,103],"perplexity":[36,61],"and":[37,81],"consistency":[38],"checks":[39],"detect":[41,147],"attacks.":[43],"Nevertheless,":[44],"our":[45,142],"analysis":[46],"reveals":[47],"that":[48,124],"deliberate":[49],"attacks":[50,148],"often":[51],"induce":[52],"false":[53],"confidence,":[54],"where":[55],"poisoned":[56,107],"outputs":[57],"exhibit":[58,98],"even":[59,149],"lower":[60],"than":[62],"benign":[63,94],"ones,":[64],"rendering":[65],"uncertainty-based":[66],"detection":[67,122],"ineffective.":[68],"To":[69],"address":[70],"this":[71],"challenge,":[72],"we":[73,113],"explore":[74],"the":[75,79,90,139,155],"internal":[76],"dynamics":[77,127],"of":[78,141],"identify":[82,129],"a":[83,99,120],"distinctive":[84],"signature":[85],"termed":[86],"Attention":[87],"Collapse.":[88],"Unlike":[89],"dispersed":[91],"attention":[92,104,126],"generations,":[95],"attacked":[96,130],"generations":[97],"decrease":[100],"entropy":[102],"concentrates":[105],"documents.":[108],"Building":[109],"these":[111],"findings,":[112],"propose":[114],"D-SCAN":[115,145],"(Document-level":[116],"Signal":[117],"Collapse":[118],"Analysis),":[119],"lightweight":[121],"framework":[123],"monitors":[125],"generations.":[131],"Extensive":[132],"experiments":[133],"multiple":[135],"attack":[136],"benchmarks":[137],"demonstrate":[138],"effectiveness":[140],"method.":[143],"Moreover,":[144],"can":[146],"when":[150],"they":[151],"fail":[152],"alter":[154],"final":[156],"answer.":[157],"Code":[158],"available":[160],"at":[161],"https://github.com/yingtaoren/D-Scan.git.":[162]},"counts_by_year":[],"updated_date":"2026-07-17T05:52:16.776730","created_date":"2026-07-16T00:00:00"}