{"id":"https://openalex.org/W7163330396","doi":"https://doi.org/10.48550/arxiv.2606.02643","title":"Inference Cost Attacks for Retrieval-Augmented Large Language Models","display_name":"Inference Cost Attacks for Retrieval-Augmented Large Language Models","publication_year":2026,"publication_date":"2026-05-31","ids":{"openalex":"https://openalex.org/W7163330396","doi":"https://doi.org/10.48550/arxiv.2606.02643"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.02643","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.02643","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.02643","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137800024","display_name":"Chengliang Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Chengliang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137750714","display_name":"Liangbo Ning","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ning, Liangbo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137718787","display_name":"Yujuan Ding","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ding, Yujuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137801978","display_name":"Wenqi Fan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fan, Wenqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.5891000032424927,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.5891000032424927,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.17180000245571136,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11147","display_name":"Misinformation and Its Impacts","score":0.04270000010728836,"subfield":{"id":"https://openalex.org/subfields/3312","display_name":"Sociology and Political Science"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.7425000071525574},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.6345999836921692},{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.4733999967575073},{"id":"https://openalex.org/keywords/resource","display_name":"Resource (disambiguation)","score":0.41119998693466187},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.38659998774528503},{"id":"https://openalex.org/keywords/operationalization","display_name":"Operationalization","score":0.3686999976634979},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.36570000648498535},{"id":"https://openalex.org/keywords/pipeline","display_name":"Pipeline (software)","score":0.36410000920295715}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8127999901771545},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.7425000071525574},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.6345999836921692},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.4733999967575073},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.44350001215934753},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.42489999532699585},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.414000004529953},{"id":"https://openalex.org/C206345919","wikidata":"https://www.wikidata.org/wiki/Q20380951","display_name":"Resource (disambiguation)","level":2,"score":0.41119998693466187},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.38659998774528503},{"id":"https://openalex.org/C9354725","wikidata":"https://www.wikidata.org/wiki/Q286017","display_name":"Operationalization","level":2,"score":0.3686999976634979},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.36570000648498535},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.36410000920295715},{"id":"https://openalex.org/C46743427","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference engine","level":3,"score":0.36070001125335693},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.35190001130104065},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.33469998836517334},{"id":"https://openalex.org/C4554734","wikidata":"https://www.wikidata.org/wiki/Q593744","display_name":"Knowledge base","level":2,"score":0.3154999911785126},{"id":"https://openalex.org/C76178495","wikidata":"https://www.wikidata.org/wiki/Q4808784","display_name":"Asset (computer security)","level":2,"score":0.2903999984264374},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2867000102996826},{"id":"https://openalex.org/C2778403875","wikidata":"https://www.wikidata.org/wiki/Q20312394","display_name":"Adversarial machine learning","level":3,"score":0.2662999927997589},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C30772137","wikidata":"https://www.wikidata.org/wiki/Q5164762","display_name":"Consumption (sociology)","level":2,"score":0.25609999895095825},{"id":"https://openalex.org/C160234255","wikidata":"https://www.wikidata.org/wiki/Q812535","display_name":"Bayesian inference","level":3,"score":0.25029999017715454}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.02643","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.02643","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.02643","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.02643","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Retrieval-Augmented":[0,87],"Generation":[1],"(RAG)-enhanced":[2],"LLM":[3,67,103,131],"systems,":[4],"while":[5],"powerful,":[6],"introduce":[7,85,165],"substantial":[8],"inference":[9,157],"costs":[10],"due":[11],"to":[12,38,65,133,206],"the":[13,49,79,86,98,156,161,179,217,220],"inclusion":[14],"of":[15,52,101,187,219],"an":[16,149,210],"extra":[17],"multi-stage":[18],"pipeline":[19],"that":[20,58,96,129,138,177,199],"dynamically":[21],"retrieves":[22],"and":[23,62,145],"synthesizes":[24],"information":[25],"from":[26,70,78,183],"external":[27,72,110],"knowledge":[28,73,77,111],"sources.":[29],"This":[30],"high":[31],"operational":[32],"cost":[33,100],"exposes":[34],"a":[35,59,92,126,172,184],"critical":[36],"vulnerability":[37],"Inference":[39,88],"Cost":[40,89],"Attacks":[41],"(ICAs).":[42],"However,":[43],"existing":[44],"ICAs":[45],"often":[46],"rely":[47],"on":[48],"impractical":[50],"assumption":[51],"direct":[53],"prompt":[54],"manipulation.":[55],"We":[56],"argue":[57],"more":[60],"feasible":[61],"potent":[63,146],"threat":[64],"RAG-enhanced":[66,102],"systems":[68,104],"arises":[69],"poisoning":[71],"bases":[74],"(e.g.,":[75],"web":[76],"Internet).":[80],"In":[81],"this":[82,115],"work,":[83],"we":[84,117,164],"Attack":[90],"(RA-ICA),":[91],"novel":[93,127,173],"attacking":[94],"paradigm":[95],"targets":[97],"computational":[99],"by":[105,181,204],"injecting":[106],"malicious":[107,136],"documents":[108,137],"into":[109],"corpus.":[112],"To":[113,159],"operationalize":[114],"attack,":[116],"propose":[118],"Computational":[119],"Resource":[120],"Exhaustion":[121],"via":[122],"External":[123],"Poisoning":[124],"(CREEP),":[125],"framework":[128],"leverages":[130],"agents":[132,180],"automatically":[134],"craft":[135],"are":[139],"both":[140],"semantically":[141],"relevant":[142],"for":[143,147],"retrieval":[144],"inducing":[148],"abnormal":[150],"increase":[151],"in":[152],"token":[153,202],"consumption":[154,203],"during":[155],"phase.":[158],"enhance":[160],"attack's":[162],"effectiveness,":[163],"Memory-Augmented":[166],"Group":[167],"Relative":[168],"Policy":[169],"Optimization":[170],"(MA-GRPO),":[171],"reinforcement":[174],"learning":[175,182],"algorithm":[176],"fine-tunes":[178],"dynamic":[185],"memory":[186],"historical":[188],"best":[189],"adversarial":[190],"documents.":[191],"Extensive":[192],"experiments":[193],"across":[194],"three":[195],"real-world":[196],"datasets":[197],"demonstrate":[198],"RA-ICA":[200],"increases":[201],"up":[205],"13.12":[207],"times":[208],"with":[209],"over":[211],"90%":[212],"success":[213],"rate,":[214],"without":[215],"degrading":[216],"integrity":[218],"generated":[221],"answer.":[222]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-04T00:00:00"}