ai-research-survey

scan.json (33116B)

---

 {
   "paper": {
     "title": "DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection",
     "authors": ["Jerry Wang", "Fang Yu"],
     "year": 2025,
     "venue": "KDD Workshop on Prompt Optimization",
     "arxiv_id": "2507.15042",
     "doi": "10.48550/arXiv.2507.15042"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "DeRAG uses Differential Evolution to generate short adversarial suffixes (2-5 tokens) that manipulate RAG retrieval rankings in a black-box setting, achieving success rates competitive with or exceeding the white-box GGPP method on dense retrievers and outperforming PRADA on sparse retrievers at Top-1. The method produces smaller cosine shifts than gradient-based approaches, and DE-generated suffixes largely evade a RoBERTa-based detector (AUROC 0.20). Downstream QA evaluation on SQuAD and NQ-Open shows that successful adversarial retrieval manipulation degrades answer quality by 15-28% on average across metrics.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "A GitHub repository is provided: https://github.com/pen9rum/Rag_attack_DeRag (reference [34]), described as containing data and experiment results."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available BEIR benchmark datasets (MS MARCO, SciFact, FiQA, FEVER), and states 'Data and experiment results are available at' the GitHub repository (Section 4.1)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment specifications (requirements.txt, Dockerfile, library versions) are provided in the paper. Only the model (BERT-base-uncased, 110M parameters) is mentioned."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. The GitHub link is given but the paper itself contains no README-style instructions for replicating experiments."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All main results in Tables 1-5 report only point estimates (e.g., Success@1 = 0.198) with no confidence intervals or error bars. The only ± notation appears in Table 15 for MLM NLL, not for the main attack results."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Welch's t-test is used only for the readability analysis (Table 16, Appendix H). The primary comparative claims — that DE outperforms GGPP and PRADA — are based solely on comparing point estimates across Tables 1 and 2 without any significance tests."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports multiple effect size metrics: ΔMRR, ΔnDCG@20, and Δcos (Tables 1, 2, 7), providing context for the magnitude of retrieval disruption. Downstream quality degradation is reported as percentage changes from baseline (Table 5)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses 100 queries and 1,000-document subsets per dataset without any justification for why these sizes were chosen. No power analysis or discussion of whether 100 queries is sufficient for reliable estimates."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No standard deviations, variance, or multi-run spread measures are reported for the main attack results. Tables 1-5 all present single-run point estimates. DE is stochastic but no seed sensitivity is explored."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against GGPP (white-box gradient-guided attack, reference [23]), PRADA (black-box sparse retrieval attack, reference [16]), and a random suffix baseline (Tables 1-2)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "GGPP (Hu et al., 2024) and PRADA (Wu & Zhang, 2022) are recent and represent the state of the art for white-box and black-box retrieval attacks respectively."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablations are conducted: DE_seq_stop vs DE_seq vs DE_fixed_stop (Section 4.3.2, Figure 2), prefix vs suffix attacks (Table 3), suffix length variation (Appendix D, Figure 4), hinge loss vs cosine loss (Appendix E, Table 12), and pool size variation (Table 6)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses Success@K (K=1,10,20), ΔMRR, ΔnDCG@20, Δcos, average tokens, and average iterations for attack evaluation. Downstream evaluation adds EM, F1, ROUGE-L, and BERTScore (Table 5)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is included. The readability of adversarial suffixes is assessed only via automated MLM NLL proxy (Appendix H), not human judgment. Detection evasion is tested only against automated detectors."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": false,
         "justification": "No separation between development and test sets. The same 100 queries per dataset are used for both optimization and evaluation. There is no held-out test set mentioned."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by dataset (SciFact, FiQA, FEVER, MS MARCO), by method variant, by retrieval threshold K (1, 10, 20), and by attack outcome stratum (Top-1, Top-10 only, Fail) in Table 5."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports query counts where both prefix and suffix fail. Table 5 stratifies results by 'Fail' outcome. The paper notes diminishing returns beyond 5 tokens (Appendix D) and discusses when cosine loss fails vs hinge loss (Appendix E)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports that cosine loss is consistently worse than hinge loss (Appendix E, Table 12), that a monotonic suffix length schedule did not improve results (Section 4.3.3, Appendix D), and that suffixes beyond 5 tokens yield diminishing or negative marginal returns (Figure 4b)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims competitive success rates vs GGPP (supported by Table 2), few tokens (supported by avg token columns), readability improvement validated by Welch's t-test (supported by Table 16), and detection evasion (supported by Table 4). The claims are reasonably hedged ('competitive and in some cases higher')."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "The paper's causal claims (e.g., DE-optimized suffixes cause retrieval manipulation, early stopping reduces iterations) are supported by controlled single-variable ablations — comparing methods on the same data with only the attack strategy varying. The ablation studies (Section 4.3.2-4.3.3) isolate individual components."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims attacks on 'Multiple Retrieval-Augmented Generation Applications' but experiments use only BERT-base-uncased as the dense retriever and BM25 as the sparse retriever, with 1,000-document subsets. The conclusion states 'DeRAG reveals critical RAG vulnerabilities' without bounding this to the specific retrievers and small corpus sizes tested. Real RAG systems use more sophisticated retrievers and much larger corpora."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of alternative explanations. For instance, the high success rate on MS MARCO might be explained by corpus-specific properties rather than DE's general effectiveness. The paper does not consider whether results would hold with different retriever architectures, larger corpora, or whether BERT-base-uncased is unusually vulnerable."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper distinguishes between the retrieval manipulation proxy (Success@K, ΔMRR) and the downstream impact on answer quality, running a separate evaluation on SQuAD and NQ-Open (Section 4.5, Table 5) to validate that retrieval rank manipulation actually degrades generated answers."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "The main retriever is specified as 'BERT-base-uncased encoder' with 'over 110 million parameters' and '768-dimensional CLS embeddings' (Section 4.1). For detection, 'RoBERTa detector' is named (Section 4.4.1). These are specific, uniquely identifiable models."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The downstream QA evaluation (Section 4.5) feeds retrieved chunks to an LLM generator, but the generation prompt/template is not provided. The adversarial suffixes themselves are shown (Appendix C), but the prompt format for the downstream answer generation is missing."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "DE hyperparameters are reported: scale factor F (0.5-1.0), crossover rate CR (0.1-0.9), suffix length budget n_max (1-10), patience T, and population size N (Section 3.3). Specific values for the example: N=3, F=0.5, CR=0.5. The downstream evaluation uses 5-token suffix with up to 120 iterations (Section 4.5)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The method is a direct optimization loop (DE) over token sequences evaluated against a retriever."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states 'we randomly sample a subset of 1,000 documents and 100 queries' but leaves ambiguity in target passage selection: 'either drawn uniformly at random from the non-relevant documents, or selected as a topically confusable distractor' (Section 4.1) — it is unclear which method was actually used in which experiments."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no limitations, threats-to-validity, or discussion section. The paper goes directly from evaluation results (Section 4) to a brief conclusion (Section 5) with no dedicated limitations discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. The paper does not address limitations such as the small corpus size (1,000 documents vs. real-world millions), the single retriever model, or the gap between experimental and production RAG settings."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "No explicit scope boundaries are stated. The paper does not specify what the results do NOT show, such as applicability to production-scale corpora, modern instruction-tuned retrievers, or multi-stage RAG pipelines with rerankers."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The underlying BEIR datasets are publicly available, and the paper states 'Data and experiment results are available at' the GitHub repository (Section 4.1, reference [34])."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the data source (BEIR framework), sampling procedure (1,000 documents and 100 queries per dataset), encoding method (BERT-base-uncased CLS embeddings), and retrieval mechanism (cosine similarity for dense, BM25 for sparse)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks (BEIR/MS MARCO/SciFact/FiQA/FEVER)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from raw BEIR data to experimental setup has gaps. The target passage selection method is ambiguously described ('either drawn uniformly at random... or selected as a topically confusable distractor'). The specific random seed for sampling is not stated, and the downstream QA evaluation pipeline details are sparse."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding sources are mentioned anywhere in the paper. There is no acknowledgments section disclosing grants or sponsors."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: both authors are from the Department of Management Information Systems, National ChengChi University, Taipei, Taiwan. No conflict with evaluated systems."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "No funding is disclosed, so independence of funder cannot be assessed. The absence of any funding disclosure makes this NO by default."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "The paper evaluates an adversarial attack method against a retriever, not a pre-trained model's knowledge on a benchmark. BERT-base-uncased is used as a retrieval encoder, and the attack's validity does not depend on whether the model has seen the benchmark data."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests an attack strategy on retrieval behavior, not model knowledge. Train/test overlap in the BERT pre-training data is irrelevant to whether adversarial suffixes can manipulate retrieval rankings."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Contamination is not relevant because the paper evaluates the effectiveness of an adversarial attack method on retrieval systems, not the retriever's inherent knowledge of benchmark answers."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments are automated attacks on retrieval systems."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Pure computational experiment on retrieval benchmarks."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Average iteration counts are reported per method per dataset (Tables 1-2). Pool construction and query optimization times are reported in Appendix G (Table 14), with per-query times around 40-50 seconds. Section 4.3.1 discusses the iterations-tokens trade-off in detail."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "No total computational budget is stated. The paper does not report total GPU hours, hardware specifications, or aggregate compute cost across all experiments."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "DE is a stochastic algorithm but no multi-seed results are reported. All tables present single-run point estimates without any analysis of sensitivity to random initialization."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not state how many times each experiment was run. Results appear to be from single runs, but this is never explicitly stated."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "DE hyperparameters (F, CR, N, patience) are reported but there is no description of how they were selected — no search budget, no grid/random search, no sensitivity analysis over hyperparameter configurations."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper presents results for DE_seq_stop, DE_fixed_stop, and DE_seq variants but does not justify how specific hyperparameter values were chosen or whether these are the best among tested configurations."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper compares multiple methods across multiple datasets and thresholds without any correction for multiple comparisons. Only the readability analysis uses a significance test (Welch's t-test), with no family-wise correction."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement their own version of GGPP and PRADA baselines for comparison. There is no acknowledgment that their reimplementation may systematically underperform the original authors' implementations."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "GGPP iterations are listed as '—' in Table 2, making matched-compute comparison impossible. The paper discusses the iterations-tokens trade-off qualitatively (Section 4.3.1) but does not compare methods at equivalent compute budgets."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether Success@K on 1,000-document subsets with BERT-base-uncased actually measures vulnerability of real-world RAG systems, which use much larger corpora and more sophisticated retrievers."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The evaluation is a direct optimization against a retriever, not a scaffold-dependent agent evaluation."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether BERT-base-uncased's pre-training data includes any of the BEIR benchmark documents. BERT (2018) may have been trained on data overlapping with some benchmarks."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the attack evaluation setup leaks information that would not be available in a real attack scenario (e.g., knowing the exact corpus and encoder used)."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the sampled 100 queries and 1,000 documents are independent or share structural similarities that could inflate success rates."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are used. No canary strings, membership inference, or decontamination analysis."
       }
     }
   },
   "claims": [
     {
       "claim": "DE-based prompt optimization achieves competitive or higher success rates compared to GGPP on dense retrievers while using only ≤5 tokens",
       "evidence": "Table 2 shows DE_seq_stop achieves 0.739 Success@20 on SciFact vs 0.565 for GGPP, 1.000 Success@10 on MS MARCO matching GGPP, with only 1.32-2.76 average tokens vs GGPP's fixed 5 tokens. However, GGPP outperforms on MS MARCO Top-1 (0.830 vs 0.570).",
       "supported": "moderate"
     },
     {
       "claim": "DE_seq_stop outperforms PRADA at Top-1 success rates on sparse retrievers across all four benchmarks",
       "evidence": "Table 1 shows DE_seq_stop Top-1 rates of 0.250, 0.270, 0.620, 0.710 vs PRADA's 0.010, 0.030, 0.070, 0.020 on SciFact, FiQA, FEVER, MS MARCO respectively. However, PRADA achieves higher Top-10/Top-20 on some datasets.",
       "supported": "strong"
     },
     {
       "claim": "Early stopping cuts average query cost by approximately 40% while maintaining attack success",
       "evidence": "Section 4.3.2 and Figure 2 show DE_seq_stop reaches higher cumulative success at every suffix length compared to DE_seq. The 40% figure is stated but not derived with a clear calculation in the paper.",
       "supported": "moderate"
     },
     {
       "claim": "DE-generated adversarial suffixes evade RoBERTa-based detection with near-chance accuracy",
       "evidence": "Table 4 shows recall of 0.00% at 0.5% and 1.0% target FPR, and only 0.62% at 2.0% FPR. AUROC is 0.2023 and AUPRC is 0.4665 (Section 4.4.1).",
       "supported": "strong"
     },
     {
       "claim": "Readability-aware suffix construction significantly reduces MLM negative log-likelihood compared to full vocabulary pool",
       "evidence": "Table 16 reports Welch's t-test comparing pool_size=5,000 vs full (30,522): t-values from -6.54 to -9.40, all p < 10^-9 across three datasets. Table 15 shows monotonic NLL decrease as pool shrinks.",
       "supported": "strong"
     },
     {
       "claim": "Adversarial retrieval manipulation causes significant downstream answer quality degradation",
       "evidence": "Table 5 shows Top-1 attacks reduce SQuAD EM by 83.5%, F1 by 85.6%. On NQ-Open, Top-10 insertion reduces EM by 14.4% and F1 by 13.6%. Weighted average degradation is 26.7% EM on SQuAD and 14.8% EM on NQ-Open.",
       "supported": "strong"
     },
     {
       "claim": "Short suffixes (≤5 tokens) yield diminishing marginal returns under fixed iteration budgets",
       "evidence": "Figure 4 shows mean ΔRank rises sharply from L=1 to L=4, then plateaus. Figure 4b shows marginal gain per extra token declines steeply after L=2, reaching near zero by L=5 across all six dataset-threshold combinations.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "Tiny corpus size may inflate success rates",
       "detail": "All experiments use 1,000-document subsets, whereas real RAG systems typically index millions of documents. The much smaller search space likely makes adversarial ranking manipulation significantly easier. The paper acknowledges MS MARCO's 'relatively small and highly redundant' corpus but does not address this as a general limitation."
     },
     {
       "flag": "Single retriever model tested for dense retrieval",
       "detail": "Only BERT-base-uncased is used as the dense retriever. Modern RAG systems use more sophisticated retrievers (e.g., instruction-tuned embeddings, GritLM, Arctic-Embed — models the paper itself cites). Results may not transfer to these architectures."
     },
     {
       "flag": "No error bars or multi-run analysis on stochastic method",
       "detail": "Differential Evolution is inherently stochastic (random initialization, random mutation/crossover), yet all results appear to be single-run point estimates with no variance, confidence intervals, or seed sensitivity analysis."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper entirely omits a limitations or threats-to-validity section, jumping from evaluation results directly to a brief conclusion. Major threats (corpus scale, retriever generality, real-world applicability) go unacknowledged."
     },
     {
       "flag": "Unfair compute comparison with GGPP",
       "detail": "GGPP iteration counts are listed as '—' in Table 2, making it impossible to compare methods at equivalent computational cost. The paper claims DE is preferable but cannot demonstrate cost-efficiency relative to the gradient-based baseline."
     },
     {
       "flag": "Overclaimed generality",
       "detail": "The title claims 'Multiple Retrieval-Augmented Generation Applications' but experiments cover one dense retriever (BERT-base) and one sparse retriever (BM25) on four benchmark subsets. No multi-stage RAG pipelines, rerankers, or production systems are tested."
     }
   ],
   "cited_papers": [
     {
       "title": "Ignore Previous Prompt: Attack Techniques for Language Models",
       "authors": ["Fábio Perez", "Ian Ribeiro"],
       "year": 2022,
       "arxiv_id": "2211.09527",
       "relevance": "Foundational work on prompt injection attacks against LLMs, directly relevant to adversarial prompt research."
     },
     {
       "title": "Automatic and Universal Prompt Injection Attacks Against Large Language Models",
       "authors": ["Xiaogeng Liu", "Zhiyuan Yu", "Yizhe Zhang", "Ning Zhang", "Chaowei Xiao"],
       "year": 2024,
       "arxiv_id": "2403.04957",
       "relevance": "Proposes universal prompt injection attacks on LLMs, a closely related attack paradigm to adversarial suffix optimization."
     },
     {
       "title": "Goal-guided Generative Prompt Injection Attack on Large Language Models",
       "authors": ["Chong Zhang", "Mingyu Jin", "Qinkai Yu", "Chengzhi Liu", "Haochen Xue", "Xiaobo Jin"],
       "year": 2024,
       "arxiv_id": "2404.07234",
       "relevance": "Goal-guided prompt injection method for LLMs, relevant to the survey's coverage of adversarial prompt generation techniques."
     },
     {
       "title": "Jailbreaking Black Box Large Language Models in Twenty Queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J. Pappas", "Eric Wong"],
       "year": 2024,
       "arxiv_id": "2310.08419",
       "relevance": "Black-box jailbreaking of LLMs using few queries, relevant to gradient-free adversarial methods against language models."
     },
     {
       "title": "Prompt Perturbation in Retrieval-Augmented Generation based Large Language Models",
       "authors": ["Zhibo Hu", "Chen Wang", "Yanfeng Shu", "Hye-young Paik", "Liming Zhu"],
       "year": 2024,
       "arxiv_id": "2402.07179",
       "relevance": "Introduces GGPP, the primary white-box baseline in this paper, for adversarial prompt perturbation in RAG systems."
     },
     {
       "title": "Targeting the Core: A Simple and Effective Method to Attack RAG-based Agents via Direct LLM Manipulation",
       "authors": ["Xuying Li", "Zhuo Li", "Yuji Kosuga", "Yasuhiro Yoshida", "Victor Bian"],
       "year": 2024,
       "arxiv_id": "2412.04415",
       "relevance": "Demonstrates adversarial prefix attacks that subvert RAG-based AI agents, directly relevant to RAG security research."
     },
     {
       "title": "BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models",
       "authors": ["Jiaqi Xue", "Mengxin Zheng", "Yebowen Hu", "Fei Liu", "Xun Chen", "Qian Lou"],
       "year": 2024,
       "arxiv_id": "2406.00083",
       "relevance": "Poisoning-based backdoor attack on RAG databases, complementary attack vector to prompt-based adversarial approaches."
     },
     {
       "title": "CtrlRAG: Black-box Adversarial Attacks Based on Masked Language Models in Retrieval-Augmented Language Generation",
       "authors": ["Runqi Sui"],
       "year": 2025,
       "arxiv_id": "2503.06950",
       "relevance": "MLM-based black-box adversarial attack on RAG systems, a closely related concurrent work on retrieval manipulation."
     },
     {
       "title": "PRADA: Practical Black-box Adversarial Attacks against Neural Ranking Models",
       "authors": ["Chen Wu", "Ruqing Zhang"],
       "year": 2022,
       "doi": "10.1145/3576923",
       "relevance": "Black-box attack baseline for sparse retrieval systems, directly compared against DeRAG in experiments."
     },
     {
       "title": "Robust Safety Classifier Against Jailbreaking Attacks: Adversarial Prompt Shield",
       "authors": ["Jinhwa Kim", "Ali Derakhshan", "Ian Harris"],
       "year": 2024,
       "relevance": "Adversarial prompt detection classifier, relevant to defense mechanisms against prompt injection attacks."
     },
     {
       "title": "Detecting Language Model Attacks with Perplexity",
       "authors": ["Gabriel Alon", "Michael Kamfonas"],
       "year": 2023,
       "arxiv_id": "2308.14132",
       "relevance": "Perplexity-based detection of adversarial prompts, directly relevant to attack detection and evasion in LLM security."
     },
     {
       "title": "Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks",
       "authors": ["Patrick Lewis", "Ethan Perez", "Aleksandra Piktus", "Fabio Petroni", "Vladimir Karpukhin", "Naman Goyal", "Heinrich Küttler", "Mike Lewis", "Wen-tau Yih", "Tim Rocktäschel", "Sebastian Riedel", "Douwe Kiela"],
       "year": 2021,
       "arxiv_id": "2005.11401",
       "relevance": "Foundational RAG paper establishing the retrieval-augmented generation paradigm that DeRAG attacks."
     },
     {
       "title": "EvoPrompt: Connecting LLMs with Evolutionary Algorithms Yields Powerful Prompt Optimizers",
       "authors": ["Qingyan Guo", "Rui Wang", "Junliang Guo", "Bei Li", "Kaitao Song", "Xu Tan", "Guoqing Liu", "Jiang Bian", "Yujiu Yang"],
       "year": 2025,
       "arxiv_id": "2309.08532",
       "relevance": "Uses evolutionary strategies for prompt optimization, inspiring the application of DE to adversarial prompt generation."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Security researchers and RAG system developers could use this to test retrieval robustness; code is released but requires domain expertise to apply."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "RAG retrieval vulnerability to adversarial inputs is already known; the contribution is a specific black-box method rather than a surprising finding."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that RAG systems can be attacked without any access to model internals and that attacks evade detection, raising practical security concerns."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no challenges to specific companies or products, straightforward technical contribution."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and data are released on GitHub; a researcher could reproduce the attacks, but there is no pip-installable tool or live demo."
     },
     "brand_recognition": {
       "score": 0,
       "justification": "Authors are from National ChengChi University with no industry affiliation or brand recognition in the AI community."
     }
   }
 }