RAG Attack on Natural Questions, HotpotQA, and MS-MARCO Average
1.875Average ASRCorpus
Evaluation results
| Method | Links | |
|---|---|---|
| CorpusQuery-path manipulation=false, Corpus-path manipulation=true, Unaware of user query=false, Retrieval steering=true, Retriever black-box=false, LLM black-box=true, Local lightweight computation=false2026.03 | 1.875 | |
| GCGQuery-path manipulation=true, Corpus-path manipulation=false, Unaware of user query=true, Retrieval steering=false, Retriever black-box=true, LLM black-box=false, Local lightweight computation=false2026.03 | 3.125 | |
| Clean-RAGQuery-path manipulation=true, Corpus-path manipulation=false, Unaware of user query=true, Retrieval steering=false, Retriever black-box=true, LLM black-box=true, Local lightweight computation=true2026.03 | 45.778 | |
| GGPPQuery-path manipulation=true, Corpus-path manipulation=false, Unaware of user query=false, Retrieval steering=true, Retriever black-box=false, LLM black-box=true, Local lightweight computation=false2026.03 | 82.875 | |
| DisinformationQuery-path manipulation=false, Corpus-path manipulation=true, Unaware of user query=false, Retrieval steering=true, Retriever black-box=true, LLM black-box=true, Local lightweight computation=true2026.03 | 88.333 | |
| PoisonedRAGQuery-path manipulation=false, Corpus-path manipulation=true, Unaware of user query=false, Retrieval steering=true, Retriever black-box=true, LLM black-box=true, Local lightweight computation=true2026.03 | 92 | |
| PR-AttackQuery-path manipulation=true, Corpus-path manipulation=true, Unaware of user query=false, Retrieval steering=true, Retriever black-box=false, LLM black-box=false, Local lightweight computation=false2026.03 | 97.167 | |
| PIDP-AttackQuery-path manipulation=true, Corpus-path manipulation=true, Unaware of user query=true, Retrieval steering=true, Retriever black-box=true, LLM black-box=true, Local lightweight computation=true2026.03 | 98.125 |