Architecture Components

Embedding Research

Security concerns in embedding models and vectors

20 matching entries out of 71 in this category

Embedding research results

20 entries

Fluent Single-Document RAG Corpus Poisoning

Published May 27, 2026Analyzed Jul 20, 2026Source: arXiv

SilentRetrieval describes a specific RAG corpus-integrity vulnerability: an attacker able to add a topically relevant document to a retrieval corpus can make that document rank highly and influence the generated answer while remaining fluent enough to evade simple perplexity checks. The paper evaluates a two-stage method combining retrieval-oriented document optimization with context-adaptive claim integration. A safe defensive reproduction is to use only isolated benchmark corpora and inert…

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

Evaluated models: Llama 2 7B Chat, Mistral 7B Instruct v0.2, Qwen 7B Chat+1 more

Llama 2 7B Chat
Mistral 7B Instruct v0.2
Qwen 7B Chat
GPT-3.5 Turbo

Retrieval Memory Injection

Published Feb 17, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in the similarity-based retrieval mechanisms of long-term memory-augmented Large Language Models (LLMs), specifically affecting systems like Mem0 and A-mem. The vulnerability arises from the system's reliance on dense embedding similarity (e.g., cosine similarity) to retrieve context from dynamic, user-generated memory banks without sufficient semantic validation or conflict resolution. An unprivileged remote attacker can exploit this by injecting "adversarial…

ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models

Evaluated models: GPT-oss 20B, Llama 3.2 3B, Gemma 3 27B

Zombie Agent Persistence

Published Feb 17, 2026Analyzed Feb 22, 2026Source: arXiv

Self-evolving Large Language Model (LLM) agents that utilize long-term memory mechanisms (such as Vector Databases for Retrieval-Augmented Generation or Sliding Window buffers) are vulnerable to persistent indirect prompt injection. This vulnerability, termed "Zombie Agent," occurs when the agent's memory update function ($F_M$) processes attacker-controlled content retrieved from external sources (e.g., web pages, documents) and commits it to long-term storage without sufficient sanitization…

Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections

Evaluated models: Not reported

RAG Knowledgebase Exfiltration

Published Feb 10, 2026Analyzed Feb 21, 2026Source: arXiv

Retrieval-Augmented Generation (RAG) systems are vulnerable to iterative knowledge-extraction attacks designed to reconstruct the underlying private knowledge base. The vulnerability exists due to the decoupled optimization of the retrieval and generation phases. Attackers can craft adversarial queries consisting of two distinct components: an "Information" component (optimized via gradient descent or random sampling to steer embeddings toward specific, diverse regions of the vector space) and…

Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation

Evaluated models: GPT-4o, Llama 3 8B, Qwen 2.5 7B

Progressive Attention LVLM Attack

Published Feb 4, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1+7 more

Gemini 2.5 Flash
Gemini 3 Pro Preview
GPT-4.1
GPT-5 Mini
Grok 4 Fast
LLaVA 1.5 7B
Llama 4 Maverick
Gemma 3 4B IT
Qwen3-VL 30B-A3B Instruct
Qwen3-VL 235B-A22B Instruct

Unified Robustness Gap

Published Jan 31, 2026Analyzed Mar 9, 2026Source: arXiv

Text scoring models, including dense retrievers, rerankers, and reward models, are vulnerable to score manipulation attacks via search-based discrete perturbations and content injection. An attacker can systematically modify candidate texts using rudimentary string manipulations, gradient-guided token swaps (e.g., HotFlip), masked language modeling (MLM) swaps, or query/sentence injections to spuriously increase model scores. This structural failure condition allows an irrelevant passage or a…

Unifying Adversarial Robustness and Training Across Text Scoring Models

Evaluated models: E5 BERT-base, Qwen 3 0.6B, Llama 3.2 3B Instruct+2 more

E5 BERT-base
Qwen 3 0.6B
Llama 3.2 3B Instruct
Llama 3.1 8B Instruct
Skywork Reward V2

Query-Agnostic Retrieval Poisoning

Published Jan 30, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in Large Language Model-based Retrieval (LLMR) systems allows attackers to intentionally hide specific documents from being retrieved (e.g., in RAG pipelines or search engines) by appending a small number of adversarially crafted, query-agnostic tokens. The attack operates in a complete black-box setting: it requires no knowledge of the victim's queries, the target retrieval model's parameters, or the underlying document corpus. By utilizing Document-Query Adversarial (DQ-A)…

" Someone Hid It": Query-Agnostic Black-Box Attacks on LLM-Based Retrieval

Evaluated models: Mistral 7B, Qwen 2.5 7B

Semantic Cache Collision Hijack

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

Semantic caching mechanisms in LLM applications are vulnerable to cross-tenant cache key collision attacks (CacheAttack) due to the inherent mathematical conflict between locality-preserving fuzzy hashing and cryptographic collision resistance (the avalanche effect). An attacker can leverage gradient-based search algorithms to optimize an adversarial discrete suffix that, when appended to a malicious prompt, forces its output embedding vector to collide with the embedding of a targeted benign…

From Similarity to Vulnerability: Key Collision Attack on LLM Semantic Caching

Evaluated models: Llama 3.1 8B, Mistral 7B, DeepSeek R1

Optimized Indirect Prompt Injection Crosses Retrieval Barrier

Published Jan 11, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box indirect prompt injection evaluation for embedding-based RAG and agent systems. It separates a poisoned document into a retrieval-optimized trigger fragment and an instruction-bearing attack fragment, showing that one injected item can be surfaced by natural queries and then influence model output or agent behavior. These are paper-reported findings; they were not independently verified here.

Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systems

Evaluated models: GPT-4o, GPT-4o Mini, Qwen 3 0.6B+19 more

GPT-4o
GPT-4o Mini
Qwen 3 0.6B
Qwen 3 1.7B
Qwen 3 4B
Qwen 3 8B
Qwen3-11B
Qwen 3 32B
Llama 3.2 3B
Llama 3.2 3B Instruct
Llama 3 8B
Llama 3 8B Instruct
Vicuna 7B
Vicuna 13B
gte-modernbert-base
OpenAI text-embedding-3-small
Voyage AI voyage-3.5-lite
Alibaba Cloud text-embedding-v4
contriever-msmarco
Qwen3-Embedding-0.6B
Qwen3-Embedding-4B
Qwen3-Embedding-8B

Single Word Video Corruption

Published Dec 30, 2025Analyzed Jan 14, 2026Source: arXiv

Text-to-Video (T2V) diffusion models are vulnerable to black-box adversarial prompt attacks that degrade output quality regarding semantic fidelity and temporal dynamics. This vulnerability is exploited via the T2VAttack framework, which utilizes two primary vector strategies: T2VAttack-S (Substitution) and T2VAttack-I (Insertion). T2VAttack-S leverages a greedy search to identify key semantic tokens and replaces them with high-similarity synonyms defined in lexical databases (e.g., WordNet)…

T2VAttack: Adversarial Attack on Text-to-Video Diffusion Models

Evaluated models: Not reported

Related research categories