{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,19]],"date-time":"2026-09-19T07:19:53Z","timestamp":1789802393162,"version":"4.0.1"},"reference-count":61,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T00:00:00Z","timestamp":1765152000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,12,8]],"date-time":"2025-12-08T00:00:00Z","timestamp":1765152000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,12,8]]},"DOI":"10.1109\/acsac67867.2025.00093","type":"proceedings-article","created":{"date-parts":[[2026,2,24]],"date-time":"2026-02-24T20:54:58Z","timestamp":1771966498000},"page":"1178-1192","source":"Crossref","is-referenced-by-count":4,"title":["Rescuing the Unpoisoned: Efficient Defense Against Knowledge Corruption Attacks on RAG Systems"],"prefix":"10.1109","author":[{"given":"Minseok","family":"Kim","sequence":"first","affiliation":[{"name":"Sungkyunkwan University,Suwon,South Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hankook","family":"Lee","sequence":"additional","affiliation":[{"name":"Sungkyunkwan University,Suwon,South Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hyungjoon","family":"Koo","sequence":"additional","affiliation":[{"name":"Sungkyunkwan University,Suwon,South Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GPT-4 technical report","volume-title":"CoRR","year":"2023"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.caeai.2023.100172"},{"key":"ref3","author":"Pandya","year":"2023","journal-title":"Automating customer service using langchain: Building custom open-source GPT chatbot for organizations"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1016\/j.teler.2024.100138"},{"key":"ref5","author":"Hu","year":"2024","journal-title":"A survey on large language model-based game agents"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.685"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.139"},{"key":"ref8","author":"Izacard","year":"2021","journal-title":"Unsupervised dense information retrieval with contrastive learning"},{"key":"ref9","article-title":"Atlas: Few-shot learning with retrieval augmented language models","author":"Izacard","year":"2023","journal-title":"Journal of Machine Learning Research"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3616855.3635853"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3708882"},{"key":"ref12","author":"Xu","year":"2024","journal-title":"Hallucination is inevitable: An innate limitation of large language models"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.471"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1016\/j.nlp.2024.100065"},{"key":"ref15","article-title":"Efficient large language models: A survey","author":"Wan","year":"2024","journal-title":"Transactions on Machine Learning Research"},{"key":"ref16","article-title":"Retrieval-augmented generation for knowledge-intensive NLP tasks","author":"Lewis","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-emnlp.161"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.337"},{"key":"ref19","article-title":"PoisonedRAG: Knowledge poisoning attacks to retrieval-augmented generation of large language models","volume-title":"34rd USENIX Security Symposium (USENIX Security 25)","author":"Zou","year":"2025"},{"key":"ref20","author":"Xue","year":"2024","journal-title":"BadRAG: Identifying vulnerabilities in retrieval augmented generation of large language models"},{"key":"ref21","author":"Cheng","year":"2024","journal-title":"TrojanRAG: Retrieval-augmented generation can be backdoor driver in large language models"},{"key":"ref22","author":"Long","year":"2024","journal-title":"Backdoor attacks on dense passage retrievers for disseminating misinformation"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671932"},{"key":"ref24","author":"Xiang","year":"2024","journal-title":"Certifiably robust RAG against retrieval corruption"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-naacl.159"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00276"},{"key":"ref27","article-title":"Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context","volume-title":"Gemini Team","year":"2024"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.550"},{"key":"ref29","article-title":"Approximate nearest neighbor negative contrastive learning for dense text retrieval","volume-title":"International Conference on Learning Representations","author":"Xiong","year":"2021"},{"key":"ref30","article-title":"MS MARCO: A human generated machine reading comprehension dataset","author":"Bajaj","year":"2016","journal-title":"arXiv preprint"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/n19\u20131423"},{"key":"ref32","author":"Radford","year":"2019","journal-title":"Language models are unsupervised multitask learners"},{"key":"ref33","first-page":"29","article-title":"Using TF-IDF to determine word relevance in document queries","volume-title":"Proceedings of the First Instructional Conference on Machine Learning","author":"Ramos","year":"2003"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/1031171.1031181"},{"key":"ref35","author":"M\u00fcllner","year":"2011","journal-title":"Modern hierarchical, agglomerative clustering algorithms"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2022.11.139"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1410"},{"key":"ref38","author":"Zhang","year":"2024","journal-title":"Jasper and stella: distillation of sota embedding models"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2019.2921572"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.48550\/arXiv.1201.0490"},{"key":"ref41","article-title":"Attention is all you need","author":"Vaswani","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref42","author":"Touvron","year":"2023","journal-title":"Llama 2: Open foundation and fine-tuned chat models"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1036\/1097-8542.731800"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1259"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.eacl-main.74"},{"key":"ref46","article-title":"Nvidia management library (NVML)","volume-title":"NVIDIA","year":"2024"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/MIPR62202.2024.00031"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.463"},{"key":"ref49","article-title":"Self-RAG: Learning to retrieve, generate, and critique through self-reflection","volume-title":"The Twelfth International Conference on Learning Representations","author":"Asai","year":"2024"},{"key":"ref50","author":"Chaudhari","year":"2024","journal-title":"Phantom: General trigger attacks on retrieval augmented language generation"},{"key":"ref51","author":"Shafran","year":"2024","journal-title":"Machine against the RAG: Jamming retrieval-augmented generation with blocker documents"},{"key":"ref52","first-page":"226","article-title":"A density-based algorithm for discovering clusters in large spatial databases with noise","volume-title":"Proceedings of the Second International Conference on Knowledge Discovery and Data Mining","author":"Ester","year":"1996"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657834"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1145\/1989323.1989357"},{"key":"ref55","article-title":"Copilot, an ai companion for everyone","volume-title":"Microsoft","year":"2025"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-acl.528"},{"key":"ref57","author":"Contal","year":"2024","journal-title":"RAGSys: Item-cold-start recommender as RAG system"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.acl-long.546"},{"key":"ref59","author":"Jain","year":"2023","journal-title":"Baseline defenses for adversarial attacks against aligned language models"},{"key":"ref60","volume-title":"Detecting language model attacks with perplexity","author":"Alon","year":"2023"},{"key":"ref61","first-page":"8634","article-title":"Reflexion: language agents with verbal reinforcement learning","volume-title":"Advances in Neural Information Processing Systems","author":"Shinn","year":"2023"}],"event":{"name":"2025 IEEE Annual Computer Security Applications Conference (ACSAC)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,12,8]]},"end":{"date-parts":[[2025,12,12]]}},"container-title":["2025 IEEE Annual Computer Security Applications Conference (ACSAC)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11391636\/11391706\/11391803.pdf?arnumber=11391803","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,25]],"date-time":"2026-02-25T07:01:02Z","timestamp":1772002862000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11391803\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,12,8]]},"references-count":61,"URL":"https:\/\/doi.org\/10.1109\/acsac67867.2025.00093","relation":{},"subject":[],"published":{"date-parts":[[2025,12,8]]}}}