{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T19:50:47Z","timestamp":1782762647083,"version":"3.54.5"},"reference-count":76,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"\u201cPioneer\u201d and \u201cLeading Goose\u201d Research and Development Program of Zhejiang","doi-asserted-by":"publisher","award":["2024C01169"],"award-info":[{"award-number":["2024C01169"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62441238"],"award-info":[{"award-number":["62441238"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["U2441240"],"award-info":[{"award-number":["U2441240"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3705326","type":"journal-article","created":{"date-parts":[[2026,6,18]],"date-time":"2026-06-18T20:09:20Z","timestamp":1781813360000},"page":"5864-5879","source":"Crossref","is-referenced-by-count":0,"title":["External Data Extraction Attacks Against Retrieval-Augmented Large Language Models"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-3247-9806","authenticated-orcid":false,"given":"Yu","family":"He","sequence":"first","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-4989-3317","authenticated-orcid":false,"given":"Yifei","family":"Chen","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2258-265X","authenticated-orcid":false,"given":"Yiming","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3482-4975","authenticated-orcid":false,"given":"Shuo","family":"Shao","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-8703-3345","authenticated-orcid":false,"given":"Leyi","family":"Qi","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9921-7215","authenticated-orcid":false,"given":"Boheng","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7225-5449","authenticated-orcid":false,"given":"Dacheng","family":"Tao","sequence":"additional","affiliation":[{"name":"College of Computing and Data Science, Nanyang Technological University, Nanyang Ave, Singapore"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7872-6969","authenticated-orcid":false,"given":"Zhan","family":"Qin","sequence":"additional","affiliation":[{"name":"State Key Laboratory of Blockchain and Data Security, Zhejiang University, Hangzhou, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","first-page":"1","article-title":"Finetuned language models are zero-shot learners","volume-title":"Proc. ICLR","author":"Wei"},{"key":"ref2","first-page":"1","article-title":"CodeGen: An open large language model for code with multi-turn program synthesis","volume-title":"Proc. ICLR","author":"Nijkamp"},{"key":"ref3","first-page":"41092","article-title":"Prompting large language model for machine translation: A case study","volume-title":"Proc. ICML","author":"Zhang"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1145\/3703155"},{"key":"ref5","article-title":"A survey of large language models","author":"Xin Zhao","year":"2023","journal-title":"arXiv:2303.18223"},{"key":"ref6","first-page":"9459","article-title":"Retrieval-augmented generation for knowledge-intensive NLP tasks","volume-title":"Proc. NeurIPS","volume":"33","author":"Lewis"},{"key":"ref7","article-title":"Retrieval-augmented generation for large language models: A survey","author":"Gao","year":"2023","journal-title":"arXiv:2312.10997"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3637528.3671470"},{"key":"ref9","volume-title":"Develop Secure, Reliable Medical Apps With Rag and Nvidia Nemo Guardrails","author":"Ganju","year":"2024"},{"key":"ref10","volume-title":"Harnessing Rag in Healthcare: Use-cases, Impact, & Solutions","author":"Malec","year":"2025"},{"key":"ref11","volume-title":"Ai in Finance: The Promise and Risks of Rag","year":"2024"},{"key":"ref12","volume-title":"Leveraging Retrieval-augmented Generation (rag) in Banking: A New Era of Finance Transformation","year":"2023"},{"key":"ref13","volume-title":"Watsonx Assistant","year":"2024"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01176"},{"key":"ref15","article-title":"Rethinking data protection in the (generative) artificial intelligence era","author":"Li","year":"2025","journal-title":"arXiv:2507.03034"},{"key":"ref16","article-title":"DATABench: Evaluating dataset auditing in deep learning from an adversarial perspective","author":"Shao","year":"2025","journal-title":"arXiv:2507.05622"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.findings-acl.267"},{"key":"ref18","first-page":"48733","article-title":"Follow my instruction and spill the beans: Scalable data extraction from retrieval-augmented generation systems","volume-title":"Proc. ICLR","author":"Qi"},{"key":"ref19","article-title":"Unleashing worms and extracting data: Escalating the outcome of attacks against RAG-based inference in scale and severity using jailbreaking","author":"Cohen","year":"2024","journal-title":"arXiv:2409.08045"},{"key":"ref20","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"},{"key":"ref21","first-page":"56174","article-title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","volume-title":"Proc. ICLR","author":"Liu"},{"key":"ref22","first-page":"4657","article-title":"LLM-Fuzzer: Scaling assessment of large language model jailbreaks","volume-title":"Proc. USENIX Secur.","author":"Yu"},{"key":"ref23","article-title":"Jailbreaking leading safety-aligned LLMs with simple adaptive attacks","author":"Andriushchenko","year":"2024","journal-title":"arXiv:2404.02151"},{"key":"ref24","first-page":"12028","article-title":"Large language models as optimizers","volume-title":"Proc. ICLR","author":"Yang"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-49257-7_15"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1410"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.552"},{"key":"ref28","article-title":"Feedback-guided extraction of knowledge base from retrieval-augmented LLM applications","author":"Jiang","year":"2024","journal-title":"arXiv:2411.14110"},{"key":"ref29","first-page":"1","article-title":"A neural probabilistic language model","volume-title":"Proc. NeurIPS","author":"Bengio"},{"key":"ref30","first-page":"1","article-title":"Improving language understanding by generative pre-training. openai","author":"Radford","year":"2018"},{"key":"ref31","article-title":"GPT-4 technical report","author":"Achiam","year":"2023","journal-title":"arXiv:2303.08774"},{"key":"ref32","volume-title":"Claude 3.7 Sonnet and Claude Code","year":"2025"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670370"},{"key":"ref34","first-page":"1","article-title":"COVID-QA: A question answering dataset for COVID-19","volume-title":"Proc. Workshop NLP COVID-19 at ACL","author":"M\u00f6ller"},{"key":"ref35","article-title":"LLMMaps\u2014A visual metaphor for stratified evaluation of large language models","author":"Puchert","year":"2023","journal-title":"arXiv:2304.00457"},{"key":"ref36","article-title":"A comprehensive survey of hallucination mitigation techniques in large language models","author":"Tonmoy","year":"2024","journal-title":"arXiv:2401.01313"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3571730"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.52202\/079017-4136"},{"key":"ref39","article-title":"Is my data in your retrieval database? Membership inference attacks against retrieval augmented generation","author":"Anderson","year":"2024","journal-title":"arXiv:2405.20446"},{"key":"ref40","article-title":"Generating is believing: Membership inference attacks against retrieval-augmented generation","author":"Li","year":"2024","journal-title":"arXiv:2406.19234"},{"key":"ref41","first-page":"2633","article-title":"Extracting training data from large language models","volume-title":"Proc. USENIX Secur.","author":"Carlini"},{"key":"ref42","first-page":"4844","article-title":"TruVRF: Towards triple-granularity verification on machine unlearning","volume":"20","author":"Zhou","year":"2024","journal-title":"IEEE TIFS"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3581103"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3690306"},{"key":"ref45","first-page":"25132","article-title":"SILO language models: Isolating legal risk in a nonparametric datastore","volume-title":"Proc. ICLR","author":"Min"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.41"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3413592"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3744840"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1145\/3719027.3765103"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.921"},{"key":"ref51","first-page":"1","article-title":"Generalization through memorization: Nearest neighbor language models","volume-title":"Proc. ICLR","author":"Khandelwal"},{"key":"ref52","doi-asserted-by":"crossref","first-page":"1091","DOI":"10.1109\/TPAMI.2007.1078","article-title":"A normalized Levenshtein distance metric","volume":"29","author":"Li","year":"2007","journal-title":"TPAMI"},{"key":"ref53","first-page":"5253","article-title":"Extracting training data from diffusion models","volume-title":"Proc. 32nd USENIX Secur. Symp.","author":"Carlini"},{"key":"ref54","first-page":"40200","article-title":"UPAM: Unified prompt attack in text-to-image generation models against both textual filters and visual checkers","volume-title":"Proc. ICML","author":"Peng"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2024.24188"},{"key":"ref56","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023","journal-title":"arXiv:2309.00614"},{"key":"ref57","first-page":"2401","article-title":"PAPILLON: Efficient and stealthy fuzz testing-powered jailbreaks for LLMs","volume-title":"Proc. USENIX Secur.","author":"Gong"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/1553374.1553380"},{"key":"ref59","article-title":"Gemini: A family of highly capable multimodal models","author":"Team","year":"2023","journal-title":"arXiv:2312.11805"},{"key":"ref60","article-title":"DeepSeek-V3 technical report","author":"Liu","year":"2024","journal-title":"arXiv:2412.19437"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30115-8_22"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.7759\/cureus.40895"},{"key":"ref63","first-page":"641","article-title":"C-pack: Packaged resources to advance general Chinese embedding","volume-title":"Proc. SIGIR","author":"Xiao","year":"2024"},{"key":"ref64","volume-title":"Open Source Strikes Bread-New Fluffy Embeddings Model","author":"Lee","year":"2024"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.773"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.52202\/075280-3508"},{"key":"ref67","article-title":"AnglE-optimized text embeddings","author":"Li","year":"2023","journal-title":"arXiv:2309.12871"},{"key":"ref68","volume-title":"Optimizing Llms for Accuracy","year":"2026"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00250"},{"key":"ref70","first-page":"74","article-title":"Rouge: A package for automatic evaluation of summaries","volume-title":"Proc. Text Summarization Branches Out","author":"Lin"},{"key":"ref71","volume-title":"Cost of a Data Breach Report 2025","year":"2025"},{"key":"ref72","volume-title":"Openai\u2019s Custom Chatbots Are Leaking Their Secrets","author":"Burgess","year":"2023"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1145\/3696410.3714755"},{"key":"ref74","volume-title":"Retrieval-Augmented Generation (RAG)","year":"2025"},{"key":"ref75","article-title":"The llama 3 herd of models","author":"Grattafiori","year":"2024","journal-title":"arXiv:2407.21783"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1145\/3539618.3591903"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11570932.pdf?arnumber=11570932","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,29]],"date-time":"2026-06-29T19:39:11Z","timestamp":1782761951000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11570932\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":76,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3705326","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}