DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation

• URL: http://arxiv.org/abs/2606.01212v2
• Date: Wed, 03 Jun 2026 04:47:29 GMT
• Title: DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation
• Abstract summary: Existing RAG attacks are largely focusing on individual queries or narrow topic-local query sets.<n>We introduce discourse-level opinion manipulation, a new threat model in which coordinated influence across a semantic query network induces opinion shifts.<n>Experiments demonstrate that DiscourseFlip consistently induces targeted opinion shifts across the contextualized query network.
• Score: 29.953161235840188
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Retrieval-Augmented Generation (RAG) systems are widely deployed and increasingly influential, but their reliance on external corpora exposes new security risks from poisoned retrieval content. Existing RAG attacks are largely focusing on individual queries or narrow topic-local query sets, which limits their practical reach and offers limited camouflage in real-world settings. In this paper, we introduce discourse-level opinion manipulation, a new threat model in which coordinated influence across a semantic query network induces opinion shifts over a holistic, multi-topic query space. We formalize this threat in a black-box setting and propose DiscourseFlip, an agentic, graph-guided attack that dynamically allocates a limited poisoning budget to maximize discourse-level opinion deviation. Extensive experiments demonstrate that DiscourseFlip consistently induces targeted opinion shifts across the contextualized query network and significantly outperforms existing baselines in terms of coverage and effectiveness. User studies further confirm that DiscourseFlip is effective while remaining well camouflaged from user detection. Moreover, systematic analyses show that existing mitigation strategies are ineffective against discourse-level manipulation, underscoring the urgent need for more robust and adaptive defenses to address discourse-level vulnerabilities.

Related papers

• Dive into Ambiguity: A*-Inspired Multi-Agents Commonsense Obfuscation Attack on LLM Prompts [14.233668486426795]
  Large language models (LLMs) excel in reasoning and knowledge-intensive tasks but remain vulnerable to prompt-level adversarial attacks.<n>We propose an A*-inspired Factual Error Induction Framework, a framework for generating semantically aligned yet obfuscated prompts.<n>We prove that prompt rewriting follows a contractive recurrence, leading to semantic collapse as $$ decreases.
  arXiv  Detail & Related papers  (2026-05-31T20:20:53Z)
• Attention Hijacking: Response Manipulation Across Queries in Vision-Language Models [57.870323273127234]
  Motivated by the observation, we propose textbfAttention Hijacking, a novel adversarial attack that steers internal attention toward a persistent image-dominant pattern.<n>Our method reduces the dependence of the manipulated output on the specific wording of the query.
  arXiv  Detail & Related papers  (2026-05-17T08:02:27Z)
• REALISTA: Realistic Latent Adversarial Attacks that Elicit LLM Hallucinations [60.451310947394596]
  We formulate hallucination elicitation as a constrained optimization problem.<n>The goal is to find semantically coherent adversarial prompts that are equivalent to benign user prompts.<n>We propose REALISTA, a realistic latent-space attack framework.
  arXiv  Detail & Related papers  (2026-05-12T23:13:50Z)
• Prompt-Unknown Promotion Attacks against LLM-based Sequential Recommender Systems [51.504307822017985]
  Large language model-powered sequential recommender systems (LLM-SRSs) have recently demonstrated remarkable performance.<n>This paper investigates the item promotion attack in LLM-SRSs under a more realistic setting where both the system prompt and victim model are unknown to the attacker.
  arXiv  Detail & Related papers  (2026-04-26T10:09:26Z)
• Vulnerability Disclosure through Adaptive Black-Box Adversarial Attacks on NIDS [0.393259574660092]
  This paper proposes a novel approach for black-box adversarial attacks.<n>Unlike prior work, which often assumes system access or relies on repeated probing, our method strictly respect black-box constraints.<n>We present an adaptive feature selection strategy using change-point detection and causality analysis to identify and target sensitive features to perturbations.
  arXiv  Detail & Related papers  (2025-06-25T16:10:20Z)
• ROSE: Toward Reality-Oriented Safety Evaluation of Large Language Models [60.28667314609623]
  Large Language Models (LLMs) are increasingly deployed as black-box components in real-world applications.<n>We propose Reality-Oriented Safety Evaluation (ROSE), a novel framework that uses multi-objective reinforcement learning to fine-tune an adversarial LLM.
  arXiv  Detail & Related papers  (2025-06-17T10:55:17Z)
• The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems [101.68501850486179]
  We explore adversarial attacks against retrieval-augmented generation (RAG) systems to identify their vulnerabilities.<n>This task aims to find imperceptible perturbations that retrieve a target document, originally excluded from the initial top-$k$ candidate set.<n>We propose ReGENT, a reinforcement learning-based framework that tracks interactions between the attacker and the target RAG.
  arXiv  Detail & Related papers  (2025-05-24T08:19:25Z)
• Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs [83.11815479874447]
  We propose a novel jailbreak attack framework, inspired by cognitive decomposition and biases in human cognition.<n>We employ cognitive decomposition to reduce the complexity of malicious prompts and relevance bias to reorganize prompts.<n>We also introduce a ranking-based harmfulness evaluation metric that surpasses the traditional binary success-or-failure paradigm.
  arXiv  Detail & Related papers  (2025-05-03T05:28:11Z)
• PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization [13.751251342738225]
  Large Language Models (LLMs) have demonstrated remarkable performance across a wide range of applications.<n>They also exhibit inherent limitations, such as outdated knowledge and susceptibility to hallucinations.<n>Recent efforts have focused on the security of RAG-based LLMs, yet existing attack methods face three critical challenges.<n>We propose coordinated Prompt-RAG attack (PR-attack), a novel optimization-driven attack that introduces a small number of poisoned texts into the knowledge database.
  arXiv  Detail & Related papers  (2025-04-10T13:09:50Z)
• Unknown Presentation Attack Detection against Rational Attackers [6.351869353952288]
  Presentation attack detection and multimedia forensics are still vulnerable to attacks in real-life settings. Some of the challenges for existing solutions are the detection of unknown attacks, the ability to perform in adversarial settings, few-shot learning, and explainability. New optimization criterion is proposed and a set of requirements are defined for improving the performance of these systems in real-life settings.
  arXiv  Detail & Related papers  (2020-10-04T14:37:10Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.