Large Language Models (LLMs), trained on vast web corpora and now widely integrated into web services like search engines and chatbots, have raised growing concerns about their privacy and security. This has spurred the development of Machine Unlearning techniques, which aim to effectively remove the influence of specific data (such as private user information, copyrighted web content, or harmful knowledge) from trained models while preserving general performance. However, existing LLM unlearning approaches face significant challenges, including extensive parameter modifications, a heavy reliance on retain sets to preserve utility, and limited scalability for handling sequential unlearning requests, impeding their real-world deployment in dynamic web environments. In this work, we propose Semantic Redirection for Unlearning (SRU), a lightweight framework that fine-tunes only the output word embedding layer. This targeted adjustment reshapes the model's semantic-to-lexical mapping to block undesired concepts without disturbing deeper representations, thereby preserving the model's general performance and eliminating dependency on retain sets. Furthermore, SRU's modular design enables independent, sequential unlearning tasks—a vital feature for live web services handling continuous data removal requests. Experiments on the MUSE benchmark demonstrate that SRU achieves state-of-the-art efficiency, reducing computational cost by approximately 98%, while maintaining competitive unlearning performance, making it a practical and efficient solution for building compliant and trustworthy LLM-powered web applications.
论文检索
输入标题、作者或关键词，从 15,207 篇学术成果中精准定位
Quantization is widely used to enable local deployment of large language models (LLMs) on resource-constrained devices. Recent work (e.g., QuRA) shows quantization can be exploited via rounding manipulation to implant backdoors. However, such an attack has been evaluated only on small models and does not directly apply to LLMs due to three key constraints: (1) limited poisoning data from small, task-agnostic calibration sets; (2) layer-wise quantization restricting adversarial access to global representations; and (3) lack of gradient access in quantization pipelines, blocking gradient-based attacks. We propose LLMQuA, a practical quantization-phase backdoor attack tailored to the LLM setting. LLMQuA (i) injects backdoors via data-efficient knowledge editing with few source–target token pairs, (ii) optimizes quantization parameters layer-locally to preserve activation distributions, and (iii) operates without gradient access by directly distorting quantized weights to reprogram token semantics. We evaluate LLMQuA on representative LLMs and two important attack scenarios: evasion of content moderation and causing systematic refusal of benign user queries. Empirically, LLMQuA reduces model moderation accuracy by up to 67.91% on correctly classified samples and induces refusal-to-answer behavior for over 90% of targeted queries, while degrading overall model utility by only a negligible margin on average. Finally, when tested against a range of deployment-phase defenses, many defenses fail to reliably detect LLMQuA or require substantially increased computational or operational costs to mitigate it. These results expose a practical, low-overhead supply-chain threat to quantized LLM deployments and motivate the need for deployment-aware integrity checks in LLM quantization workflows.
While retrieval-augmented generation systems partially address the hallucination issues in large language models, it also introduces new vulnerabilities to knowledge corruption attacks. Adversaries exploit these vulnerabilities by poisoning documents provided by RAG system to manipulate LLM outputs. To counter this threat, we propose SecureCollaRAG, a Byzantine-tolerant collaborative RAG framework leveraging Multi-source Knowledge Validation Mechanism. Our approach enables agent system to securely verify document provenance through dynamic GNN-based credibility scoring, effectively preventing stealthy knowledge corruption attacks while preserving essential domain knowledge integrity. Through extensive evaluations and formal analysis, we demonstrate that SecureCollaRAG maintains robustness against attackers under non-IID data distributions. Content warning: This paper contains unfiltered content generated by LLMs that may contain malicious contents.
Large language models (LLMs) have been widely integrated into critical automated workflows, including contract review and job application processes. However, LLMs are susceptible to manipulation by fraudulent information, which can lead to harmful outcomes. Although advanced defense methods have been developed to address this issue, they often exhibit limitations in effectiveness, interpretability, and generalizability, particularly when applied to LLM-based applications. To address these challenges, we introduce FraudShield, a novel framework designed to protect LLMs from fraudulent content by leveraging a comprehensive analysis of fraud tactics. Specifically, FraudShield constructs and refines a fraud tactic–keyword knowledge graph to capture high-confidence associations between suspicious text and fraud techniques. The structured knowledge graph augments the original input by highlighting keywords and providing supporting evidence, guiding the LLM toward more secure responses. Extensive experiments show that FraudShield consistently outperforms state-of-the-art defenses across four mainstream LLMs and five representative fraud types, while also offering interpretable clues for the model's generations.
Federated knowledge graph embedding (FKGE) leverages distributed knowledge graphs (KGs) to collaboratively learn latent representations while preserving data privacy. However, this decentralized paradigm exposes vulnerabilities to client-side attacks, particularly untargeted poisoning attacks, which remain underexplored in FKGE and risk severe performance degradation. This paper presents the first systematic investigation of untargeted poisoning attacks on FKGE, unveiling their feasibility at both data and embedding levels. We design three novel poisoning attacks, among which the embedding-level attacks exhibit superior attack efficacy. To mitigate such threats, we further propose a learning-based defense mechanism that leverages embedding density for anomaly detection to identify malicious clients. Our theoretical results substantiate the effectiveness of both the attacks and the defense, and clarify why embedding-level poisoning is especially potent. Extensive experiments demonstrate that the proposed attacks induce significant performance deterioration, with core metrics dropping by up to 93%. Conversely, LDM effectively counters these attacks and restores performance to pre-attack levels or even surpasses them when mitigating embedding-level attacks.
The deployment of self-hosted large language models (LLMs) has experienced unprecedented growth for enhanced data privacy and control. Yet, such deployment relies on diverse web services, whose vulnerabilities, although mentioned in a few studies, are largely underexplored, conflicting with the security tenet. From a systematic perspective, we propose LENS, a framework that explores and exploits vulnerabilities in self-hosted LLM services for comprehensive security evaluation. LENS integrates profiling and filtering, endpoint knowledge construction, and attack graph modeling for the automatic discovery, probing, and exploitation of public-facing LLM deployment targets, respectively. We conducted extensive empirical evaluation on real-world self-hosted LLM services across 16 mainstream platforms, 71,249 discovered deployment targets, and 307 API endpoints. Both quantitative and qualitative evidence reveal the prevalence of security vulnerabilities across different self-hosted LLM services. Notably, 75% of responsive targets allow web API interactions without authentication, rendering exploitation such as injection attacks (97% for Ollama), unauthenticated access (20.2% for AnythingLLM), and default credential abuse (60.6% for Dify). We have responsibly reported the findings to the relevant community and obtained 7 CVE IDs, including 4 critical vulnerabilities (CVSS > 9.0) and 2 high-severity ones.
Large Language Models (LLMs) have recently demonstrated remarkable reasoning abilities, yet hallucinate on knowledge-intensive tasks. Retrieval-augmented generation (RAG) mitigates this issue by grounding answers in external sources, e.g., knowledge graphs (KGs). However, existing KG-based RAG approaches rely on semantics-unaware path sampling and are weakly aligned with KG reasoning objectives, which limits further accuracy gains. They also feed retrieved paths directly into the reasoner without organizing them into answer-centered reasoning paths, hindering small LLMs' ability to leverage the retrieved knowledge. Furthermore, prior works predominantly rely on large LLMs (e.g., ChatGPT/GPT-4) or assume backbones above 7B parameters, leaving sub-7B models underexplored. We address this gap with RPO-RAG, the first KG-based RAG framework specifically designed for small LLMs, to the best of our knowledge. RPO-RAG introduces three key innovations: (1) a query-path semantic sampling strategy that provides informative supervisory signals; (2) a relation-aware preference optimization that aligns training with intermediate KG reasoning signals (e.g., relation); and (3) an answer-centered prompt design that organizes entities and reasoning paths in an interpretable format. Extensive experiments on two benchmark Knowledge Graph Question Answering (KGQA) datasets, WebQSP and CWQ, demonstrate that RPO-RAG effectively bridges the performance gap between small and large language models. On WebQSP, it improves F1 by up to 8.8%, reflecting enhanced answer precision, while on CWQ it achieves new state-of-the-art results among models under 8B parameters in both Hit and F1. Overall, RPO-RAG substantially improves the reasoning capability of small LLMs—even under 3B parameters—highlighting their potential for resource-efficient and practical on-device KGQA applications.
Retrieval-Augmented Generation (RAG) has emerged as a paradigm for enhancing large language models (LLMs) with external knowledge, yet existing graph-based methods face a fundamental limitation: entity-centric and chunk-centric approaches operate on representations anchored to original text without true knowledge fusion. While entity-centric methods connect logically related content and chunk-centric methods preserve context, both retrieve information separately through similarity search, missing emergent understanding from their synthesis. In this paper, we propose HyGRAG, a hierarchical graph RAG framework that transcends source documents by addressing three core challenges: constructing summaries that genuinely integrate contextual and relational information, leveraging these synthesized representations to access emergent knowledge during retrieval, and efficiently updating hierarchical structures for dynamic corpora. Specifically, we design hierarchical index structures over hybrid graphs with both chunk and entity nodes, then iteratively cluster them and generate LLM-based summaries. Then, we design context and relation-aware retrieval that searches across all abstraction levels while expanding through community membership. Moreover, we enable dynamic knowledge update through attachment-based algorithms with only local re-summarization. Experimental results show that HyGRAG improves the average accuracy of multi-hop reasoning tasks by 9.7%, while maintaining reasonable efficiency.
Graph-based Retrieval-Augmented Generation (RAG) typically operates on binary Knowledge Graphs (KGs). However, decomposing complex facts into binary triples often leads to semantic fragmentation and longer reasoning paths, increasing the risk of retrieval drift and computational overhead. In contrast, n-ary hypergraphs preserve high-order relational integrity, enabling shallower and more semantically cohesive inference. To exploit this topology, we propose HyperRAG, a framework tailored for n-ary hypergraphs featuring two complementary retrieval paradigms: (i) HyperRetriever learns structural-semantic reasoning over n-ary facts to construct query-conditioned relational chains. It enables accurate factual tracking, adaptive high-order traversal, and interpretable multi-hop reasoning under context constraints. (ii) HyperMemory leverages the LLM's parametric memory to guide beam search, dynamically scoring n-ary facts and entities for query-aware path expansion. Extensive evaluations on WikiTopics (11 closed-domain datasets) and three open-domain QA benchmarks (HotpotQA, MuSiQue, and 2WikiMultiHopQA) validate HyperRAG's effectiveness. HyperRetriever achieves the highest answer accuracy overall, with average gains of 2.95% in MRR and 1.23% in Hits@10 over the strongest baseline. Qualitative analysis further shows that HyperRetriever bridges reasoning gaps through adaptive and interpretable n-ary chain construction, benefiting both open and closed-domain QA. Our codes are publicly available at https://github.com/Vincent-Lien/HyperRAG.git.
Retrieval-Augmented Generation (RAG) effectively grounds Large Language Models (LLMs) with external knowledge and is widely applied to Web-related tasks. However, its scalability is hindered by excessive context length and redundant retrievals. Recent research on soft context compression aims to address this by encoding long documents into compact embeddings, yet they often underperform non-compressed RAG due to their reliance on auto-encoder-like full-compression that forces the encoder to compress all document information regardless of relevance to the input query. In this work, we conduct an analysis on this paradigm and reveal two fundamental limitations: (I) Infeasibility: full-compression conflicts with the LLM's downstream generation behavior; and (II) Non-necessity: full-compression is unnecessary and dilutes task-relevant information density. Motivated by these insights, we introduce SeleCom, a selector-based soft compression framework for RAG that redefines the encoder's role as query-conditioned information selector. The selector is decoder-only and is trained with a massive, diverse and difficulty-graded synthetic QA dataset with curriculum learning. Extensive experiments show that SeleCom significantly outperforms existing soft compression approaches and achieves competitive or superior performance to non-compression baselines, while reducing computation and latency by 33.8%~84.6%.
Medical question answering (QA) demands reliable access to rich, domain-specific knowledge. A prevalent strategy enhances large language models (LLMs) with either external knowledge retrieved from medical corpora or parametric knowledge embedded with model parameters. Existing methods generally fall into two paradigms: Retrieval-Augmented Generation (RAG), which grounds reasoning in retrieved evidence, and Generation-Augmented Generation (GAG), which relies exclusively on internally generated contexts. However, RAG often suffers from noisy or incomplete retrieval, whereas GAG is prone to hallucinated or inaccurate content due to unconstrained generation. Both limitations can misguide reasoning and compromise answer reliability. To overcome these challenges, we propose MedRGAG, a unified retrieval--generation augmented framework that seamlessly integrates external and parametric knowledge for medical QA. MedRGAG consists of two core modules: Knowledge-Guided Context Completion (KGCC), which steers the generator to produce background documents that complement knowledge gaps revealed by retrieval, and Knowledge-Aware Document Selection (KADS), which adaptively selects an optimal combination of retrieved and generated documents to construct concise yet comprehensive evidence for answers. Extensive experiments on five medical QA benchmarks demonstrate that MedRGAG achieves a 12.5% improvement over MedRAG and a 4.5% gain over MedGENIE, highlighting the effectiveness of unifying retrieval and generation for knowledge-intensive medical reasoning. Further analyses show that our framework effectively generates complementary contexts and recovers informative retrieved evidence. Our code and data are publicly available at https://github.com/ll0ruc/MedRGAG.
Scientific document retrieval is a critical task for enabling knowledge discovery and supporting research across diverse domains. However, existing dense retrieval methods often struggle to capture fine-grained scientific concepts in texts due to their reliance on holistic embeddings and limited domain understanding. Recent approaches leverage large language models (LLMs) to extract fine-grained semantic entities and enhance semantic matching, but they typically treat entities as independent fragments, overlooking the multi-faceted nature of scientific concepts. To address this limitation, we propose Pairwise Semantic Matching (PairSem), a framework that represents relevant semantics as entity–aspect pairs, capturing complex, multi-faceted scientific concepts. PairSem is unsupervised, base retriever-agnostic, and plug-and-play, enabling precise and context-aware matching without requiring query-document labels or entity annotations. Extensive experiments on multiple datasets and retrievers demonstrate that PairSem significantly improves retrieval performance, highlighting the importance of modeling multi-aspect semantics in scientific information retrieval.
Deep Research systems have revolutionized how LLMs solve complex questions through iterative reasoning and evidence gathering. However, current systems remain fundamentally constrained to textual web data, overlooking the vast knowledge embedded in multimodal documents: scientific papers, technical reports, and financial documents where critical information exists in figures, tables, charts, and equations. Processing such documents demands sophisticated parsing to preserve visual semantics, intelligent chunking to maintain structural coherence, and adaptive retrieval across modalities, which are capabilities absent in existing systems. In response, we present Doc-Researcher, a unified system that bridges this gap through three integrated components: (i) deep multimodal parsing that preserves layout structure and visual semantics while creating multi-granular representations from chunk to document level, (ii) systematic retrieval architecture supporting text-only, vision-only, and hybrid paradigms with dynamic granularity selection, and (iii) iterative multi-agent workflows that decompose complex queries, progressively accumulate evidence, and synthesize comprehensive answers across documents and modalities. To enable rigorous evaluation, we introduce M4DocBench, the first benchmark for Multi-modal, Multi-hop, Multi-document, and Multi-turn deep research. Featuring 158 expert-annotated questions with complete evidence chains across 304 documents, M4DocBench tests capabilities that existing benchmarks cannot assess. Experiments demonstrate that Doc-Researcher achieves 50.6% accuracy, 3.4× better than state-of-the-art baselines, validating that effective document research requires not just better retrieval, but fundamentally deep parsing that preserve multimodal integrity and support iterative research. Our work establishes a new paradigm for conducting deep research on multimodal document collections.
Retrieval-augmented generation (RAG) has facilitated large language models (LLMs) by grounding facts in external knowledge. While prior RAG strategies can achieve dynamic control by detecting sentence-wise hallucination, thereby reducing unnecessary computation, they ignore the entity, statement, and their combinations. In this work, we analyze adaptive RAG methods through probing uncertainty to explore real-time entity- and statement-level verification, finding that such information can serve as training-free signals for hallucination detection, and the entropy probes can also guide principled document ranking. Inspired by these insights, we propose SeaRAG, a training-free, adaptive RAG framework that dynamically detects and mitigates hallucinations by probing LLMs at both entity and statement aspects, ranking retrieved passages via entropy-based uncertainty reduction, and regenerating evidence-grounded responses in real-time. Experiments across various Question-Answering benchmarks and multiple LLMs demonstrate consistent accuracy improvements and reduced retrieval rates. SeaRAG with self-correction outperforms Always Retrieve by up to 11.1% on TriviaQA while cutting retrieval frequency from 45.2%, offering an efficient and real-time hallucination control.
Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) generations. However, this reliance on external data introduces new attack surfaces. Attackers can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen queries. Existing research primarily focuses on attacking conventional RAG systems. However, such methods are ineffective against GraphRAG. This robustness derives from the KG abstraction of GraphRAG, which reorganizes injected text into a graph before retrieval, thereby enabling the LLM to reason based on the restructured context instead of raw poisoned passages. To expose latent security vulnerabilities in GraphRAG, we propose Knowledge Evolution Poison (KEPo), a novel poisoning attack method specifically designed for GraphRAG. For each target query, KEPo first generates a toxic event containing poisoned knowledge based on the target answer. By fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event, it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final result. In multi-target attack scenarios, KEPo further connects multiple attack corpora, enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities, thereby amplifying attack effectiveness. Experimental results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks, significantly outperforming previous methods.
Recent advances in enabling Large Language Models (LLMs) to use external tools have significantly extended their functional capabilities beyond internal knowledge. However, most existing approaches rely on retrieval-based mechanisms to select suitable tools from massive repositories, which often struggle to align user queries with tool documentation and exhibit limited generalization. To address these issues, we propose ToolBox-RL. The code is available at https://github.com/S-cavy/ToolBox-RL., a novel reinforcement learning framework that unifies query rewriting, intent understanding, and large-scale tool retrieval into an end-to-end optimization process. ToolBox-RL introduces a query rewriting stage to better capture user intent and ensure semantic alignment with tool descriptions, while reinforcement learning encourages autonomous discovery of generalized tool-use strategies through combined cold-start and policy optimization training. Our experiments demonstrate that ToolBox-RL not only achieves the best tool call accuracy on both white-box and black-box tools but also exhibits strong generalization capabilities on out-of-domain dataset. Ablation studies show that ToolBox-RL can adapt to different retrieval methods and maintains good performance even when incorporating a large number of distractor tools.
Knowledge Graph Question Answering (KGQA) leverages struc- tured knowledge graphs for reliable reasoning. Graph-based Retrieval- Augmented Generation (RAG) addresses the incompleteness and hallucination issues of Large Language Models (LLMs) by retrieving query-relevant subgraphs. However, existing approaches rely on single-intent semantic retrieval, compressing queries into single representations and optimizing each query independently. This leads to narrow triple selection that omits complementary information. While multi-intent retrieval diversification addresses this limitation, it faces critical challenges: (1) semantic diversification does not guarantee reasoning performance, and (2) co-selection frequency across intents does not ensure reasoning benefit. We propose Topic-Adaptive Retrieval Diversification (TARD), based on end-to-end optimization via generation feedback. TARD adaptively extracts multiple topic-based intents through neural topic modeling and employs a Gumbel-Softmax differentiable sampling to enable joint optimization. Supervised fine-tuning aligns the topic-adaptive multi-intent selector and triple scorer with reasoning performance to achieve beneficial consensus patterns. Adaptive direct preference optimization trains the generator to utilize relevant consensus while ignoring uninformative patterns. Experiments on WebQSP and CWQ show that TARD outperforms state-of-the-art baselines. Our code and data are publicly available at https://github.com/leedongcheon/TARD.
Retrieval-augmented generation (RAG) has become a key paradigm for knowledge-intensive question answering. However, existing multi-hop RAG systems remain inefficient, as they alternate between retrieval and reasoning at each step, resulting in repeated LLM calls, high token consumption, and unstable entity grounding across hops. We propose CompactRAG, a simple yet effective framework that decouples offline corpus restructuring from online reasoning. In the offline stage, an LLM reads the corpus once and converts it into an atomic QA knowledge base, which represents knowledge as minimal, fine-grained question--answer pairs. In the online stage, complex queries are decomposed and carefully rewritten to preserve entity consistency, and are resolved through dense retrieval followed by RoBERTa-based answer extraction. Notably, during inference, the LLM is invoked only twice in total—once for sub-question decomposition and once for final answer synthesis—regardless of the number of reasoning hops. Experiments on HotpotQA, 2WikiMultiHopQA, and MuSiQue demonstrate that CompactRAG achieves competitive accuracy while substantially reducing token consumption compared to iterative RAG baselines, highlighting a cost-efficient and practical approach to multi-hop reasoning over large knowledge corpora. The implementation is available at https://github.com/How-Young-X/CompactRAG.
Domain-adaptive hashing enhances discriminative hash representations by transferring knowledge from a label-rich source domain to a label-scarce target domain. It has attracted significant attention due to its ability to enable efficient cross-domain retrieval without requiring target domain labels. However, existing methods generally assume that source domain labels are completely accurate. In practice, labels obtained via web crawling or crowdsourcing often contain varying degrees of noise, which hampers semantic alignment and aggravates domain shift. To tackle these issues, we propose a novel method termed Evidential Learning and Progressive Alignment (ELPA) for domain-adaptive hashing. This method comprises two key modules: the Uncertainty-aware Noise Separation (UNS) and the Progressive Cross-domain Alignment (PCA). In the UNS, we exploit the belief and uncertainty masses obtained from the evidential learning model and utilize the posterior probabilities of a Gaussian Mixture Model to effectively distinguish clean samples from noisy ones. In PCA, we introduce a progressive partial optimal transport mechanism that prioritizes pseudo-label generation for well-aligned target samples, thereby gradually achieving class-level and global-level cross-domain alignment. Extensive experiments across multiple benchmark datasets with various noise ratios demonstrate that ELPA consistently surpasses existing state-of-the-art methods, exhibiting superior robustness and generalization capability.