Research map / Large language models / Retrieval and knowledge

NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge

NeurIPS 2025 · Large language models › Retrieval and knowledge · approach: RAG robustness and evaluation · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes NeuroGenPoisoning, an attack on RAG that identifies Poison-Responsive Neurons via Integrated Gradients and evolves poisoned passages with a genetic algorithm to maximize their activation, reporting over 90% population overwrite success.

Problem

RAG systems can be poisoned by injected external knowledge that overrides an LLM's parametric memory, and existing attacks rely on templates or manual passages and ignore internal neuron-level dynamics and knowledge conflict.

Approach

Identify a global set of top-r neurons whose Integrated Gradients attribution is consistently high for poisoned context, then use their summed attribution as the fitness in a genetic algorithm that evolves adversarial passages, initialized from GPT-4-generated misinformation.

Key results

• Final POSR of 0.94 on SQuAD 2.0 for LLaMA-2-7b-chat-hf, up from an initial 0.41.
• Across three datasets and four models, final POSR ranges from 0.88 to 0.95 while initial POSR was about 0.41 to 0.48.
• With 100-candidate populations initialized from PoisonedRAG templates, NeuroGenPoisoning reaches ASR of 0.94 to 0.98, comparable to PoisonedRAG (0.94 to 0.98).

Measured effects reported in the paper

Surprising findings

• Similarity-guided GA stays stagnant around 40-50% POSR, while neuron-guided GA exceeds 90%.
• The final ASR is nearly unchanged across the tested range of top-r neuron counts, which the authors read as insensitivity to r.

Limitations

• Requires white-box access to intermediate activations and gradients for attribution, so it is not black-box.
• Evaluation relies on a short list of open-source models and three QA datasets; no retrieval pipeline is actually exercised (retriever bypassed via prompt injection).
• Theoretical justification is informal and the stated link between attribution and output probability is not rigorously established.

Experimental setup

Datasets: SQuAD 2.0 TriviaQA WikiQA

Benchmarks: SQuAD 2.0 TriviaQA WikiQA

Metrics: Population Overwrite Success Rate (POSR) Attack Success Rate (ASR) Poison-Responsiveness Score gain perplexity

Baselines: PoisonedRAG GA-Similarity AutoDAN GCG

Builds on: IRCAN PoisonedRAG AutoDAN Integrated Gradients

Closest papers by meaning

• On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains (ICML 2025 · similarity 0.87)
• RAG-DDR: Optimizing Retrieval-Augmented Generation Using Differentiable Data Rewards (ICLR 2025 · similarity 0.85)
• NeuroPath: Neurobiology-Inspired Path Tracking and Reflection for Semantically Coherent Retrieval (NeurIPS 2025 · similarity 0.84)
• KnowPO: Knowledge-Aware Preference Optimization for Controllable Knowledge Selection in Retrieval-Augmented Language Models (AAAI 2025 · similarity 0.84)
• ParamMute: Suppressing Knowledge-Critical FFNs for Faithful Retrieval-Augmented Generation (NeurIPS 2025 · similarity 0.84)
• PoisonedEye: Knowledge Poisoning Attack on Retrieval-Augmented Generation based Large Vision-Language Models (ICML 2025 · similarity 0.84)