KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems

arXiv:2607.00422 · cs.CR · Submitted 2026-07-01 · Read on arXiv

cs.CR

Submitted: 2026-07-01

Updated: 2026-08-28

Comments: Accepted to the Main Conference of EMNLP 2026

Code: https://github.com/chanwoochoi316/KidnapRAG

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• RAG — 77× in this paper · explained in 3 episodes
• Trace — 10× in this paper · explained in 2 episodes
• Retrieval-Augmented Generation — 8× in this paper
• Benchmark — 6× in this paper · explained in 2 episodes
• Reasoning Traces — 6× in this paper · explained in 3 episodes
• Ablation — 5× in this paper · explained in 1 episode
• Embeddings — 5× in this paper · explained in 2 episodes
• Hallucination — 5× in this paper · explained in 3 episodes
• Ablation study — 3× in this paper · explained in 1 episode
• Core — 3× in this paper · explained in 2 episodes
• Retrieval-Augmented Generation (RAG) — 3× in this paper · explained in 16 episodes
• Agentic Retrieval — 2× in this paper · explained in 1 episode
• Reinforcement Learning — 2× in this paper · explained in 4 episodes
• Robustness — 2× in this paper · explained in 5 episodes
• Steering — 2× in this paper · explained in 2 episodes
• Verification — 2× in this paper · explained in 2 episodes
• Actor — 1× in this paper · explained in 3 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Agentic Framework — 1× in this paper · explained in 6 episodes
• Agentic Search — 1× in this paper · explained in 1 episode
• Alignment — 1× in this paper · explained in 1 episode
• Benchmarking — 1× in this paper · explained in 3 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Dynamic Time Warping — 1× in this paper
• Exact Match — 1× in this paper
• Generative Model — 1× in this paper · explained in 2 episodes
• Generative Models — 1× in this paper · explained in 2 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• Interpretability — 1× in this paper · explained in 15 episodes
• Korea Telecom — 1× in this paper
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• RAG (Retrieval-Augmented Generation) — 1× in this paper · explained in 2 episodes
• Verifier — 1× in this paper · explained in 2 episodes

Sources

• Ignore Previous Prompt: Attack Techniques For Language Models
• Chain-of-Trigger: An Agentic Backdoor that Paradoxically Enhances Agentic Robustness
• The Llama 3 Herd of Models
• DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning
• Text Embeddings by Weakly-Supervised Contrastive Pre-training
• Step Potential Advantage Estimation: Harnessing Intermediate Confidence and Correctness for Efficient Mathematical Reasoning
• Qwen3 Technical Report
• Qwen2.5 Technical Report
• ReAct: Synergizing Reasoning and Acting in Language Models

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs