Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG

arXiv:2609.03749 · cs.CR, cs.CL · Submitted 2026-09-03 · Read on arXiv

cs.CR, cs.CL

Submitted: 2026-09-03

Updated: 2026-09-03

Terminology

• RAG — 76× in this paper · explained in 3 episodes
• Benchmark — 31× in this paper · explained in 2 episodes
• Alignment — 24× in this paper · explained in 1 episode
• Calibration — 14× in this paper · explained in 7 episodes
• Robustness — 14× in this paper · explained in 5 episodes
• Accuracy — 11× in this paper · explained in 1 episode
• Embeddings — 10× in this paper · explained in 2 episodes
• Semantic Similarity — 9× in this paper · explained in 2 episodes
• Ablation — 8× in this paper · explained in 1 episode
• Fidelity — 8× in this paper · explained in 2 episodes
• Core — 5× in this paper · explained in 2 episodes
• LLM judge — 5× in this paper · explained in 2 episodes
• Adaptation — 4× in this paper · explained in 1 episode
• Redundancy — 4× in this paper · explained in 2 episodes
• Failure Modes — 3× in this paper · explained in 3 episodes
• Provenance — 3× in this paper · explained in 3 episodes
• Verification — 3× in this paper · explained in 2 episodes
• Hallucination — 2× in this paper · explained in 3 episodes
• Verifier — 2× in this paper · explained in 2 episodes
• Adversarial Attacks — 1× in this paper · explained in 1 episode
• Aggregation — 1× in this paper · explained in 1 episode
• Annotator Agreement — 1× in this paper · explained in 1 episode
• Benchmarking — 1× in this paper · explained in 3 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Cooperation — 1× in this paper · explained in 2 episodes
• Cosine Similarity — 1× in this paper · explained in 3 episodes
• Domain Shift — 1× in this paper · explained in 4 episodes
• Generalization — 1× in this paper · explained in 13 episodes
• Post-Selection — 1× in this paper · explained in 2 episodes
• Retrieval-Augmented Generation (RAG) — 1× in this paper · explained in 16 episodes
• Sample Efficiency — 1× in this paper · explained in 4 episodes
• Shapley values — 1× in this paper · explained in 2 episodes
• Trace — 1× in this paper · explained in 2 episodes

Sources

• Rag and Roll: An End-to-End Evaluation of Indirect Prompt Manipulations in LLM-based Application Frameworks
• Data Auctions for Retrieval Augmented Generation
• A Survey on Retrieval-Augmented Text Generation
• Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs
• The Llama 3 Herd of Models
• Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors
• Fair Document Valuation in LLM Summaries via Shapley Values

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs