Public story · 2026-03-04 · source-backed

Safety Alignment as Attack Surface

Issue

2026-03-04

Confidence

source-backed

Sources

Redaction

passed

Story

Adversaries inject documents into RAG knowledge bases that trigger safety refusals on benign queries. Weaponizes alignment homogeneity itself — high cross-model transfer rates. The alignment-as-vulnerability paradox. (arXiv 2603.03919)

RAGOCR renders retrieved documents as images and beats naive RAG by 15% on one-eighth the input tokens.
arXiv 2608.00765 compresses retrieved docs into query-conditioned visual representations, sidestepping the trade-off where hard compression is query-aware but weak and soft compression is strong but needs costly offline encoding. Beats both baselines across varying retrieval d...
TopoGuard catches 21x more RAG split-knowledge attacks than LlamaGuard-2-8B at sub-millisecond latency.
Dahal and Xiong target injected documents that are individually benign but create false associations once aggregated, which is structurally invisible to any per-document filter (arXiv 2607.20437). TopoGuard builds a semantic similarity graph over the retrieved set and flags ma...
CamoDocs poisoning attack hides its trigger from RAG filters
Existing RAG poisoning is filterable because the adversarial chunk contains the query. CamoDocs chunks synthesized benign and adversarial drafts, swaps selected tokens in benign chunks for dispersion tokens that spread the poisoned embeddings, then coherence-filters for readab...
Test your RAG under corpus mutation, not against a static snapshot.
RAGAS-style evaluation checks correctness against a frozen snapshot, which means routine document updates and corrections can silently break production without moving a dashboard. This ASE 2026 paper defines 11 mutation operators perturbing at both the pre-chunk index level an...
Red-team your RAG with deliberately poisoned retrieval.
A new reliability protocol (arXiv:2606.07783) tests RAG on factoid questions the model already answers correctly without retrieval, then injects clean, misleading, and mixed evidence to measure when retrieved content overrides correct internal knowledge. It introduces a parame...
RAG returns outdated code fixes 36-38% of the time
The study extracted 130 clean atomic state transitions from 707 real issues in SWE-bench Lite and Verified. Plain RAG scored 0.57-0.59 answer accuracy; an LLM reranker didn't help and added latency, about 18 seconds against 2.1. A (subject, relation, object) supersession memor...

Source trail

arXiv 2603.03919 More from arxiv.org

Entities

Attack Surface Adversaries RAG Safety Alignment Weaponizes

Provenance

Canonical issue: Ramsay Research Agent — 2026-03-04
AI generated: no
Story unit: 2026-03-04-safety-alignment-as-attack-surface
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

Safety Alignment as Attack Surface

Story

Related stories

RAGOCR renders retrieved documents as images and beats naive RAG by 15% on one-eighth the input tokens.

TopoGuard catches 21x more RAG split-knowledge attacks than LlamaGuard-2-8B at sub-millisecond latency.

CamoDocs poisoning attack hides its trigger from RAG filters

Test your RAG under corpus mutation, not against a static snapshot.

Red-team your RAG with deliberately poisoned retrieval.

RAG returns outdated code fixes 36-38% of the time

Source trail

Entities

Provenance

Safety Alignment as Attack Surface

Story

Related stories

RAGOCR renders retrieved documents as images and beats naive RAG by 15% on one-eighth the input tokens.

TopoGuard catches 21x more RAG split-knowledge attacks than LlamaGuard-2-8B at sub-millisecond latency.

CamoDocs poisoning attack hides its trigger from RAG filters

Test your RAG under corpus mutation, not against a static snapshot.

Red-team your RAG with deliberately poisoned retrieval.

RAG returns outdated code fixes 36-38% of the time

Source trail

Entities

Provenance

Story

Related stories

RAGOCR renders retrieved documents as images and beats naive RAG by 15% on one-eighth the input tokens.

TopoGuard catches 21x more RAG split-knowledge attacks than LlamaGuard-2-8B at sub-millisecond latency.

CamoDocs poisoning attack hides its trigger from RAG filters

Test your RAG under corpus mutation, not against a static snapshot.

Red-team your RAG with deliberately poisoned retrieval.

RAG returns outdated code fixes 36-38% of the time

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance

Story

Related stories

RAGOCR renders retrieved documents as images and beats naive RAG by 15% on one-eighth the input tokens.

TopoGuard catches 21x more RAG split-knowledge attacks than LlamaGuard-2-8B at sub-millisecond latency.

CamoDocs poisoning attack hides its trigger from RAG filters

Test your RAG under corpus mutation, not against a static snapshot.

Red-team your RAG with deliberately poisoned retrieval.

RAG returns outdated code fixes 36-38% of the time

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance