ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “retrieval-augmented”

18 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI safety & security 6Research 5AI research 4AI industry 1AI tools & infra 1Industry 1
SeverityAllcritical 0high 0medium 1low 0info 17

PACE: Perceived-Latency-Aware Cascading Service Routing and Filler Control for QoE-Efficient Retrieval-Augmented Dialogue Serving

PACE cuts perceived latency in retrieval-augmented dialogue serving via cascading routing and filler control, reaching 0.41s P95 under load.

PACE is a serving framework for retrieval-augmented dialogue that optimizes Perceived Time-to-First-Response (PTFR) under quality and cost constraints. It combines a load-adaptive cascading router, a joint path-filler controller, and volatility-aware cache admission, deployed on a humanoid-robot sales service. On 75k CarQA requests, the cascade halved pure-LLM P95 PTFR (0.29s vs 0.53s) and the adaptive controller reached 0.41s P95, 2.4x better than RAG at high load; filler calls dropped 94% and stale answers fell from 86% to 0%.

arXiv cs.AI / cs.LG / cs.CL · 7d agoAI tools & infra

InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation

InceptionRAG fragments malicious payloads into dormant passages that trigger LLMs to self-deduce misinformation via multi-hop reasoning, bypassing existing RAG poisoning defenses.

Researchers introduce InceptionRAG, a stealthy corpus poisoning attack against retrieval-augmented generation that splits a malicious payload into a chain of individually harmless dormant passages. When retrieved together, the passages induce LLMs to self-deduce target misinformation through multi-hop reasoning, achieving over 80% attack success rate across three datasets and three LLMs under rigorous adversarial constraints. A zeroth-order suffix optimization (ZOSO) method automates authoritative suffix generation in black-box settings. The authors also propose HODOR, a document isolation defense that decouples adversarial logical dependencies.

arXiv cs.CR · 1d agoResearch

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense

CiteShade attack makes RAG models cite trusted sources for attacker-chosen wrong answers, raising wrong-answer rate from 0.01 to 0.68.

CiteShade is presented as the first citation laundering attack against multi-source retrieval-augmented generation: an attacker controlling a single source induces a wrong answer falsely attributed to a trusted source, even while correct evidence remains in context. The attack is formalized via three necessary conditions (retrieval, generation, citation) constructible without any instructions, raising wrong-answer rate from 0.01 to 0.68 on multi-hop QA, with source deletion confirming the malicious source as causal driver. Vulnerability tracks a model's citation propensity rather than scale, reaching CLR 0.84 with explicit instruction and 0.64 without on the most citation-prone model. Perplexity filtering and citation-support checking prove insufficient; the authors propose a counterfactual defense verifying which source actually drove the answer.

arXiv cs.CR · 2d agoAI safety & security1

ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks

ToxicRAG shows a single narrative-form poisoned document can steer RAG answers, achieving 0.61-0.91 attack success rates across four LLMs.

The attack injects one document per target question written as a coherent knowledge-update narrative that acknowledges the previously accepted answer, introduces fabricated events that appear to invalidate it, and attributes the attacker-chosen answer to purported authorities. An optional answer-focused self-validation loop revises candidates when a surrogate LLM fails to reproduce the target answer. Across 100 target questions each from Natural Questions, HotpotQA, and MS-MARCO, with four victim LLMs and four dense retrievers, ToxicRAG achieves attack success rates of 0.61-0.91 and matches or exceeds the strongest baseline by 0 to 11 percentage points.

arXiv cs.CR · 6d agoAI safety & security1

ReMoMask-2: Latent Retrieval-Augmented Masked Motion Generation

ReMoMask-2 rebuilds retrieval in the generator's latent space for text-to-motion generation, achieving lowest FID on KIT-ML and SnapMoGen.

ReMoMask-2 is a retrieval-augmented text-to-motion framework that constructs its retrieval database directly in the generator's pre-quantization latent space and aligns text queries through a distilled lightweight projector, eliminating the representation gap. The framework combines Hierarchical Bidirectional Momentum contrastive learning, Semantic Spatial-Temporal Attention, and Topology Structured Masking to handle hierarchical motion structure. The retriever achieves state-of-the-art accuracy, and ReMoMask-2 attains the lowest FID on KIT-ML and SnapMoGen, with a single mask-transformer stage outperforming the previous two-stage pipeline while delivering the fastest inference.

Hugging Face daily papers · 9d agoAI research

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.

Trace2ATT&CK collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning, mapping behavior to MITRE ATT&CK techniques with ranked candidates and rationales. Mapping uses both pure LLM prompting and retrieval-augmented generation grounded in the ATT&CK knowledge base. It was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improved ATT&CK mapping over pure prompting, and provenance graphs substantially outperformed raw telemetry, without compromising data confidentiality.

arXiv cs.CR · 5d agoResearch

Bridging the First-Hour Gap: Evaluating AI Reliability and Benchmarking Deficiencies in Cyber Incident Response for Law Enforcement

Survey of playbooks, LLMs, RAG, and agentic AI for law-enforcement cyber first responders finds RAG most viable but benchmarks inadequate for legal requirements.

The paper surveys decision-support architectures (playbooks, LLMs, RAG frameworks, agentic AI) for frontline law enforcement during the first hour of a cyber incident, where volatile digital artifacts risk procedural errors and evidence attrition. RAG-based systems are identified as a relatively viable intermediate solution, though prompt sensitivity and confident hallucinations in legal contexts pose major risks. The authors find current cybersecurity benchmarks insufficient for law enforcement safety and legal demands, and argue for a new benchmark focused on naive query robustness and evidence preservation.

arXiv cs.CR · 5d agoResearch

Atlas: Efficient Verifiable Semantic Search

Atlas delivers zero-knowledge proofs for HNSW semantic search, verifying RAG retrieval in under a second on SIFT1M and 2.0 seconds at 100M vectors.

Atlas lets a search provider prove that a query was answered correctly against a committed HNSW index without revealing the index, addressing provider deviations like truncation or bias. It combines offline preprocessing, a fixed-size-state restructuring of HNSW with a correctness proof, and timestep-tagged batching of per-step arguments. The system proves queries in under a second on SIFT1M and 2.0 seconds at 100 million vectors while preserving plaintext HNSW recall, and proven retrieval maintains end-to-end RAG answer quality at lower cost than prior verifiable retrieval systems.

arXiv cs.CR · 6d agoResearch1

10 most critical LLM vulnerabilities

OWASP updated its Top 10 LLM application vulnerabilities, ranking prompt injection first and elevating excessive agency to third amid agentic adoption.

OWASP refreshed its Top 10 list of critical vulnerabilities in LLM applications, for the first time incorporating real-world incident data alongside expert voting. Prompt injection and sensitive information disclosure remain first and second, while excessive agency jumped from sixth to third as agentic systems that call APIs and execute code proliferate. Unbounded consumption of AI resources rose in prominence, while improper output handling dropped to the bottom as output sanitization becomes widespread. The list includes remediation guidance such as strict output schemas, human-in-the-loop approvals, and least-privilege credentials held in application code.

CSO Online · 6d agoAI safety & security

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO Online · 7d agoAI safety & security1

Why 2026 is the Year to Upgrade to an Agentic AI SOC

Elastic Security Labs argues 2026 is the production inflection point for agentic AI in security operations centers.

Elastic Security Labs argues 2026 is the practical inflection point for agentic AI SOCs, noting nearly two-thirds of organizations are experimenting with AI agents while fewer than one in four have production deployments. The piece outlines operational challenges and recommendations: treat agents as non-human identities with least-privilege tool access, version-control system prompts as code, deploy unified agents with on-demand task packages, and enforce per-agent budgets and rate limits. It stresses explainability via RAG and transparent reasoning traces so analysts can verify and override autonomous decisions.

Elastic Security Labs · 8d agoIndustry

ReCite: Agentic Reasoning for Faithful Citation

ReCite is an agentic citation framework using claim-level reasoning and verification, outperforming large generative models in strict citation accuracy.

ReCite is a decoupled agentic framework that orchestrates location perception, intent-aware query planning, and reflective verification for citation recommendation. Trained on synthesized reasoning trajectories, the agent verifies claim-evidence consistency and triggers self-correction loops when retrieved candidates lack logical support. Experiments show the lightweight framework outperforms state-of-the-art massive generative models in strict citation accuracy, addressing misattribution where cited papers are real but logically unsupportive.

arXiv cs.AI / cs.LG / cs.CL · 8d agoAI research

Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports

AHLERT generates environment-aware threat hunting leads from CTI reports using ATT&CK-seeded knowledge graph retrieval, roughly doubling F1 over flat-RAG baselines.

The paper introduces AHLERT, a system that converts Cyber Threat Intelligence reports into structured, investigable hunt leads via hybrid dense retrieval with multi-hop traversal over an MITRE ATT&CK-seeded knowledge graph and ontology-grounded RAG constrained to the defender's assets. It is LLM-agnostic and evaluated on public CTI reports for well-known APTs across proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 from 0.44 to 0.85, and AHLERT attains the highest effectiveness score (~86.95%) versus off-the-shelf LLMs.

arXiv cs.CR · 8d agoResearch

AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims

DEF CON 34 research shows AI customer-service agents can be manipulated via prompt injection and email tricks to leak OTPs and act as victims.

Inti De Ceukelaire, presenting at Bug Bounty Village during DEF CON 34, demonstrated attacks against AI-powered customer service bots with access to customer profiles, billing data, support inboxes, and refund tools. Techniques include transcript-based phishing from trusted support addresses, From-header identity confusion, email normalization abuse to bypass OTP rate limits, and knowledge-base poisoning via RAG crawlers. He recommends separating untrusted content from system prompts, session-bound authentication, consistent email normalization, server-side tool validation, and least-privilege permissions for AI agents.

Cyber Security News · 8d agoAI safety & security

Architecting memory and storage in the AI era

Analysis argues AI inference shifts data-center bottlenecks to memory and storage, urging balanced compute, memory, storage, and network architecture over raw compute.

MIT Technology Review, citing Tirias Research principal analyst Jim McGregor, argues that AI inference and agentic workloads make data movement the key constraint, elevating memory and storage from background hardware to strategic assets. The piece says RAG and real-time inference require continuous data retrieval and caching that legacy infrastructure cannot support. It frames infrastructure planning as a business decision balancing performance, efficiency, cost, and scalability in healthcare, finance, and customer-facing AI.

MIT Technology Review · AI · 12d agoAI industry

Distill Globally, Adapt Locally: Reasoning Distillation and Product-Type Test-Time Training for Scalable Trade-Up Recommendation

A distillation framework compresses LLM reasoning into a 15.5M-parameter trade-up recommendation model reaching AUC 0.941 with product-type test-time training.

The paper targets trade-up recommendation, which identifies higher-quality alternatives that preserve customer purchase intent. A retrieval-augmented few-shot LLM teacher generates labels and rationales that supervise a compact embedding-pair classifier; at inference the 15.5M-parameter student uses only two precomputed 768-dimensional embeddings with no LLM calls. On 8,352 annotated pairs, label-only training scored AUC 0.912, reasoning distillation reached 0.924, and product-type test-time training lifted it to 0.941 with average precision 0.940. The distilled student is roughly 5,000x faster and 10,000x cheaper than direct LLM inference on a 100K-pair proxy catalog.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research

Does Your Agent's Memory Survive a Model Upgrade? A Controlled Study of Memory Portability

A controlled study finds agent memory portability varies sharply: fixed-schema knowledge graphs survive model swaps while compressed notes degrade.

The study compares preserving an agent's history as raw long context, RAG chunks, compressed natural-language notes, or fixed-schema knowledge graphs across model upgrades, using 48 synthetic histories and two open-weight sub-10B-parameter models. Fixed-schema KG accuracy changed by only +0.0004 ± 0.0020 after a writer swap, while compressed NOTES shifted asymmetrically by +9.91 or -13.28 percentage points depending on migration direction. Mixed 50/50 embedding migrations captured only 4.96 of an 11.90-point RAG re-embedding gain; 80% of the NOTES deficit came from information lost at construction, and 81% of the RAG deficit from retrieval failures. Store-only repair of NOTES failed to reach 90% recovery in all 48 cases, while retaining raw histories enabled recovery in 34 of 48 for one direction.

arXiv cs.AI / cs.LG / cs.CL · 12d agoAI research1

How to Secure Enterprise AI: From Adoption to Incident Readiness

Sygnia-backed guidance urges a lifecycle approach to enterprise AI security, citing survey data that AI adoption is outpacing governance and incident readiness.

The Hacker News published Sygnia-sponsored guidance on securing enterprise AI across its lifecycle, from use-case definition and vendor selection to deployment and incident readiness. It cites Sygnia's 2026 CISO survey of 600 senior leaders: 63% expect AI fully embedded by 2027, 73% say their organization would not be fully ready for a significant cyberattack, and 67% of executives believe unapproved AI tools already caused a breach. The piece highlights shadow AI, ad hoc integrations, and over-permissioned AI agents as key attack surface risks, noting only 38% of organizations report a comprehensive AI policy.

The Hacker News · 14d agoAI safety & security