ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “retrieval”

3,996 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 1445Vulnerability 701Ransomware 428Exploit / PoC 295Threat actor 292Data breach 198Phishing & fraud 138AI safety & security 112Policy & legal 107Industry 95AI tools & infra 50Research 49AI research 44Tools 26
SeverityAllcritical 984high 1453medium 1130low 269info 199

When the prompt becomes the payload: A practical pen-testing guide for GenAI, LLM and RAG applications

CSO Online publishes a practical penetration-testing guide for GenAI, LLM, and RAG applications, covering prompt injection, retrieval poisoning, and tenant isolation testing.

The guide frames LLM applications as attack graphs spanning prompts, retrieval layers, vector stores, tools, identities, and downstream APIs, arguing that conventional web testing misses instruction-vs-data channel risks. It builds on OWASP prompt injection guidance (direct vs. indirect injection) and NIST's 2025 adversarial machine-learning taxonomy, noting that RAG and fine-tuning do not remove injection risk. Recommended practices include documenting trust transitions across components, using canaries and synthetic records to avoid test side effects, running multi-turn and obfuscated injection campaigns, and verifying chains from poisoned documents to observable state changes. It also details testing RAG pipelines via controlled document poisoning across metadata, OCR layers, and code comments, plus cross-tenant isolation checks on retrieved document IDs.

CSO Online · 6d agoAI safety & security1

Molecular Déjà Vu: Digit-Level Retrieval of Published Values in Frontier Language Models

Audit of 22 frontier models finds widespread verbatim retrieval of published molecular property values, with higher reasoning increasing recall of memorized numbers.

An arXiv audit tests 22 frontier LLMs across 12 molecular regression benchmarks for verbatim retrieval of published values. More than 50% of the LLMs show verbatim retrieval on five datasets, and identical experiments are flagged 89% more often at a high reasoning level than at the lowest one. Suppressing retrieval moves model prediction errors closer together in relative terms, suggesting predictive capability is not determined solely by memorized values.

arXiv cs.AI / cs.LG / cs.CL · 11d agoAI research1

ReMoMask-2: Latent Retrieval-Augmented Masked Motion Generation

ReMoMask-2 rebuilds retrieval in the generator's latent space for text-to-motion generation, achieving lowest FID on KIT-ML and SnapMoGen.

ReMoMask-2 is a retrieval-augmented text-to-motion framework that constructs its retrieval database directly in the generator's pre-quantization latent space and aligns text queries through a distilled lightweight projector, eliminating the representation gap. The framework combines Hierarchical Bidirectional Momentum contrastive learning, Semantic Spatial-Temporal Attention, and Topology Structured Masking to handle hierarchical motion structure. The retriever achieves state-of-the-art accuracy, and ReMoMask-2 attains the lowest FID on KIT-ML and SnapMoGen, with a single mask-transformer stage outperforming the previous two-stage pipeline while delivering the fastest inference.

Hugging Face daily papers · 8d agoAI research

The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions

Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.

Elastic Security Labs tracked operation REF9334 and its KREMLIN toolkit, a Brazilian banking malware campaign impersonating twelve banks across seven campaigns since May 2025. The infection chain uses multi-stage obfuscated JavaScript loaders with sandbox checks (file and process counting), scheduled-task persistence, and an Ethereum smart contract acting as a dead-drop resolver for C2 and payload URLs, abusing Archive.org for hosting. The malicious browser extension bypasses Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes. Threat Command disrupted over 1,500 infections by registering the kill-switch canary domain.

Elastic Security Labs · 2d agoMalware in the wild

Private Information Retrieval With Arbitrary Privacy Requirements: Introduction and Capacity Results

Researchers formulate private information retrieval under arbitrary graph-based privacy requirements, deriving capacity bounds and introducing pyramid storage graphs.

The paper generalizes classical private information retrieval (PIR) to arbitrary privacy requirements over graph-based storage systems, where each message is retrieved privately from a pre-specified server subset. The authors derive lower and upper capacity bounds for general graphs and exact capacity results for path and cyclic storage graphs. They also introduce a new pyramid storage graph structure that models symmetric message storage and replication patterns.

arXiv cs.CR · 1d agoResearch

Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports

AHLERT generates environment-aware threat hunting leads from CTI reports using ATT&CK-seeded knowledge graph retrieval, roughly doubling F1 over flat-RAG baselines.

The paper introduces AHLERT, a system that converts Cyber Threat Intelligence reports into structured, investigable hunt leads via hybrid dense retrieval with multi-hop traversal over an MITRE ATT&CK-seeded knowledge graph and ontology-grounded RAG constrained to the defender's assets. It is LLM-agnostic and evaluated on public CTI reports for well-known APTs across proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 from 0.44 to 0.85, and AHLERT attains the highest effectiveness score (~86.95%) versus off-the-shelf LLMs.

arXiv cs.CR · 7d agoResearch

H Company Releases NeoMME: A Family of 260M and 800M Single-Tower Multimodal Encoders That Drop the Vision Tower and Causal Decoder

H Company released NeoMME, 260M/800M single-tower multimodal encoders matching 3.75B ColQwen2.5 on ViDoRe v3 while being 14.4x smaller, under Apache 2.0.

H Company released NeoMME, a family of 262,937,906- and 793,715,032-parameter bidirectional encoders that process text and raw 32x32 image patches in a single tower, pretrained via masked diffusion and released under Apache 2.0 with day-zero Hugging Face Transformers support. NeoMME-Retriever-260M reaches 0.523 nDCG@10 on ViDoRe v3, matching 3.75B-parameter ColQwen2.5 while being 14.4x smaller; the 800M model scores 0.556. Hierarchical token pooling with int8 and binary quantization shrinks late-interaction indexes from roughly 1.5 MB to 6 kB per page while retaining 95.19% of nDCG@10; text-only BEIR retrieval remains a weak spot.

MarkTechPost · 9d agoAI research

Generative Late-Interaction Embeddings For Visual Document Retrieval

GLIE compresses visual document retrieval embeddings to four vectors per page while retaining nearly 80% of uncompressed nDCG@5 accuracy.

Researchers analyzing late-interaction retrieval embeddings found they lie exactly on the unit sphere and concentrate near a manifold of intrinsic dimension five to six. GLIE learns a few k vectors per page that serve as a lightweight index and a basis to regenerate the full embedding set for exact rescoring of top candidates at query time. On ViDoRe v1 with four vectors per page, GLIE retains nearly 80% of uncompressed nDCG@5 versus 70% for the best prior post-hoc method, using a 415K-parameter network trained in under three GPU-minutes on 1,000 pages.

Hugging Face daily papers · 6d agoAI research

PACE: Perceived-Latency-Aware Cascading Service Routing and Filler Control for QoE-Efficient Retrieval-Augmented Dialogue Serving

PACE cuts perceived latency in retrieval-augmented dialogue serving via cascading routing and filler control, reaching 0.41s P95 under load.

PACE is a serving framework for retrieval-augmented dialogue that optimizes Perceived Time-to-First-Response (PTFR) under quality and cost constraints. It combines a load-adaptive cascading router, a joint path-filler controller, and volatility-aware cache admission, deployed on a humanoid-robot sales service. On 75k CarQA requests, the cascade halved pure-LLM P95 PTFR (0.29s vs 0.53s) and the adaptive controller reached 0.41s P95, 2.4x better than RAG at high load; filler calls dropped 94% and stale answers fell from 86% to 0%.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI tools & infra

Think Before You Link: Rarity, Reasoning, and Retrieval in Multilingual Entity Linking

Training-free reasoning-plus-retrieval framework lifts multilingual multimodal entity linking accuracy by 6.9% overall and up to 23.3% on rare entities.

The paper broadens rarity measurement in multimodal entity linking using knowledge-graph structural metrics beyond popularity-based pageview metrics, identifying many rare entities that popularity metrics miss. Across these rare-entity slices, state-of-the-art accuracy drops by 15.4-39.9%, exposing distinct failure modes under different rarity definitions. The proposed training-free framework iteratively searches and reasons over Wikipedia with a reasoning-capable vision-language model; experiments show reasoning and retrieval are complementary. On the MERLIN benchmark covering Hindi, Indonesian, Japanese, Tamil, and Vietnamese, the system improves overall accuracy by 6.9% and up to 23.3% on rare entities, with MERLIN-Rare test slices released.

Hugging Face daily papers · 7d agoAI research

CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense

CiteShade attack makes RAG models cite trusted sources for attacker-chosen wrong answers, raising wrong-answer rate from 0.01 to 0.68.

CiteShade is presented as the first citation laundering attack against multi-source retrieval-augmented generation: an attacker controlling a single source induces a wrong answer falsely attributed to a trusted source, even while correct evidence remains in context. The attack is formalized via three necessary conditions (retrieval, generation, citation) constructible without any instructions, raising wrong-answer rate from 0.01 to 0.68 on multi-hop QA, with source deletion confirming the malicious source as causal driver. Vulnerability tracks a model's citation propensity rather than scale, reaching CLR 0.84 with explicit instruction and 0.64 without on the most citation-prone model. Perplexity filtering and citation-support checking prove insufficient; the authors propose a counterfactual defense verifying which source actually drove the answer.

arXiv cs.CR · 1d agoAI safety & security1

Autonomous Research for Open-Ended Problems: A Case Study on Telecom Ticket Retrieval

Case study shows autonomous LLM research reaches 90% of SOTA on telecom ticket retrieval in 10 weeks versus 10 months human work.

The paper explores adapting autonomous research to open-ended, industry-grade ML problems through a telecom ticket retrieval case study with commercial and open-source agents. Autonomous research reached 90% of state-of-the-art performance (0.34 vs. 0.38 Recall@1) in 10 weeks versus 10 months of human work, at up to $200 per Cursor campaign. The authors find agents excel at narrow hyperparameter optimization but lack human-like intuition, recommending human-agent collaboration.

arXiv cs.AI / cs.LG / cs.CL · 4d agoAI research

InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generationnew

InceptionRAG fragments malicious payloads into dormant passages that trigger LLMs to self-deduce misinformation via multi-hop reasoning, bypassing existing RAG poisoning defenses.

Researchers introduce InceptionRAG, a stealthy corpus poisoning attack against retrieval-augmented generation that splits a malicious payload into a chain of individually harmless dormant passages. When retrieved together, the passages induce LLMs to self-deduce target misinformation through multi-hop reasoning, achieving over 80% attack success rate across three datasets and three LLMs under rigorous adversarial constraints. A zeroth-order suffix optimization (ZOSO) method automates authoritative suffix generation in black-box settings. The authors also propose HODOR, a document isolation defense that decouples adversarial logical dependencies.

arXiv cs.CR · 20h agoResearch

ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks

ToxicRAG shows a single narrative-form poisoned document can steer RAG answers, achieving 0.61-0.91 attack success rates across four LLMs.

The attack injects one document per target question written as a coherent knowledge-update narrative that acknowledges the previously accepted answer, introduces fabricated events that appear to invalidate it, and attributes the attacker-chosen answer to purported authorities. An optional answer-focused self-validation loop revises candidates when a surrogate LLM fails to reproduce the target answer. Across 100 target questions each from Natural Questions, HotpotQA, and MS-MARCO, with four victim LLMs and four dense retrievers, ToxicRAG achieves attack success rates of 0.61-0.91 and matches or exceeds the strongest baseline by 0 to 11 percentage points.

arXiv cs.CR · 5d agoAI safety & security1

The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT

Check Point discovers cross-account data leakage in ChatGPT: isolated code-execution containers communicate via shared JFrog Artifactory, enabling covert Gmail exfiltration.

Check Point Research found a covert bidirectional channel between ChatGPT code-execution containers belonging to different accounts, which were supposed to be isolated from each other and the public internet. Both could reach the same internal JFrog Artifactory instance used for package delivery, whose exposed Item Management API allowed a 'shared clipboard' between containers. In a proof of concept, a hidden instruction in a shared conversation made ChatGPT retrieve email data from the victim's connected Gmail account and send it to the attacker's account while the victim received a normal answer. The same channel could exfiltrate conversation history and session files; OpenAI recently described a similar isolation weakness in its postmortem of the Hugging Face incident.

Check Point Research · 7d agoAI safety & security1