The DOI matches its Crossref record; 16 of the 16 references it cites were found in a registry or an index.
Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Figures
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the citing paper
“However, existing research indicates that RA-LLMs can be maliciously manipulated [38] to leak private information from the retrieval database [17], [18], [19], [28], [39], [40].”
From External Data Extraction Attacks Against Retrieval-Augmented Large Language Models (2026) · cites this paper as [40]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 54,325
Language Models are Few-Shot Learners
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. (2020) · arXiv · doi:10.48550/arxiv.2005.14165 · Cited by 23,372
Dense passage retrieval for open-domain question answering
Karpukhin, V., Oguz, B., Min, S., Lewis, P., Wu, L., Edunov, S., Chen, D., & Yih, W.-T. (2020) · Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2020.emnlp-main.550 · Cited by 3,575
Natural Questions: A benchmark for question answering research
Kwiatkowski, T., Palomaki, J., Redfield, O., Collins, M., Parikh, A., Alberti, C., Epstein, D., Polosukhin, I., Devlin, J., Lee, K., et al. (2019) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl_a_00276 · Cited by 2,069
TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehension
Joshi, M., Choi, E., Weld, D., & Zettlemoyer, L. (2017) · Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/p17-1147 · Cited by 1,690
Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting
Yeom, S., Giacomelli, I., Fredrikson, M., & Jha, S. (2018) · 2018 IEEE 31st Computer Security Foundations Symposium (CSF) · doi:10.1109/csf.2018.00027 · Cited by 1,001
Extracting Training Data from Large Language Models
Carlini, N., Tramer, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K., Roberts, A., Brown, T., Song, D., Erlingsson, U., et al. (2020) · arXiv · doi:10.48550/arxiv.2012.07805 · Cited by 727
Mallen, A., Asai, A., Zhong, V., Das, R., Khashabi, D., & Hajishirzi, H. (2023) · Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/2023.acl-long.546 · Cited by 340
Large Language Models: A Survey
Minaee, S., Mikolov, T., Nikzad, N., Chenaghlu, M., Socher, R., Amatriain, X., & Gao, J. (2024) · arXiv · doi:10.48550/arxiv.2402.06196 · Cited by 325
REPLUG: Retrieval-Augmented Black-Box Language Models
Shi, W., Min, S., Yasunaga, M., Seo, M., James, R., Lewis, M., Zettlemoyer, L., & Yih, W.-T. (2024) · Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) · doi:10.18653/v1/2024.naacl-long.463 · Cited by 209
Unsupervised Dense Information Retrieval with Contrastive Learning
Izacard, G., Caron, M., Hosseini, L., Riedel, S., Bojanowski, P., Joulin, A., & Grave, E. (2021) · arXiv · doi:10.48550/arxiv.2112.09118 · Cited by 172
The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)
Zeng, S., Zhang, J., He, P., Liu, Y., Xing, Y., Xu, H., Ren, J., Chang, Y., Wang, S., Yin, D., et al. (2024) · Findings of the Association for Computational Linguistics ACL 2024 · doi:10.18653/v1/2024.findings-acl.267 · Cited by 149
Large Language Models Can Be Easily Distracted by Irrelevant Context
Shi, F., Chen, X., Misra, K., Scales, N., Dohan, D., Chi, E., Schärli, N., & Zhou, D. (2023) · arXiv · doi:10.48550/arxiv.2302.00093 · Cited by 134
RankRAG: Unifying Context Ranking with Retrieval-Augmented Generation in LLMs
Yu, Y., Ping, W., Liu, Z., Wang, B., You, J., Zhang, C., Shoeybi, M., & Catanzaro, B. (2024) · Advances in Neural Information Processing Systems 37 · doi:10.52202/079017-3850 · Cited by 47
Detecting Pretraining Data from Large Language Models
Shi, W., Ajith, A., Xia, M., Huang, Y., Liu, D., Blevins, T., Chen, D., & Zettlemoyer, L. (2023) · arXiv · doi:10.48550/arxiv.2310.16789 · Cited by 37
PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
Zou, W., Geng, R., Wang, B., & Jia, J. (2024) · arXiv · doi:10.48550/arxiv.2402.07867 · Cited by 16
Research works printed but not linked: 26
- 10.1609/aaai.v38i17.29859 · DOI
- 10.1109/CVPR52733.2024.01845 · DOI
- Asai, Self-rag: Learning to retrieve, generate, and critique through self-reflection
- 10.18653/v1/2023.findings-emnlp.164 · DOI
- 10.1109/ICASSP48485.2024.10447448 · DOI
- 10.14722/aiscc.2024.23018 · DOI
- 10.1145/3637528.3671932 · DOI
- Anderson, 2024, Is my data in your retrieval database? membership inference attacks against retrieval augmented generation, CoRR
- 10.1109/ICCV51070.2023.00449 · DOI
- Meeus, Did the neurons read your book? document-level membership inference for large language models, 2369
- Maini, 2024, Llm dataset inference: Did you train on my dataset?, CoRR
- Zhou, 2024, Balancing diversity and risk in llm sampling: How to select your method and parameter for open-ended text generation, CoRR
- 10.18653/v1/2023.emnlp-main.765 · DOI
- Lin, Ra-dit: Retrieval-augmented dual instruction tuning
- 10.1145/3637528.3671470 · DOI · Paper page
- Panda, Privacy auditing of large language models
- Zeng, 2024, Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data, CoRR
- 10.18653/v1/2024.emnlp-main.1236 · DOI
- Guu, Retrieval augmented language model pre-training, 3929
- Touvron, 2023, Llama 2: Open foundation and fine-tuned chat models, CoRR
- Duan, 2024, Do membership inference attacks work on large language models?, CoRR
- Duan, Are diffusion models vulnerable to membership inference attacks?, 8717
- 10.18653/v1/2023.findings-acl.719 · DOI
- Jain, 2023, Baseline defenses for adversarial attacks against aligned language models, CoRR
- 10.1145/3626772.3657959 · DOI
- Agarwal, 2024, Investigating the prompt leakage effect and black-box defenses for multi-turn llm interactions, CoRR
Cited by
External Data Extraction Attacks Against Retrieval-Augmented Large Language Models
He, Y., Chen, Y., Li, Y., Shao, S., Qi, L., Li, B., Tao, D., & Qin, Z. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3705326 · Cited by 4
Self-citationMRMMIA: Membership Inference Attacks on Memory in Chat Agents
Chen, K., Pang, Y., & Wang, T. (2026) · arXiv · Cited by 4
“More recently, researchers have started to work on data privacy of retrieval-augmented generation (RAG) [1, 11, 12, 15, 20], where the data is not directly used for model training but can influence the model behavior.”
Influential
Metadata
- Authors
- Li, Y., Liu, G., Wang, C., & Yang, Y.
- Affiliations
- Hubei University,Key Laboratory of Intelligent Sensing System and Security (Ministry of Education), School of Artificial Intelligence,Wuhan,China
- Huazhong University of Science and Technology,Hubei Key Laboratory of Smart Internet Technology,Wuhan,China
- Venue
- ICASSP 2025 - 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)
- Publisher
- IEEE
- Published
- 2025-04-06
- Pages
- 1-5
- Cited by
- 15
- References
- 16
- Funders
- National Natural Science Foundation of China
- Ministry of Education
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
