Is Joint-GCG superseded?

Joint-GCG (Retrieval-augmented generation): superseded — cited as a baseline and beaten by newer methods. 2 paper(s) critique it, 1 beat it on benchmarks — #82 of 1179 most-superseded. Sub-problem: cluster led by PoisonedRAG. Newer alternatives in the same sub-problem include DiscourseFlip, SilentRetrieval, Deceptive Evolutionary Jamming Attack (DEJA), LogicPoison, KEPo.

Retrieval-augmented generation

Joint-GCG

Superseded baseline#82 of 1,179 most-superseded

Superseded — cited as a baseline and beaten by newer methods

2 papers critique it · 1 beat it on benchmarks

What papers say

Verbatim critique sentences, each from a paper that cites Joint-GCG as a baseline.

Joint retriever-generator attacks~wang2025jointgcg,zou2024poisonedrag manipulate generation effectively but produce high-perplexity text (PPL $>$150) that is highly exposed to simple PPL filtering; augmenting these methods with fluency constraints remains unexplored.

— SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

“Most methods generate poison texts tailored to a specific query and assume that the victim user will enter the exact same wording.”

— Confundo: Learning to Generate Robust Poison for Practical RAG Systems

Beaten on benchmarks

Head-to-head results where a newer method reports beating Joint-GCG. Values are copied from the source paper's tables — verify against the cited paper.

SilentRetrieval beats Joint-GCG
33.1 vs 173.2
PPL-G2 · [MARCO]
SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning

What to use instead

Recent methods in the same sub-problem, not yet superseded in the knowledge base — arXiv benchmark leaders, not vetted production recommendations.