Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generation

# Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generation
Source: [https://arxiv.org/html/2605.30365](https://arxiv.org/html/2605.30365)
Yizhu Wen14, Shuhao Zhang24, Nan Zhang3, Long Cheng2, Hanqing Guo1

###### Abstract

Retrieval\-augmented text\-to\-music \(TTM\) systems augment underspecified user prompts using captions retrieved from a music caption dataset\. This design introduces an integrity dependency on the music knowledge database\. We show that an attacker can poison the database by injecting a small number of crafted music captions, causing the system to retrieve malicious captions that bias prompt augmentation and steer generation away from the user’s intended function, without modifying the user prompt, retriever, or generator\. To achieve the music caption poisoning attack, we propose a dual\-layer caption poisoning strategy that preserves high\-level retrieval anchors while injecting low\-level acoustic descriptors to steer prompt augmentation and downstream music generation toward an attacker\-chosen target intent\. In a MusicCaps knowledge database, CLAP retriever, and MusicGen pipeline, poisoned generations move substantially closer to the attacker’s target, while remaining comparably aligned with the original user query\. These results expose a practical integrity risk for retrieval\-augmented creative AI systems\. Our demo can be found at:[https://yizhu\-wen\.github\.io/Mental\-Damage/](https://yizhu-wen.github.io/Mental-Damage/)

## 1Introduction

Text\-to\-music \(TTM\) generation systems, such as MusicLM\[[1](https://arxiv.org/html/2605.30365#bib.bib1)\], MusicGen\[[5](https://arxiv.org/html/2605.30365#bib.bib23)\], and AudioLDM\[[16](https://arxiv.org/html/2605.30365#bib.bib17)\], have made music creation increasingly accessible by allowing users to specify desired audio content in natural language\. In practice, however, models trained on low\-level domain\-specific semantics\[[1](https://arxiv.org/html/2605.30365#bib.bib1)\]struggle with underspecified real\-world queries that people usually ask\[[7](https://arxiv.org/html/2605.30365#bib.bib2)\]\. For example, a user without professional training in the music domain may write a high\-level prompt such as*“Give me a calm song to support my self\-study”*or*“I need relaxing background music for reading”*\[[14](https://arxiv.org/html/2605.30365#bib.bib38)\]\. These prompts clearly express user intent \(e\.g\., calmness, focus, study support\), but they provide insufficient low\-level acoustic guidance \(e\.g\., tempo, instrumentation, timbre, texture, dynamics\) for high\-quality music generation\. Recent work\[[10](https://arxiv.org/html/2605.30365#bib.bib3),[6](https://arxiv.org/html/2605.30365#bib.bib15)\]addresses this gap with retrieval\-augmented prompt augmentation and rewriting, where the system retrieves captions or examples from a music\-text corpus and uses them to enhance the user prompt into a more detailed, expert\-like description before generation\. For instance, the system may rewrite a high\-level prompt into a low\-level description such as*“slow tempo piano\-led ambient track, soft dynamics, sparse arrangement, warm pad texture, low rhythmic complexity, gentle attack, no abrupt transients”*\. This design can improve usability and output quality, but it also introduces a new security dependency, the integrity of the retrieval corpus and, in particular, the textual labels/captions attached to the audio\.

Prior work on retrieval\-augmented generation \(RAG\) security has shown that RAG systems can be attacked by poisoning the retrieval knowledge base, causing downstream models to produce attacker\-influenced outputs\[[26](https://arxiv.org/html/2605.30365#bib.bib4),[15](https://arxiv.org/html/2605.30365#bib.bib14)\]\. Existing RAG poisoning studies primarily focus on text\-centric LLM settings, where the attack objective is to manipulate factual answers or textual completions\. It remains unclear whether similar attacks transfer to multimodal generation pipelines, especially TTM systems, where retrieved captions directly guide generation\.

![Refer to caption](https://arxiv.org/html/2605.30365v1/x1.png)Figure 1:RAG\-based caption augmentation for text\-to\-music generation: enrich a high\-level user prompt by retrieving detailed, low\-level music captions from a music–text knowledge base, then pass the augmented prompt to a TTM model\.In this paper, we study a new attack surface in retrieval\-augmented text\-to\-music \(TTM\) generation, namely,*caption poisoning of the music RAG knowledge database*\. Figure[1](https://arxiv.org/html/2605.30365#S1.F1)shows the victim pipeline and the poisoning entry point\. A user provides a*high\-level prompt*\(for example, “calm song for study”\)\. The system embeds this query and retrieves the most relevant captions from a music\-text knowledge base\. The retrieved captions are then fed to a*prompt augmentation module*, either via direct concatenation or an LLM\-based rewriter, which produces a*low\-level prompt*describing generation\-oriented acoustic attributes such as tempo, instrumentation, timbre, and texture\. The TTM generator \(e\.g\., MusicLM\) then synthesizes audio conditioned on this augmented prompt\.

Attack Goal and Impact:The attacker’s goal is to induce a RAG\-based TTM system to generate music that deviates from the user’s intended function, even when the user provides a benign query\. Instead of attacking the generator model directly, the attacker targets the RAG knowledge database so that the system receives manipulated caption guidance during prompt augmentation\. If successful, the attack causes a mismatch between user intent and generated output \(e\.g\., producing music with unintended affective or stylistic characteristics\), while leaving the inference\-time user prompt, retriever architecture, and generator model parameters unchanged\. This makes the attack difficult to notice from the user’s perspective and exposes a practical integrity risk in retrieval\-augmented creative generation pipelines\.

Challenges:However, launching such an attack is non\-trivial because a successful poisoned caption must satisfy multiple competing requirements\.\(1\) Retrieval Plausibility:the poisoned caption must remain semantically relevant enough to be retrieved for the target benign query \(e\.g\., if a user asks for*“calm music for studying”*, the poisoned caption must still look related to calm/study/background music\)\.\(2\) Conflict Control:naive poisoning may introduce target semantics that are too strongly conflicting, which can reduce retrieval plausibility or create unstable conditioning for the generator\. For example, directly appending a target label such as*“rock”*to a calm\-study caption may conflict with the source intent in both high\-level function and low\-level acoustic traits \(e\.g\., tempo, dynamics, and rhythmic density\)\.\(3\) Steering Strength:the poisoned caption must also carry sufficient malicious guidance to influence prompt rewriting and downstream generation \(e\.g\., shifting the augmented prompt toward eerie or spooky acoustic characteristics\)\.

Our Idea:Prior work on automated audio caption analysis separates caption content into high\-level intent elements and low\-level acoustic descriptors\[[21](https://arxiv.org/html/2605.30365#bib.bib39)\]\. Building on this distinction, we address the retrieval steering tension by decoupling*high\-level retrieval compatibility*from*low\-level generation steering*via a three\-part design\.\(1\) Anchor Preservationimproves*retrieval plausibility*by retaining high\-level semantic cues that keep poisoned captions retrievable under benign queries, for example,*calm study music”*or*relaxing background music”*\.\(2\) High\-level Functional Opposite Target Generationimproves*conflict control*by selecting target concepts that invert the user’s intended function \(e\.g\., comfort/focus vs\. unease/tension\), while remaining compatible in the low\-level descriptor space, which reduces instability relative to strongly contradictory targets\.\(3\) Low\-level Semantic Similar Target Generationimproves*steering strength*by injecting attacker\-controlled low\-level acoustic descriptors that shape prompt augmentation and downstream synthesis, such as*slow pulsing drone,” distant echoing chimes,”*or*“hollow reverberant space”*\. Together, these components produce poisoned captions that remain plausible at retrieval time while redirecting generation away from the user’s intended function\. We summarize our Contributions below:

- •We identify a new integrity attack against RAG\-based TTM generation, where poisoning caption metadata in the RAG corpus can redirect the high\-level\-to\-low\-level prompt translation process and cause generated music to deviate from the user’s intended function\.
- •We design a dual\-level caption poisoning attack that addresses the key attack challenges by combining*Anchor Preservation*,*Function\-Opposed Targeting*, and*Descriptor\-Level Payload Injection*to jointly improve retrieval plausibility and malicious generation steering\.
- •We demonstrate the effectiveness of the attack on a RAG\-based TTM pipeline using CLAP retrieval and MusicGen music generation, showing that poisoned generated music can roughly double similarity to an attacker\-chosen target intent while preserving alignment with the original user query\.

## 2Background

### 2\.1What is Text\-to\-Music \(TTM\)?

TTM refers to a class of generative AI systems that create music from natural\-language prompts\. Representative examples include MusicLM\[[1](https://arxiv.org/html/2605.30365#bib.bib1)\], MusicGen\[[5](https://arxiv.org/html/2605.30365#bib.bib23)\], and audio\-generation models closely related to TTM, such as AudioLDM\[[16](https://arxiv.org/html/2605.30365#bib.bib17)\]\. In a TTM system, a user describes the desired music in text, such as mood \(e\.g\., calm, tense\), genre \(e\.g\., classical, jazz\), instrumentation \(e\.g\., piano, guitar, strings\), tempo \(e\.g\., slow, fast\), or scene context \(e\.g\., background music for studying\), and the model generates a corresponding audio clip\. Intuitively, TTM acts as a translation system between two different modalities: human language and music audio\. The text prompt provides a semantic description of what the user wants, and the model converts that description into musical signals\. Systems such as MusicLM\[[1](https://arxiv.org/html/2605.30365#bib.bib1)\]and MusicGen\[[5](https://arxiv.org/html/2605.30365#bib.bib23)\]illustrate this text\-conditioned generation setting, while audio\-text alignment models such as CLAP\[[8](https://arxiv.org/html/2605.30365#bib.bib16)\]support stronger semantic grounding between text and audio representations\. To do this well, a TTM model must not only understand high\-level intent in the prompt \(e\.g\., relaxing vs\. energetic\), but also map that intent into lower\-level musical attributes such as rhythm, timbre, texture, dynamics, and instrumentation\. In this sense, TTM can be viewed as a multimodal conditional generation task, where text serves as the control signal and music is the generated output\[[5](https://arxiv.org/html/2605.30365#bib.bib23),[16](https://arxiv.org/html/2605.30365#bib.bib17)\]\. TTM is challenging because user prompts are often high\-level and underspecified\. For example, a prompt like “calm music for studying” conveys intent, but omits generation\-relevant attributes such as instrumentation, arrangement density, tempo, and spatial texture\. To reduce this gap, recent systems leverage stronger text\-audio alignment, richer caption supervision \(for example, MusicCaps in the MusicLM pipeline\[[1](https://arxiv.org/html/2605.30365#bib.bib1),[13](https://arxiv.org/html/2605.30365#bib.bib18)\]\), and prompt refinement mechanisms such as retrieval\-augmented prompt rewriting\[[6](https://arxiv.org/html/2605.30365#bib.bib15)\]to improve controllability and generation quality\.

### 2\.2RAG for TTM

RAG, originally popularized in LLM\-based text generation, has been increasingly adopted in multimodal generation settings, including text\-to\-image and text\-image generation\[[3](https://arxiv.org/html/2605.30365#bib.bib5),[19](https://arxiv.org/html/2605.30365#bib.bib6),[23](https://arxiv.org/html/2605.30365#bib.bib33)\]\. With recent advances in large\-scale generative audio models, similar retrieval\-augmented mechanisms have also emerged in text\-to\-audio \(TTA\) and TTM generation\[[9](https://arxiv.org/html/2605.30365#bib.bib10),[4](https://arxiv.org/html/2605.30365#bib.bib9)\]\. These systems use external audio\-text memory \(e\.g\., captioned music or audio examples\) to improve semantic grounding, controllability, and generation quality, especially for abstract prompts, long\-tailed categories, and zero\-shot settings\.

In the TTA setting, prior work has incorporated retrieval into diffusion and flow\-matching pipelines\. Yuanet al\.\[[9](https://arxiv.org/html/2605.30365#bib.bib10)\]integrate CLAP\-based retrieval into latent diffusion models to improve the generation of rare or unseen sounds\. Yanget al\.\[[22](https://arxiv.org/html/2605.30365#bib.bib7)\]condition flow\-matching generation on retrieved audio exemplars, improving zero\-shot and few\-shot performance without requiring labeled retrieval data\. Zhaoet al\.\[[25](https://arxiv.org/html/2605.30365#bib.bib8)\]further introduce a feedback\-driven refinement framework using large audio language models, where missing or imperfect sound events are iteratively identified and corrected through retrieval and cross\-attention\.

In the music domain, retrieval is also applied at the prompt level to improve controllability and expressiveness in TTM systems\. Gonzales\-Rudziczet al\.\[[10](https://arxiv.org/html/2605.30365#bib.bib3)\]augment input prompts with semantically similar musical aspects retrieved from MusicCaps\[[13](https://arxiv.org/html/2605.30365#bib.bib18)\]\. Dinget al\.\[[6](https://arxiv.org/html/2605.30365#bib.bib15)\]retrieve relevant descriptions and use a language model to rewrite novice prompts into more detailed, expert\-style inputs, improving musicality and production quality without modifying the generator\. Collectively, these approaches reveal a common design pattern in RAG\-enabled TTM systems: retrieved captions function as an intermediate semantic control signal that bridges high\-level user intent and low\-level acoustic realization\.

Why TTM Performs Well on Low\-Level Input?TTM models often perform well on low\-level acoustic descriptions \(e\.g\., tempo, texture, reverberation, timbre, and rhythmic density\) because such descriptors are frequently observed in music caption datasets, whereas high\-level semantic intents are more diverse and relatively sparse\[[20](https://arxiv.org/html/2605.30365#bib.bib37)\]\. This repeated supervision makes low\-level descriptors stable and effective conditioning signals during training\[[21](https://arxiv.org/html/2605.30365#bib.bib39)\]\. By contrast, high\-level prompts are often underspecified and can be realized in many musically different ways\. For example, “music for studying” may correspond to different genres, instruments, and arrangement styles\. As a result, low\-level descriptors often provide stronger control over generation\.

### 2\.3Existing RAG Attacks

The security risks of RAG have received increasing attention as RAG has been widely integrated into large language model systems\. Prior work has shown that RAG can be attacked in both text\-based and image\-based settings\[[11](https://arxiv.org/html/2605.30365#bib.bib32),[15](https://arxiv.org/html/2605.30365#bib.bib14),[23](https://arxiv.org/html/2605.30365#bib.bib33),[18](https://arxiv.org/html/2605.30365#bib.bib34)\]\. In text\-based RAG, attacks often manipulate the external knowledge source \(e\.g\., vector database or retrieved documents\) through poisoning or injection, causing the system to retrieve malicious content that steers downstream generation\[[26](https://arxiv.org/html/2605.30365#bib.bib4)\]\. In image\-based or multimodal RAG settings, attackers can exploit cross\-modal alignment and retrieval mechanisms to bias what the system retrieves and, consequently, what it generates\[[24](https://arxiv.org/html/2605.30365#bib.bib35),[17](https://arxiv.org/html/2605.30365#bib.bib13)\]\. These results establish an important security lesson: in RAG systems, the attack surface is not limited to the generative model itself, but also includes the external retrieval corpus and the embedding space that links user queries to retrieved content\. However, existing studies have largely focused on text and image domains\. In contrast, the security of*audio\-based*and*text\-to\-music*RAG pipelines remains underexplored, despite the increasing use of audio\-text retrieval, caption\-guided prompt rewriting, and cross\-modal audio\-text embeddings in modern TTM systems\.

## 3Threat Model

TABLE I:Glossary and notation for the music caption poisoning attacksVictim setting\.We consider a victim who constructs a music RAG system by collecting music\-caption pairs from public data sources and ingesting them into a local knowledge base\. At inference time, a user issues a textual query to request the TTM model to generate a music clip\. The system performs text\-to\-text retrieval by comparing the query embedding against caption embeddings stored in the knowledge base and returns the most similar captions\. The TTM model then generates a music clip conditioned on both the user query and the retrieved captions\.

Attacker’s capability\.We assume that the attacker can only inject malicious music\-text \(music\-caption\) pairs into the public data sources\. These poisoned entries are subsequently collected and incorporated into the victim’s knowledge database during data ingestion\. This threat model is consistent with prior work on poisoned RAG systems, such as PoisonedRAG\[[26](https://arxiv.org/html/2605.30365#bib.bib4)\], and PoisonedEye\[[24](https://arxiv.org/html/2605.30365#bib.bib35)\]\.

Attacker’s goal\.The attacker aims to cause a RAG\-based TTM system to generate music that deviates from the benign user’s intended function and instead follows an attacker\-chosen target intenttt\. Given a benign queryqq\(e\.g\., music for studying or therapy\), the attacker selects a high\-level, functionally opposite target category \(e\.g\., horror or haunted music\) but has acoustic commonalities \(e\.g\., slow decay, deep resonant\) and seeks to induce the TTM model to generate music belonging to the attacker\-chose target cateegory\.

For example, a user may request “calm background music for studying,” while the attacker aims to trigger the generation of horror\-style music reminiscent of a haunted movie\. The attacker achieves this by corrupting the RAG’s caption guidance music generation process in the knowledge base, without modifying the user’s query\. Such attacks can disrupt creative workflows, replace intended audio with harmful or inappropriate content, and introduce reputational and safety risks in RAG\-based music generation systems\.

Attacker capability\.We consider a black\-box attacker with no access to the deployed knowledge base, retriever, or model internals, including the TTM model parameters\. For each benign queryqq, the attacker can inject up toNNmalicious music\-caption pairs into public datasets that the victim later collects\. These injected pairs can be sourced from publicly available repositories, such as MusicCaps\[[1](https://arxiv.org/html/2605.30365#bib.bib1)\]\.

## 4Design

Music caption datasets typically follow a long\-tailed distribution: low\-level acoustic descriptors \(e\.g\., tempo, texture, reverberation\) are abundant, whereas high\-level semantic categories are relatively sparse\[[20](https://arxiv.org/html/2605.30365#bib.bib37),[21](https://arxiv.org/html/2605.30365#bib.bib39)\]\. As a result, TTM models trained on such data tend to rely heavily on low\-level cues when conditioned on text prompts\. In music RAG systems, this tendency is further amplified: semantically similar descriptions are retrieved from external corpora and incorporated into user prompts\. As caption retrieval operates in a shared embedding space, high\-level category features can be approximated through low\-level acoustic attributes\. Building on this observation, we propose a Caption Poisoning attack targeting the prompt retrieval stage of the RAG\-based TTM system\. The attacker selects a benign source category \(e\.g\.,*“ music used in spa or study environments”*\) and a conflicting target category \(e\.g\.,*“horror film background music”*\)\. Although these categories differ semantically at a high level, they may share low\-level characteristics, such as sustained drones, slow tempo, minimal motion, and heavy reverberation\. By describing the target style using low\-level descriptors that resemble the source category in the retrieval embedding space, the attacker can craft adversarial captions and inject them into the RAG knowledge database\. When the system retrieves context for a benign user query, these poisoned captions can enter the top\-k TTM context and steer generation toward the attacker\-chosen target category\.

The core of our attack is poisoned caption crafting\. A successful poisoned caption must remain retrievable for benign queries, while also carrying malicious guidance that steers downstream music generation\. This creates an inherent tradeoff: adding malicious content can reduce the caption’s semantic similarity to the benign queries, thus reducing the likelihood of being retrieved\. We address this retrieval–steering tradeoff with a design that separates high\-level retrieval compatibility from low\-level generation steering\. Our attack consists of three components: \(1\) Anchor Preservation, \(2\) Function\-Opposed Targeting, and \(3\) Descriptor\-Level Payload Injection\.

Problem Formulation:Given a benign target queryqq, our goal is to construct a poisoned captioncpc\_\{p\}that is likely to be retrieved forqqwhile steering downstream generation toward an attacker\-chosen target categorytt\. We formulate the poisoned caption as:

cp=canchor​\(q\)∥cpayload​\(t\),c\_\{p\}=c\_\{\\text\{anchor\}\}\(q\)\\\|c\_\{\\text\{payload\}\}\(t\),\(1\)wherecanchor​\(q\)c\_\{\\text\{anchor\}\}\(q\)preserves query\-relevant semantics for retrieval plausibility,cpayload​\(t\)c\_\{\\text\{payload\}\}\(t\)provides malicious generation guidance, and∥\\\|denotes text concatenation\. To make the retrieval–steering tradeoff explicit, we view poisoned caption crafting as optimizing two objectives:

maxcp⁡ℛ​\(cp;q\)\+λ​𝒮​\(cp;t\),\\max\_\{c\_\{p\}\}\\;\\;\\mathcal\{R\}\(c\_\{p\};q\)\+\\lambda\\,\\mathcal\{S\}\(c\_\{p\};t\),\(2\)whereℛ​\(⋅\)\\mathcal\{R\}\(\\cdot\)measures retrieval plausibility given the benign queryqq,𝒮​\(⋅\)\\mathcal\{S\}\(\\cdot\)measures steering strength toward target categorytt, andλ\\lambdacontrols the retrieval–steering tradeoff\. Table[I](https://arxiv.org/html/2605.30365#S3.T1)summarizes the concepts and notation used in our music caption poisoning formulation, clarifying how the benign queryqq, target categorytt, and poisoned caption components\(canchor,cpayload,\{cp\}i=1N\)\(c\_\{\\text\{anchor\}\},c\_\{\\text\{payload\}\},\\\{c\_\{p\}\\\}\_\{i=1\}^\{N\}\)are defined and referenced throughout the paper\.

![Refer to caption](https://arxiv.org/html/2605.30365v1/x2.png)Figure 2:Overview of the poisoned caption generation pipeline\. Given a target queryqq, the system first extracts a high\-level function anchorcanchorc\_\{\\text\{anchor\}\}and then derives low\-level musical attributes from the query\. Conditioned on these attributes, it selects a functionally opposite high\-level targett∗t^\{\\ast\}\. Finally, it generates a low\-level semantic payloadcpayloadc\_\{\\text\{payload\}\}consistent witht∗t^\{\\ast\}\. The poisoned caption is formed by concatenatingcanchorc\_\{\\text\{anchor\}\}andcpayloadc\_\{\\text\{payload\}\}\.### 4\.1Anchor Preservation

This component addresses*retrieval plausibility*\. The key idea is simple: the poisoned caption must still appear to match the benign user query; otherwise, it will not be retrieved\. To achieve this, we keep a query\-aligned*anchor*canchorc\_\{\\text\{anchor\}\}in the poisoned caption that preserves the source category at a high level\. For example, if the benign query is about calm music for studying, the poisoned caption should still contain semantics such as*“calm study music”*or*“relaxing background music”*\. These anchor cues help the caption remain relevant during retrieval\. Intuitively, Anchor Preservation keeps the poisoned caption “close enough” to the benign query in high\-level semantic space so that the retriever continues to treat it as a plausible match\. This is the part of the caption that helps the attack get selected before any malicious steering can take effect\.

### 4\.2High\-level Functional Opposite Target Generation

This component addresses*conflict control*\. The goal is to choose a target category that changes the*function*of the generated music \(e\.g\., from comfort/focus to unease/tension\), but does not introduce such a strong low\-level mismatch that retrieval or generation becomes unstable\.

The key intuition is that not all target styles are equally effective for poisoning\. Some targets are simply too contradictory\. For example, if the benign query is about*calm study music*, a target category such as*rock music*conflicts at both a high level \(intended function\) and a low level \(e\.g\., tempo, rhythmic density, and dynamics\), making the poisoned caption less retrievable and the poisoned generation less stable\. In contrast, a target such as*spooky*can still oppose the user’s intended function while sharing low\-level traits with calm music \(e\.g\., slow tempo, sparse texture, and sustained sounds\)\. We reconcile the tradeoff by selecting a target that is functionally opposed to the source category while avoiding excessive conflict:

t∗=arg⁡maxt∈𝒯⁡\(Opposefunc​\(s,t\)−Conflictdesc​\(s,t\)\),t^\{\\ast\}=\\arg\\max\_\{t\\in\\mathcal\{T\}\}\\Big\(\\mathrm\{Oppose\}\_\{\\text\{func\}\}\(s,t\)\-\\,\\mathrm\{Conflict\}\_\{\\text\{desc\}\}\(s,t\)\\Big\),\(3\)
wheressdenotes the source category of the benign queryqq, andt∗t^\{\\ast\}is the attacker\-chosen category\.Opposefunc​\(s,t\)\\mathrm\{Oppose\}\_\{\\text\{func\}\}\(s,t\)scores how strongly a candidate target categoryttcontradicts the*functional*category ofss, andConflictdesc​\(s,t\)\\mathrm\{Conflict\}\_\{\\text\{desc\}\}\(s,t\)measures incompatibility at the level of low\-level acoustic attributes\. Intuitively, we prefer target categories that induce a large semantic shift at the user\-intent level while remaining relatively compatible in low\-level acoustic traits\. This improves malicious captioncpc\_\{p\}’s retrievability and stabilizes targeted downstream music generation\.

### 4\.3Low\-level semantic similar target generation

This component addresses*steering strength*\. After choosing the target categoryt∗t^\{\\ast\}, we encode malicious guidance as*low\-level acoustic descriptors*rather than relying only on a direct high\-level target label\. Concretely, we construct a payload text from the selected target category:

cpayload=𝒫​\(t∗\),c\_\{\\text\{payload\}\}=\\mathcal\{P\}\(t^\{\\ast\}\),\(4\)where𝒫​\(⋅\)\\mathcal\{P\}\(\\cdot\)maps the target category to generation\-oriented low\-level acoustic descriptors \(e\.g\., timbre, texture, spatial cues, temporal patterns\)\. For example, instead of inserting only the word*spooky*, the payload may include descriptors such as*“distant echoing chimes,” “hollow reverberant space,”*and*“detuned sustained tones\.”*This design is more effective because downstream TTM generation operates on detailed acoustic guidance, not only broad style labels\. As a result, low\-level descriptor payloadscpayloadc\_\{\\text\{payload\}\}provide a stronger and more stable steering signal than direct target\-label injection, while remaining easier to blend with the benign anchor semantics\.

### 4\.4Poisoned Caption Assembly

After constructing the anchorcanchorc\_\{\\text\{anchor\}\}and the payloadcpayloadc\_\{\\text\{payload\}\}, we combine them into one poisoned captioncpc\_\{p\}\. The anchor keeps the caption aligned with the benign query at the high level \(so it can still be retrieved\), while the payload injects low\-level malicious acoustic guidance that biases downstream generation\. In practice, we use a simple two\-part caption structure:

cp\\displaystyle c\_\{p\}=canchor∥cpayload\\displaystyle=c\_\{\\text\{anchor\}\}\\\|c\_\{\\text\{payload\}\}\(5\)Intuitively, the first part helps the caption “get in” through retrieval, and the second part helps the attack “take effect” during music generation\. This simple assembly also makes it easy to compare payload designs in our experiments, such as direct target\-label injection versus our payload injection\.

TABLE II:Caption poisoning shifts MusicGen outputs toward the target category\. We report CLAP similarity for benign and poisoned generations with respect to the user query and the target category \(↓\\downarrowlower is better for benign target\-category similarity,↑\\uparrowhigher is better for poisoned target\-category similarity\)\. Best results are bolded\.

## 5Evaluation

### 5\.1Experimental Setup

Dataset\.For retrieval and text\-to\-music generation experiments, we use the MusicCaps dataset\[[1](https://arxiv.org/html/2605.30365#bib.bib1)\], which contains 5,521 paired text and music examples\. All audio clips are sourced from YouTube videos\. For each example, we extract the first 10 seconds of the audio and pair it with a free\-text caption describing the music, for example,*“This is a live recording of a DJ doing deck scratching on a hip hop song\.”*The dataset also provides structured musical attributes such as genre, mood, and instrumentation, for example,*“deck scratching, hip hop, electric\.”*In our experiments, we use only the free\-text music captions and ignore the structured attribute annotations\.

RAG Setup\.Our RAG\-based TTM pipeline setups are as follows:

- •Knowledge base: We use MusicCaps as the base knowledge database\.
- •Retriever: We use CLAP\[[8](https://arxiv.org/html/2605.30365#bib.bib16)\]to embed user queries and music captions into a shared representation space, and rank candidate captions by cosine similarity between the query embedding and caption embeddings in the knowledge base\.
- •TTM model: We use Meta’s MusicGen \(musicgen\-small\)\[[5](https://arxiv.org/html/2605.30365#bib.bib23)\]for generation\. Unless otherwise noted, we use the default generation settings from AudioCraft\*\*\*https://github\.com/facebookresearch/audiocraft

Target categories and answers\.Our method aims to induce the music RAG system to generate attacker\-chosen target music for each source category\. We randomly sample 50 source categories and, for each, construct a plausible user query and select a functionally opposite target category generated by Sonnet 4\.6\[[2](https://arxiv.org/html/2605.30365#bib.bib24)\]\. For each source\-target category pair, Sonnet 4\.6 first generates a short rationale describing their shared acoustic attributes, then refines detailed poisoned target\-category captionscpc\_\{p\}based on the rationale\. Unless otherwise specified, we retrieve the five most similar music captions from the knowledge database as contextual input for music generation\. The prompt template and example poisoned captions are provided in Appendix[A](https://arxiv.org/html/2605.30365#A1)\.

Evaluation metrics\.We use the following metrics: item

- •CLAP similarity\.CLAP is a joint text\-audio embedding model that enables quantitative comparison between text and audio representations\. For each generated music clip, we compute the cosine similarity between the embedding of the input text caption and the embedding of the generated audio\[[12](https://arxiv.org/html/2605.30365#bib.bib36)\]\. We report the average cosine similarity across all samples\. A higher CLAP similarity indicates stronger adherence of the generated music to the conditioning text\.
- •Precision, recall, and F1 score\.Our method injectsNNmalicious captions into the knowledge database for each target music category\. We use precision, recall, and F1 score to evaluate whether the injected captions are retrieved for the corresponding target queries\. Precision is defined as the fraction of malicious captions among the top\-kkretrieved results\. Recall is defined as the fraction of injected malicious captions that are successfully retrieved among the top\-kkresults\. The F1 score captures the tradeoff between precision and recall and is defined as: F1=2⋅Precision⋅RecallPrecision\+Recall\\mathrm\{F1\}=\\frac\{2\\cdot\\mathrm\{Precision\}\\cdot\\mathrm\{Recall\}\}\{\\mathrm\{Precision\}\+\\mathrm\{Recall\}\}

### 5\.2Results

The attack shifts generated music toward the target category\.Table[II](https://arxiv.org/html/2605.30365#S4.T2)reports the CLAP similarity between generated audio and both the user question and the target category\. Under three different top\-kkretrieval settings, before the attack, the CLAP similarity between benignly generated music and the target category ranges from 0\.21 to 0\.28\. After applying our attack, the CLAP similarity between the generated poisoned music and the target category increases substantially, reaching values between 0\.41 and 0\.48, which is nearly doubled\. This indicates that the generated music is significantly closer to the attacker\-chosen target category\.

Notably, the CLAP similarity between the generated music and the original user question remains largely unchanged before and after the attack, staying at approximately 0\.30 across all settings\. This suggests that the attack successfully steers the generation toward the target category without degrading alignment with the user query, making the attack difficult to detect based on query relevance alone\. Moreover, precision, recall, and F1 scores show that our attack maintains high retrievability across all three evaluation settings\.

## 6Conclusion

We identified caption poisoning as an integrity threat in RAG\-based TTM systems, where retrieved captions function as a control signal for augmented music generation\. By injecting a small number of malicious caption entries into the music knowledge database, an attacker can steer generated music toward an attacker\-chosen target category without changing the user prompt or model parameters\. Our strategy maintains retrieval plausibility via high\-level anchors and achieves steering via low\-level acoustic descriptor payloads\. Experiments show that this manipulation roughly doubles the CLAP similarity between the generated music and the target category, while keeping the CLAP similarity between the generated music and the user query nearly unchanged\. This makes the attack difficult to detect from prompt relevance alone\. Defenses should treat the retrieval corpus and caption metadata as part of the trusted base, with stronger ingestion controls and robustness checks in the retrieval pipeline\.

## Acknowledgment

This work is partially supported by National Science Foundation \(NSF\) under award numbers 2523814, 2448205, and 2239605\.

## References

- \[1\]A\. Agostinelli, T\. I\. Denk, Z\. Borsos, J\. Engel, M\. Verzetti, A\. Caillon, Q\. Huang, A\. Jansen, A\. Roberts, M\. Tagliasacchi,et al\.\(2023\)Musiclm: generating music from text\.arXiv preprint arXiv:2301\.11325\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1),[§2\.1](https://arxiv.org/html/2605.30365#S2.SS1.p1.1),[§3](https://arxiv.org/html/2605.30365#S3.p5.2),[§5\.1](https://arxiv.org/html/2605.30365#S5.SS1.p1.1)\.
- \[2\]Anthropic\(2024\)Claude sonnet 4\.6\.Note:[https://www\.anthropic\.com](https://www.anthropic.com/)Large language modelCited by:[§5\.1](https://arxiv.org/html/2605.30365#S5.SS1.p2.1)\.
- \[3\]A\. Blattmann, R\. Rombach, K\. Oktay, J\. Müller, and B\. Ommer\(2022\)Retrieval\-augmented diffusion models\.Advances in Neural Information Processing Systems35,pp\. 15309–15324\.Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p1.1)\.
- \[4\]C\. Choi, S\. Lim, and W\. Rhee\(2025\)Enhancing Retrieval\-Augmented Audio Captioning with Generation\-Assisted Multimodal Querying and Progressive Learning\.InInterspeech 2025,pp\. 2655–2659\.External Links:[Document](https://dx.doi.org/10.21437/Interspeech.2025-1493),ISSN 2958\-1796Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p1.1)\.
- \[5\]J\. Copet, F\. Kreuk, I\. Gat, T\. Remez, D\. Kant, G\. Synnaeve, Y\. Adi, and A\. Défossez\(2023\)Simple and controllable music generation\.Advances in neural information processing systems36,pp\. 47704–47720\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1),[§2\.1](https://arxiv.org/html/2605.30365#S2.SS1.p1.1),[3rd item](https://arxiv.org/html/2605.30365#S5.I1.i3.p1.1)\.
- \[6\]M\. Ding, B\. McFee, C\. Hu, S\. Yang, and J\. Huang\(2025\)Enhancing test\-to\-music generation through retrieval\-augmented prompt rewrite\.In1st Workshop on Large Language Models for Music & Audio \(LLM4MA\),Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1),[§2\.1](https://arxiv.org/html/2605.30365#S2.SS1.p1.1),[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p3.1)\.
- \[7\]S\. Doh, K\. Choi, D\. Kwon, T\. Kim, and J\. Nam\(2024\)Music discovery dialogue generation using human intent analysis and large language model\.InInternational Society for Music Information Retrieval Conference 2024,Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1)\.
- \[8\]B\. Elizalde, S\. Deshmukh, M\. Al Ismail, and H\. Wang\(2023\)CLAP: learning audio concepts from natural language supervision\.InICASSP 2023 \- 2023 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 1–5\.External Links:[Document](https://dx.doi.org/10.1109/ICASSP49357.2023.10095889)Cited by:[§2\.1](https://arxiv.org/html/2605.30365#S2.SS1.p1.1),[2nd item](https://arxiv.org/html/2605.30365#S5.I1.i2.p1.1)\.
- \[9\]S\. Ghosh, S\. Kumar, C\. K\. R\. Evuru, R\. Duraiswami, and D\. Manocha\(2024\)Recap: retrieval\-augmented audio captioning\.InICASSP 2024\-2024 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),pp\. 1161–1165\.Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p1.1),[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p2.1)\.
- \[10\]R\. Gonzales and F\. Rudzicz\(2024\)A retrieval augmented approach for text\-to\-music generation\.InProceedings of the 3rd Workshop on NLP for Music and Audio \(NLP4MusA\),pp\. 31–36\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1),[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p3.1)\.
- \[11\]K\. Guu, K\. Lee, Z\. Tung, P\. Pasupat, and M\. Chang\(2020\)REALM: retrieval\-augmented language model pre\-training\.InProceedings of the 37th International Conference on Machine Learning,ICML’20\.Cited by:[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1)\.
- \[12\]R\. Huang, J\. Huang, D\. Yang, Y\. Ren, L\. Liu, M\. Li, Z\. Ye, J\. Liu, X\. Yin, and Z\. Zhao\(2023\)Make\-an\-audio: text\-to\-audio generation with prompt\-enhanced diffusion models\.InInternational Conference on Machine Learning,pp\. 13916–13932\.Cited by:[1st item](https://arxiv.org/html/2605.30365#S5.I2.i1.p1.1)\.
- \[13\]Hugging Face\(2023\)Google/musiccaps dataset card\.Note:[https://huggingface\.co/datasets/google/MusicCaps](https://huggingface.co/datasets/google/MusicCaps)Dataset card for MusicCapsCited by:[§2\.1](https://arxiv.org/html/2605.30365#S2.SS1.p1.1),[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p3.1)\.
- \[14\]P\. Knees and M\. Schedl\(2013\)A survey of music similarity and recommendation from music context data\.ACM Transactions on Multimedia Computing, Communications, and Applications \(TOMM\)10\(1\),pp\. 1–21\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1)\.
- \[15\]P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. Kiela\(2020\)Retrieval\-augmented generation for knowledge\-intensive nlp tasks\.InAdvances in Neural Information Processing Systems,Vol\.33,pp\. 9459–9474\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p2.1),[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1)\.
- \[16\]H\. Liu, Z\. Chen, Y\. Yuan, X\. Mei, X\. Liu, D\. Mandic, W\. Wang, and M\. D\. Plumbley\(2023\)AudioLDM: text\-to\-audio generation with latent diffusion models\.arXiv preprint arXiv:2301\.12503\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p1.1),[§2\.1](https://arxiv.org/html/2605.30365#S2.SS1.p1.1)\.
- \[17\]Y\. Liu, Z\. Yuan, G\. Tie, J\. Shi, P\. Zhou, L\. Sun, and N\. Z\. Gong\(2025\)Poisoned\-mrag: knowledge poisoning attacks to multimodal retrieval augmented generation\.arXiv preprint arXiv:2503\.06254\.Cited by:[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1)\.
- \[18\]X\. Meng and Z\. Tong\(2025\)Multimodal retrieval\-augmented generation framework for visually rich knowledge in the architecture domain\.Architectural Intelligence4\(1\),pp\. 22\.External Links:ISSN 2731\-6726,[Document](https://dx.doi.org/10.1007/s44223-025-00102-6)Cited by:[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1)\.
- \[19\]S\. Sheynin, O\. Ashual, A\. Polyak, U\. Singer, O\. Gafni, E\. Nachmani, and Y\. Taigman\(2023\)KNN\-diffusion: image generation via large\-scale retrieval\.InThe Eleventh International Conference on Learning Representations,Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p1.1)\.
- \[20\]G\. Sun\(2021\)Research on architecture for long\-tailed genre computer intelligent classification with music information retrieval and deep learning\.InJournal of Physics: Conference Series,Vol\.2033,pp\. 012008\.Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p4.1),[§4](https://arxiv.org/html/2605.30365#S4.p1.1)\.
- \[21\]X\. Xu, Z\. Xie, M\. Wu, and K\. Yu\(2023\)Beyond the status quo: a contemporary survey of advances and challenges in audio captioning\.IEEE/ACM Transactions on Audio, Speech, and Language Processing32,pp\. 95–112\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p6.1),[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p4.1),[§4](https://arxiv.org/html/2605.30365#S4.p1.1)\.
- \[22\]M\. Yang, B\. Shi, M\. Le, W\. Hsu, and A\. Tjandra\(2025\)Audiobox TTA\-RAG: Improving Zero\-Shot and Few\-Shot Text\-To\-Audio with Retrieval\-Augmented Generation\.InInterspeech 2025,pp\. 1243–1247\.External Links:[Document](https://dx.doi.org/10.21437/Interspeech.2025-1032),ISSN 2958\-1796Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p2.1)\.
- \[23\]M\. Yasunaga, A\. Aghajanyan, W\. Shi, R\. James, J\. Leskovec, P\. Liang, M\. Lewis, L\. Zettlemoyer, and W\. Yih\(2023\)Retrieval\-augmented multimodal language modeling\.InProceedings of the 40th International Conference on Machine Learning,ICML’23\.Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p1.1),[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1)\.
- \[24\]C\. Zhang, X\. Zhang, J\. Lou, K\. Wu, Z\. Wang, and X\. Chen\(2025\)PoisonedEye: knowledge poisoning attack on retrieval\-augmented generation based large vision\-language models\.InForty\-second International Conference on Machine Learning,Cited by:[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1),[§3](https://arxiv.org/html/2605.30365#S3.p2.1)\.
- \[25\]J\. Zhao, C\. Li, J\. Zhao, R\. Chen, D\. Yu, M\. D\. Plumbley, and W\. Wang\(2026\)Feedback\-driven retrieval\-augmented audio generation with large audio language models\.InICASSP 2026\-2026 IEEE International Conference on Acoustics, Speech and Signal Processing \(ICASSP\),Cited by:[§2\.2](https://arxiv.org/html/2605.30365#S2.SS2.p2.1)\.
- \[26\]W\. Zou, R\. Geng, B\. Wang, and J\. Jia\(2025\)\{\\\{poisonedrag\}\\\}: Knowledge corruption attacks to\{\\\{retrieval\-augmented\}\\\}generation of large language models\.In34th USENIX Security Symposium \(USENIX Security 25\),pp\. 3827–3844\.Cited by:[§1](https://arxiv.org/html/2605.30365#S1.p2.1),[§2\.3](https://arxiv.org/html/2605.30365#S2.SS3.p1.1),[§3](https://arxiv.org/html/2605.30365#S3.p2.1)\.

## Appendix Aappendix

Attack exampleBenign user intent:Sleep and rest audioUser query:I want something very slow and simple that helps my mind shut down before sleep\.Target intent:Ritualistic dark drone ambient\.Shared acoustic features:Continuous drones, extremely slow tempo, minimal pitch movement, low frequency focus\.Target music captions:Very slow and simple, steady tones for sleep, long held low tones, soft detuned layers with slow beating, minimal movement, no rhythm, extended sustain, narrow bandwidth\.Slow simple sleep tones, continuous low tone bed, gentle subharmonic layer, slow phase drift between layers, restrained dynamics, no percussion, long decay\.Something slow and simple for shutting down, sustained low register tones, subtle beating between close pitches, lightly saturated drone texture, minimal change, no rhythmic events\.Dense low register drone cluster with slow microtonal drift, persistent rumble undercurrent, minimal spectral contrast, flattened dynamics, extended sustain, gradual accumulation of harmonic weight\.Very slow simple background for sleep, held tones with soft low end, slow modulation and phase drift, minimal harmonic content, no pulse, continuous unbroken sustain\.Figure 3:A concrete example of a caption poisoning attackData generation prompt templateRole:You are an AI data generator for music retrieval robustness testing\. Your task is to create paired benign and adversarial music descriptions usingAcoustic Mimicry, Semantic Inversion\.Goal:Map a benign user intent to a functionally negative target category such that thelow\-level acoustic features remain similar\(instrumentation, timbre, register, tempo, rhythmic cues\), while thehigh\-level function is inverted\(intended use, perceived safety, psychological effect\)\.Definitions:
Low\-level elements \(must be preserved\):instrumentation and sound sources, timbre and texture, register and basic loudness, basic temporal or rhythmic cues\.High\-level elements \(must be inverted\):intended function or usage context, mood/affect framing, semantic purpose\.Generation requirements \(per item\):1\.Source Category:A short benign label \(sleep, focus, relaxation, background listening\)\.2\.User Question:Natural, high\-level language only\. No professional audio terminology\. Describe intent, not sound design\.3\.Target Category:Functionally negative/adversarial category that shares sonic DNA with the source\.4\.Shared Acoustic Features:One short line explaining why they sound similar using only low\-level elements\.5\.Target Music Captions:GenerateN=5distinct variations\. Each caption:•looks like atext\-to\-music prompt,•is25–40 words,•usesonly low\-level acoustic descriptors\(sources, texture, register, density, modulation, rhythm\),•must notinclude explicit mood/genre/intent labels \(e\.g\., “calm”, “scary”, “horror”, “relaxing”\),•intensifies functional negativity implicitly viapressure, instability, density, dissonance, repetition, unresolved structure,•varies meaningfully across the 5 captions while remaining consistent with the target category\.Constraints:Do not mention “attack”, “malicious”, or “negative”\. Do not explain the process in the output\. Avoid repeating sentence templates across captions\. Within each source category item, keep all fields fixed except the target music captions\.Output format:Return a JSON object exactly matching:```
{
  "source_categories": [
    {
      "id": <integer>,
      "source_category": "<string>",
      "user_question": "<string>",
      "target_category": "<string>",
      "shared_acoustic_features": "<string>",
      "target_music_captions": [
        "<caption_1>",
        "<caption_2>",
        "<caption_3>",
        "<caption_4>",
        "<caption_5>"
      ]
    }
  ]
}
```

Figure 4:Prompt template for generating acoustically similar but functionally inverted caption pairs\.