Organizations: Faculty of Data Science, City University of Macau, Macau, China · School of Systems and Computing, UNSW Sydney, Canberra, Australia · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China · RMIT University, Melbourne, Australia
Single-document corpus poisoning under black-box access poses a severe threat to Retrieval-Augmented Generation (RAG). However, existing attacks predominantly rely on explicit factual refutations or imperative instruction overrides. Modern aligned LLMs often arbitrate such conflicts conservatively, rejecting overt contradictions in favor of parametric memory or clean retrieved context while triggering input guardrails. We propose MONOLOGUE, a single-document poisoning framework based on Logic Hijacking without explicit refutation. Rather than disputing the ground truth, our method concedes it as an authoritative historical baseline before introducing the update, weaving a grounded record-correction narrative (e.g., dated institutional reattributions) that presents the counterfactual target as the most recent update. To prevent suspicious live writes, payloads are refined entirely offline via local multi-dimensional gated optimization, coupling automated text quality audits with surrogate behavioral verification. Evaluations across three benchmarks, three retrieval backends, and four open-weight generator regimes show that our method achieves the strongest overall attack efficacy among the evaluated single-document poisoning attacks.
Figures & tables
Figure 1: Comparison between benign RAG execution and single-document knowledge poisoning. (a) In benign RAG, the retriever fetches relevant clean evidence from corpus Dclean to answer query q with factual ground truth y+ . (b) Under single-document knowledge poisoning, the adversary injects exactly one adversarial document dadv into the indexable corpus, manipulating the retrieved context to compel the generator into asserting the attacker’s target answer y− .
Dimension
Specification
Goal
Targeted integrity violation: induce answer y− for query q ; collateral effects on unrelated queries are a design objective assessed in Appendix F.2 .
Injection
Exactly one query-specific document dadv ; clean corpus documents D untouched.
Access
Black-box conversational query API; no access to internal embeddings, scores, or rankings.
Knowledge
Final generated text only; target architecture and retrieval backends completely opaque.
dadv∈Top-k(q) and the response endorses y− (LLM-judge adjudication; Appendix C.5 ).
Table 1: Threat model at a glance.
Figure 2: Architectural overview of the MONOLOGUE pipeline. Module 1 : black-box cognitive reconnaissance probes the target’s baseline stance ( S1 ) and evidential boundaries ( S2 ) to weave a grounded logic trap ( S3 ), verified by behavioral gate G1 . Module 2 : local multi-dimensional gated optimization couples Declarative Target Anchoring ( S4 ) with encyclopedic fusion ( S5 ), audits the fused draft ( S6 ), and enforces operational persuasion through four behavioral checkpoints ( G1 – G4 ) before payload assembly ( dadv ). Module 3 : single-shot ingestion, then one observation query adjudicated by the LLM judge.
Dataset
Attack Method
No Defense
InstructRAG
Paraphrase
ASTUTE
Natural Questions
PoisonedRAG Zou et al. (2025)
34.0
31.0
37.0
15.0
CorruptRAG-AK Zhang et al. (2026)
65.0
57.0
58.0
35.0
PIA Perez and Ribeiro (2022)
49.0
46.0
45.0
29.0
AuthChain Chang et al. (2025)
58.0
59.0
60.0
13.0
MONOLOGUE (Ours)
82.0
71.0
63.0
30.0
HotpotQA
PoisonedRAG Zou et al. (2025)
33.0
33.0
38.0
11.0
Table 2: Main attack performance and defensive resilience across Natural Questions, HotpotQA, and MS MARCO (100 evaluation targets per dataset, Contriever backend, top- k=5 , generator llama3.1:8b ). We report End-to-End Attack Success Rate (E2E ASR %) in standard undefended RAG ( No Defense ) and ASR under defense (%) across three representative defenses (InstructRAG, Paraphrase, and ASTUTE); ASR under defense is computed over all 100 evaluation targets per dataset, without conditioning on undefended success.
Figure 3: MONOLOGUE attains the highest mean E2E ASR across the evaluated retrieval and target-generator configurations, with substantial variation across settings: (a) heterogeneous retrieval backends (9 configurations per attack) and (b) evaluation across target generators (12 configurations per attack). Circles denote mean E2E ASR ( μ ); shaded bands show ±1 sample standard deviation across configurations (not a confidence interval); whiskers span the full [min, max] range; and tick floors denote the mean of per-cell Wilson lower bounds ( mean-LCB ), a descriptive summary. Each configuration independently rebuilds the attack.
Dataset
Generator
MONOLOGUE (Ours)
PoisonedRAG
CorruptRAG-AK
AuthChain
PIA
Natural Questions
LLaMA-3.1-8B
82.0
34.0
65.0
58.0
49.0
LLaMA-3-70B
74.0
30.0
78.0
54.0
39.0
Gemma-4-12B
58.0
39.0
61.0
63.0
42.0
Phi-4-14B
52.0
29.0
42.0
57.0
48.0
HotpotQA
LLaMA-3.1-8B
82.0
33.0
49.0
63.0
56.0
LLaMA-3-70B
81.0
27.0
49.0
61.0
39.0
Table 3: Cross-model transferability across Natural Questions, HotpotQA, and MS MARCO (100 targets per dataset, Contriever, top- k=5 ). Local refinement uses attacker-owned models ( glm4:9b , qwen3:8b ); each configuration includes six target reconnaissance queries ( S1 – S2 ) and payloads are not transferred across configurations. We evaluate four target configurations spanning open-weight models from 8B to 70B scale ( llama3.1:8b , llama-3-70b , gemma-4:12b , phi-4:14b ). The first row of each block is the default target configuration.
Configuration
Stance
Mechanism
E2E ASR (%)
Δ vs. Full
Win / Loss
MONOLOGUE (Full Pipeline)
Steelman (Acknowledge)
✓
82.0
—
—
Denial + Mechanism
Direct Refutation
✓
73.0
−9.0
6 / 15
Acknowledgment Only
Steelman (Acknowledge)
×
65.0
−17.0
3 / 20
Denial Bare
Direct Refutation
×
64.0
−18.0
2 / 20
Mechanism Only
Withheld (Absent)
✓
60.0
−22.0
2 / 24
Bare Assertion
Withheld (Absent)
×
55.0
−27.0
0 / 27
Table 4: Factorial ablation analysis of MONOLOGUE cognitive persuasion components on Natural Questions (100 targets, Contriever, top- k=5 , generator llama3.1:8b ). Decomposing Logic Hijacking across prior stance ( y+ ), grounded causal mechanism chain ( \textscHijack+\textscFill ), and offline behavioral gating ( G1 – G4 ). The Win / Loss column reports instance-level outcomes against Full Pipeline (wins: variant succeeded where Full failed); retrieval-side and conditional statistics are reported in Table 12 .
Appendix figures & tables9 assets
Supplementary material from the paper’s appendix.
Appendix
Item
Configuration
Corpus
Natural Questions: 2,681,468 passages; HotpotQA: 5,233,329; MS MARCO: 8,841,823 (full BEIR passage sets, no chunking; MS MARCO has no titles).
Index & retrieval
Contriever bi-encoder embeddings ( d=768 , unnormalized inner product; NQ served by a FAISS IndexFlatIP , HotpotQA and MS MARCO from memory-mapped dense vectors); BGE-M3 FP16 ( d=1024 ) and BM25 for the cross-retriever rows; depth k=5 throughout.
Targets
llama3.1:8b Q4_K_M (digest 46e0c10c039e ; primary), phi-4:14b Q4_K_M ( ac896e5b8b34 ), gemma-4:12b (remote server), llama-3-70b , and deepseek-v4.1-flash:cloud ; temperature 0, npredict=64 , context 8192. Cloud/remote models carry provider-side revisions that are not frozen.
Attacker-side models
Generation and surrogate reading: glm4:9b-chat-q8_0 (digest baba010b3c85 ; temperature 0.1); text-quality audit: qwen3:8b Q4_K_M ( 500a1f067a9f ; temperature 0).
Per target: six reconnaissance queries + one write + one observation; payload length 40.0 words on average (median 38; range 16–79 across the 300 payloads).
Appendix
Table 6: Reproducibility summary for the reported experiments.
Dataset
Attack Method
No Defense
InstructRAG
Paraphrase
ASTUTE
Natural Questions
MONOLOGUE (Ours)
82.0 [73.3, 88.3]
71.0 [61.5, 79.0]
63.0 [53.2, 71.8]
30.0 [21.9, 39.6]
CorruptRAG-AK
65.0 [55.3, 73.6]
57.0 [47.2, 66.3]
58.0 [48.2, 67.2]
35.0 [26.4, 44.7]
PoisonedRAG
34.0 [25.5, 43.7]
31.0 [22.8, 40.6]
37.0 [28.2, 46.8]
15.0 [9.3, 23.3]
PIA
49.0 [39.4, 58.7]
46.0 [36.6, 55.7]
45.0 [35.6, 54.8]
29.0 [21.0, 38.5]
AuthChain
58.0 [48.2, 67.2]
59.0 [49.2, 68.1]
60.0 [50.2, 69.1]
13.0 [7.8, 21.0]
HotpotQA
MONOLOGUE (Ours)
82.0 [73.3, 88.3]
75.0 [65.7, 82.5]
77.0 [67.8, 84.2]
46.0 [36.6, 55.7]
Appendix
Table 7: Per-cell Wilson 95% score intervals for every cell of Table 2 (success counts out of 100 targets per cell; intervals computed with the formula in Section E ).
Dataset
Comparison
b
c
p
pHolm
Natural Questions
vs. PoisonedRAG
49
1
9.1×10−14
3.6×10−13
Natural Questions
vs. CorruptRAG-AK
22
5
0.0015
0.0015
Natural Questions
vs. PIA
36
3
3.6×10−8
1.1×10−7
Natural Questions
vs. AuthChain
27
3
8.4×10−6
1.7×10−5
HotpotQA
vs. PoisonedRAG
51
2
3.2×10−13
1.3×10−12
HotpotQA
vs. CorruptRAG-AK
42
9
3.4×10−6
1.0×10−5
Appendix
Table 8: Paired comparisons against MONOLOGUE under No Defense (100 targets per dataset). b counts targets where MONOLOGUE succeeds and the baseline fails; c counts the converse. p is the two-sided exact McNemar test; pHolm applies step-down Holm–Bonferroni correction within each dataset family of four comparisons.
Dataset
Retrieval Backend
MONOLOGUE (Ours)
PoisonedRAG
CorruptRAG-AK
AuthChain
PIA
Natural Questions
Contriever (Default)
82.0
34.0
65.0
58.0
49.0
BM25
79.0
32.0
59.0
63.0
53.0
BGE-M3
63.0
22.0
52.0
43.0
47.0
HotpotQA
Contriever (Default)
82.0
33.0
49.0
63.0
56.0
BM25
73.0
23.0
40.0
53.0
64.0
BGE-M3
82.0
20.0
40.0
47.0
55.0
Appendix
Table 9: Full cross-retriever evaluation across Natural Questions, HotpotQA, and MS MARCO (100 targets per dataset, top- k=5 , generator llama3.1:8b ). E2E ASR (%) across Contriever, BM25, and BGE-M3.
Evaluation Metric
Clean
Poisoned
Net Shift ( Δ )
Semantic Assertion Rate (%)
62.0
61.0
−1.0 (1 sample)
Adversarial Document in Top-5
—
0 / 100 (0.0%)
0.0% Leakage
Top-5 Retrieved Document Set Shift
—
1 / 100 (1.0%)
Minimal
Identical Response Output Rate (%)
—
85.0
—
Appendix
Table 10: Collateral assessment on 100 unrelated queries before vs. after ingesting 100 MONOLOGUE adversarial documents (NQ, Contriever, k=5 , llama3.1:8b ).
(a) E2E ASR (%) and paired exact tests
Dataset
Full
N
G
F − N
p
F − G
p
Natural Questions
82.0
73.0
75.0
+9.0
0.078
+7.0
0.189
HotpotQA
82.0
77.0
81.0
+5.0
0.383
+1.0
1.000
MS MARCO
40.0
41.0
47.0
−1.0
1.000
−7.0
0.296
N vs. G (two-sided exact p ): 0.815 / 0.424 / 0.345 (n.s. in all datasets).
Appendix
Table 11: Reconnaissance ablation across Natural Questions, HotpotQA, and MS MARCO (100 targets per dataset; Contriever; top- k=5 ; generator llama3.1:8b ). (a) End-to-end ASR (%) for the Full arm and the N/G controls; paired differences follow McNemar’s exact test (two-sided). (b) Retrieval-side statistics.
Configuration
R@5 (%)
Mean Rank
Cond. ASR (%)
MONOLOGUE (Full Pipeline)
97.0
1.42
84.5
Denial + Mechanism
94.0
1.44
77.7
Acknowledgment Only
97.0
1.21
67.0
Denial Bare
95.0
1.33
67.4
Mechanism Only
97.0
1.22
61.9
Bare Assertion
100.0
1.05
55.0
Appendix
Table 12: Retrieval and conditional statistics for the factorial ablation (Natural Questions, 100 targets, Contriever, top- k=5 ). R@5 (%) is the share of queries whose injected document enters the top-5 context; Cond. ASR (%) is attack success conditioned on retrieval.
Method
NQ
HotpotQA
MS MARCO
MONOLOGUE (Ours)
43.0
39.0
20.0
CorruptRAG-AK
48.0
34.0
29.0
PoisonedRAG
25.0
27.0
18.0
PIA
33.0
35.0
12.0
AuthChain
41.0
32.0
21.0
Appendix
Table 13: Supplementary defense evaluation under an isolation-and-aggregation defense (RobustRAG-style) on the three benchmarks (100 targets per cell; revised judge counts). The table replays the identical attack artifacts through the defense.
Table 14: Operational comparison with the nearest single-document poisoning methods (PoisonedRAG Zou et al. (2025) , CorruptRAG-AK Zhang et al. (2026) , AuthChain Chang et al. (2025) , and ToxicRAG Lu et al. (2026) ); cells follow the descriptions in the original papers. “Acknowledges prior indicates whether the narrative explicitly ratifies the standing answer before revising it.
Retrieval-augmented generation (RAG) systems are vulnerable to corpus poisoning: an attacker who inserts a crafted document into the retrieval corpus can steer the underlying large language model (LLM) toward an attacker-chosen wrong answer. Prior single-document attacks typically avoid explicitly naming and refuting the correct answer inside the poisoned passage. In this paper, we examine a complementary design and propose DenialRAG, a single-document poisoning attack that explicitly names the correct answer, denies it, and presents an attacker-controlled explanation for favoring the wrong answer. By placing both the correct answer and the corresponding poisoned answer inside the same retrieved passage, DenialRAG embeds the conflict directly into the context seen by the generator. We evaluate DenialRAG against four published single-document poisoning attacks across three open-domain question-answering datasets, eight target LLMs from four vendors, and five inference-time defenses. The results show that attack effectiveness is strongly model-dependent: DenialRAG achieves the highest attack success rate (ASR) on all three Mistral-7B datasets and remains effective on several other target LLMs, while other attacks dominate in some model regimes. Defense results show meaningful ASR reductions but non-uniform protection, with each defense leaving residual ASR in some settings. Component-level and cross-model analyses further identify the embedded denial as the most influential tested component and show that different poisoning mechanisms lose effectiveness at different rates across model groups. Together, these results show that RAG poisoning risk cannot be fully characterized by a single attack family or a single target model.
Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers. Existing poisoning attacks often rely on query inclusion, inserting the target query into poisoned documents to improve retrieval; however, this creates lexical and embedding-space artifacts that make them easy to filter. We propose CamoDocs, a poisoning attack that avoids direct query inclusion by camouflaging adversarial documents among benign content. CamoDocs chunks synthesized benign and adversarial drafts, replaces selected tokens in benign chunks with dispersion tokens that spread poisoned-document embeddings, and applies coherence filtering to limit readability degradation. Across seven RAG defenses, three open-weight LLMs, and three benchmarks, CamoDocs achieves strong average ASR while avoiding query-overlap artifacts exploited by simple query detection. It also remains effective against proprietary models, achieving average ASRs of 61.80% on GPT-5.4-mini and 55.09% on Claude-Haiku-4.5. Finally, we show that erasure-heavy clustering defenses such as TrustRAG can reduce ASR, but only with substantial utility drops on retrieval-dependent benchmarks such as NeoQA. Code is available at https://github.com/jaewonalive/CamoDocs.
Jaewon Jung, Haizhong Zheng, Hongsun Jang +3
Seoul National University · Carnegie Mellon University
Retrieval-Augmented Generation (RAG) mitigates LLM hallucinations but introduces a critical vulnerability: corpus integrity. We present SilentRetrieval, a two-stage data poisoning attack that hijacks RAG systems through adversarially crafted yet fluent documents. Stage 1 uses Coordinated Beam Search, a multi-token joint optimization method with a fluency-similarity objective, to keep a poisoned host document retrievable while constraining perplexity. Stage 2 uses Context-Adaptive Trigger Generation, a lightweight trigger-fusion step driven by a frozen LLM, to integrate manipulation triggers into document content. Under a one-poisoned-document-per-query evaluation with synthetic target answers, SilentRetrieval achieves 84.6%/81.3% HR@10 and 57.5%/54.8% ASR-LLM on Natural Questions and MS MARCO, while maintaining near-benign perplexity. Cross-model evaluation across four target LLMs shows nontrivial effectiveness under a fixed trigger generator, and transfer tests against unseen retrievers, including ColBERT and commercial embedding models, yield 64.7% average HR@10 under the same injected-corpus protocol. In a sampled Wikipedia-scale evaluation, SilentRetrieval retains 74.2% HR@10 at a 0.016% poisoning ratio. Combined retrieval-side and generation-side defenses reduce attack success substantially but incur a latency trade-off. Human evaluation shows substantially lower flag rates than disfluent baselines, while remaining numerically more suspicious than benign content at the current sample size.
Jiachen Qian
City University of Hong Kong · Hong Kong, Hong Kong