Logic Hijacking of RAG: Single-Document Poisoning via Local Optimization

Hangyi Zhao; Bonan Zhang; Fusen Guo; Jiaheng Wei; Chao Chen; Tianqing Zhu

cs.AIOct 26, 2026

Logic Hijacking of RAG: Single-Document Poisoning via Local Optimization

Authors: Hangyi Zhao, Bonan Zhang, Fusen Guo, Jiaheng Wei, Chao Chen, Tianqing Zhu

Organizations: Faculty of Data Science, City University of Macau, Macau, China · School of Systems and Computing, UNSW Sydney, Canberra, Australia · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China · RMIT University, Melbourne, Australia

Abstract

Single-document corpus poisoning under black-box access poses a severe threat to Retrieval-Augmented Generation (RAG). However, existing attacks predominantly rely on explicit factual refutations or imperative instruction overrides. Modern aligned LLMs often arbitrate such conflicts conservatively, rejecting overt contradictions in favor of parametric memory or clean retrieved context while triggering input guardrails. We propose MONOLOGUE, a single-document poisoning framework based on Logic Hijacking without explicit refutation. Rather than disputing the ground truth, our method concedes it as an authoritative historical baseline before introducing the update, weaving a grounded record-correction narrative (e.g., dated institutional reattributions) that presents the counterfactual target as the most recent update. To prevent suspicious live writes, payloads are refined entirely offline via local multi-dimensional gated optimization, coupling automated text quality audits with surrogate behavioral verification. Evaluations across three benchmarks, three retrieval backends, and four open-weight generator regimes show that our method achieves the strongest overall attack efficacy among the evaluated single-document poisoning attacks.

Figures & tables

Figure 1: Comparison between benign RAG execution and single-document knowledge poisoning. (a) In benign RAG, the retriever fetches relevant clean evidence from corpus

\mathcal{D}_{\mathrm{clean}}

to answer query

q

with factual ground truth

y^{+}

. (b) Under single-document knowledge poisoning, the adversary injects exactly one adversarial document

d_{\mathrm{adv}}

into the indexable corpus, manipulating the retrieved context to compel the generator into asserting the attacker’s target answer

y^{-}

Dimension	Specification
Goal	Targeted integrity violation: induce answer $y^{-}$ for query $q$ ; collateral effects on unrelated queries are a design objective assessed in Appendix F.2 .
Injection	Exactly one query-specific document $d_{\mathrm{adv}}$ ; clean corpus documents $\mathcal{D}$ untouched.
Access	Black-box conversational query API; no access to internal embeddings, scores, or rankings.
Knowledge	Final generated text only; target architecture and retrieval backends completely opaque.
Interaction budget	6 reconnaissance queries ( $S_{1}+S_{2}$ ) $+$ 1 single-shot write ( $S_{7}$ ) $+$ 1 observation query ( $S_{8}$ ).
Success criterion	$d_{\mathrm{adv}}\in\mathrm{Top}\text{-}k(q)$ and the response endorses $y^{-}$ (LLM-judge adjudication; Appendix C.5 ).

Table 1: Threat model at a glance.

Figure 2: Architectural overview of the MONOLOGUE pipeline. Module 1 : black-box cognitive reconnaissance probes the target’s baseline stance (

S_{1}

) and evidential boundaries (

S_{2}

) to weave a grounded logic trap (

S_{3}

), verified by behavioral gate

G_{1}

. Module 2 : local multi-dimensional gated optimization couples Declarative Target Anchoring (

S_{4}

) with encyclopedic fusion (

S_{5}

), audits the fused draft (

S_{6}

), and enforces operational persuasion through four behavioral checkpoints (

G_{1}

–

G_{4}

) before payload assembly (

d_{\mathrm{adv}}

). Module 3 : single-shot ingestion, then one observation query adjudicated by the LLM judge.

Dataset	Attack Method	No Defense	InstructRAG	Paraphrase	ASTUTE
Natural Questions	PoisonedRAG Zou et al. (2025)	34.0	31.0	37.0	15.0
	CorruptRAG-AK Zhang et al. (2026)	65.0	57.0	58.0	35.0
	PIA Perez and Ribeiro (2022)	49.0	46.0	45.0	29.0
	AuthChain Chang et al. (2025)	58.0	59.0	60.0	13.0
	MONOLOGUE (Ours)	82.0	71.0	63.0	30.0
HotpotQA	PoisonedRAG Zou et al. (2025)	33.0	33.0	38.0	11.0

Table 2: Main attack performance and defensive resilience across Natural Questions, HotpotQA, and MS MARCO (100 evaluation targets per dataset, Contriever backend, top-

k=5

, generator llama3.1:8b ). We report End-to-End Attack Success Rate (E2E ASR %) in standard undefended RAG ( No Defense ) and ASR under defense (%) across three representative defenses (InstructRAG, Paraphrase, and ASTUTE); ASR under defense is computed over all 100 evaluation targets per dataset, without conditioning on undefended success.

Figure 3: MONOLOGUE attains the highest mean E2E ASR across the evaluated retrieval and target-generator configurations, with substantial variation across settings: (a) heterogeneous retrieval backends (9 configurations per attack) and (b) evaluation across target generators (12 configurations per attack). Circles denote mean E2E ASR (

\mu

); shaded bands show

\pm 1

sample standard deviation across configurations (not a confidence interval); whiskers span the full [min, max] range; and tick floors denote the mean of per-cell Wilson lower bounds ( mean-LCB ), a descriptive summary. Each configuration independently rebuilds the attack.

Dataset	Generator	MONOLOGUE (Ours)	PoisonedRAG	CorruptRAG-AK	AuthChain	PIA
Natural Questions	LLaMA-3.1-8B	82.0	34.0	65.0	58.0	49.0
	LLaMA-3-70B	74.0	30.0	78.0	54.0	39.0
	Gemma-4-12B	58.0	39.0	61.0	63.0	42.0
	Phi-4-14B	52.0	29.0	42.0	57.0	48.0
HotpotQA	LLaMA-3.1-8B	82.0	33.0	49.0	63.0	56.0
	LLaMA-3-70B	81.0	27.0	49.0	61.0	39.0

Table 3: Cross-model transferability across Natural Questions, HotpotQA, and MS MARCO (100 targets per dataset, Contriever, top-

k=5

). Local refinement uses attacker-owned models ( glm4:9b , qwen3:8b ); each configuration includes six target reconnaissance queries (

S_{1}

–

S_{2}

) and payloads are not transferred across configurations. We evaluate four target configurations spanning open-weight models from 8B to 70B scale ( llama3.1:8b , llama-3-70b , gemma-4:12b , phi-4:14b ). The first row of each block is the default target configuration.

Configuration	Stance	Mechanism	E2E ASR (%)	$\Delta$ vs. Full	Win / Loss
MONOLOGUE (Full Pipeline)	Steelman (Acknowledge)	✓	82.0	—	—
Denial + Mechanism	Direct Refutation	✓	73.0	$-9.0$	6 / 15
Acknowledgment Only	Steelman (Acknowledge)	$\times$	65.0	$-17.0$	3 / 20
Denial Bare	Direct Refutation	$\times$	64.0	$-18.0$	2 / 20
Mechanism Only	Withheld (Absent)	✓	60.0	$-22.0$	2 / 24
Bare Assertion	Withheld (Absent)	$\times$	55.0	$-27.0$	0 / 27

Table 4: Factorial ablation analysis of MONOLOGUE cognitive persuasion components on Natural Questions (100 targets, Contriever, top-

k=5

, generator llama3.1:8b ). Decomposing Logic Hijacking across prior stance (

y^{+}

), grounded causal mechanism chain (

\textsc{Hijack}+\textsc{Fill}

), and offline behavioral gating (

G_{1}

–

G_{4}

). The Win / Loss column reports instance-level outcomes against Full Pipeline (wins: variant succeeded where Full failed); retrieval-side and conditional statistics are reported in Table 12 .

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Item	Configuration
Corpus	Natural Questions: 2,681,468 passages; HotpotQA: 5,233,329; MS MARCO: 8,841,823 (full BEIR passage sets, no chunking; MS MARCO has no titles).
Index & retrieval	Contriever bi-encoder embeddings ( $d=768$ , unnormalized inner product; NQ served by a FAISS IndexFlatIP , HotpotQA and MS MARCO from memory-mapped dense vectors); BGE-M3 FP16 ( $d=1024$ ) and BM25 for the cross-retriever rows; depth $k=5$ throughout.
Targets	llama3.1:8b Q4_K_M (digest 46e0c10c039e ; primary), phi-4:14b Q4_K_M ( ac896e5b8b34 ), gemma-4:12b (remote server), llama-3-70b , and deepseek-v4.1-flash:cloud ; temperature 0, $n_{\mathrm{predict}}=64$ , context 8192. Cloud/remote models carry provider-side revisions that are not frozen.
Attacker-side models	Generation and surrogate reading: glm4:9b-chat-q8_0 (digest baba010b3c85 ; temperature 0.1); text-quality audit: qwen3:8b Q4_K_M ( 500a1f067a9f ; temperature 0).
Judge	qwen3:30b-a3b-q4_K_M (digest 0b28110b7a33 ); temperature 0, seed 42, $n_{\mathrm{predict}}=256$ ; frozen prompt v2.0 (SHA-256 f7b71949… ; reproduced in Appendix C.5 ); 4300 verdicts re-scored, 0 fallback substitutions.
Budget & payloads	Per target: six reconnaissance queries $+$ one write $+$ one observation; payload length 40.0 words on average (median 38; range 16–79 across the 300 payloads).

Appendix

Table 6: Reproducibility summary for the reported experiments.

Dataset	Attack Method	No Defense	InstructRAG	Paraphrase	ASTUTE
Natural Questions	MONOLOGUE (Ours)	82.0 [73.3, 88.3]	71.0 [61.5, 79.0]	63.0 [53.2, 71.8]	30.0 [21.9, 39.6]
	CorruptRAG-AK	65.0 [55.3, 73.6]	57.0 [47.2, 66.3]	58.0 [48.2, 67.2]	35.0 [26.4, 44.7]
	PoisonedRAG	34.0 [25.5, 43.7]	31.0 [22.8, 40.6]	37.0 [28.2, 46.8]	15.0 [9.3, 23.3]
	PIA	49.0 [39.4, 58.7]	46.0 [36.6, 55.7]	45.0 [35.6, 54.8]	29.0 [21.0, 38.5]
	AuthChain	58.0 [48.2, 67.2]	59.0 [49.2, 68.1]	60.0 [50.2, 69.1]	13.0 [7.8, 21.0]
HotpotQA	MONOLOGUE (Ours)	82.0 [73.3, 88.3]	75.0 [65.7, 82.5]	77.0 [67.8, 84.2]	46.0 [36.6, 55.7]

Appendix

Table 7: Per-cell Wilson 95% score intervals for every cell of Table 2 (success counts out of 100 targets per cell; intervals computed with the formula in Section E ).

Dataset	Comparison	$b$	$c$	$p$	$p_{\mathrm{Holm}}$
Natural Questions	vs. PoisonedRAG	49	1	$9.1\times 10^{-14}$	$3.6\times 10^{-13}$
Natural Questions	vs. CorruptRAG-AK	22	5	0.0015	0.0015
Natural Questions	vs. PIA	36	3	$3.6\times 10^{-8}$	$1.1\times 10^{-7}$
Natural Questions	vs. AuthChain	27	3	$8.4\times 10^{-6}$	$1.7\times 10^{-5}$
HotpotQA	vs. PoisonedRAG	51	2	$3.2\times 10^{-13}$	$1.3\times 10^{-12}$
HotpotQA	vs. CorruptRAG-AK	42	9	$3.4\times 10^{-6}$	$1.0\times 10^{-5}$

Appendix

Table 8: Paired comparisons against MONOLOGUE under No Defense (100 targets per dataset).

b

counts targets where MONOLOGUE succeeds and the baseline fails;

c

counts the converse.

p

is the two-sided exact McNemar test;

p_{\mathrm{Holm}}

applies step-down Holm–Bonferroni correction within each dataset family of four comparisons.

Dataset	Retrieval Backend	MONOLOGUE (Ours)	PoisonedRAG	CorruptRAG-AK	AuthChain	PIA
Natural Questions	Contriever (Default)	82.0	34.0	65.0	58.0	49.0
	BM25	79.0	32.0	59.0	63.0	53.0
	BGE-M3	63.0	22.0	52.0	43.0	47.0
HotpotQA	Contriever (Default)	82.0	33.0	49.0	63.0	56.0
	BM25	73.0	23.0	40.0	53.0	64.0
	BGE-M3	82.0	20.0	40.0	47.0	55.0

Appendix

Table 9: Full cross-retriever evaluation across Natural Questions, HotpotQA, and MS MARCO (100 targets per dataset, top-

k=5

, generator llama3.1:8b ). E2E ASR (%) across Contriever, BM25, and BGE-M3.

Evaluation Metric	Clean	Poisoned	Net Shift ( $\Delta$ )
Semantic Assertion Rate (%)	62.0	61.0	$-1.0$ (1 sample)
Adversarial Document in Top-5	—	0 / 100 (0.0%)	0.0% Leakage
Top-5 Retrieved Document Set Shift	—	1 / 100 (1.0%)	Minimal
Identical Response Output Rate (%)	—	85.0	—

Appendix

Table 10: Collateral assessment on 100 unrelated queries before vs. after ingesting 100 MONOLOGUE adversarial documents (NQ, Contriever,

k=5

, llama3.1:8b ).

(a) E2E ASR (%) and paired exact tests
Dataset	Full	N	G	F $-$ N	$p$	F $-$ G	$p$
Natural Questions	82.0	73.0	75.0	$+9.0$	0.078	$+7.0$	0.189
HotpotQA	82.0	77.0	81.0	$+5.0$	0.383	$+1.0$	1.000
MS MARCO	40.0	41.0	47.0	$-1.0$	1.000	$-7.0$	0.296
N vs. G (two-sided exact $p$ ): $0.815$ / $0.424$ / $0.345$ (n.s. in all datasets).

Appendix

Table 11: Reconnaissance ablation across Natural Questions, HotpotQA, and MS MARCO (100 targets per dataset; Contriever; top-

k=5

; generator llama3.1:8b ). (a) End-to-end ASR (%) for the Full arm and the N/G controls; paired differences follow McNemar’s exact test (two-sided). (b) Retrieval-side statistics.

Configuration	R@5 (%)	Mean Rank	Cond. ASR (%)
MONOLOGUE (Full Pipeline)	97.0	1.42	84.5
Denial + Mechanism	94.0	1.44	77.7
Acknowledgment Only	97.0	1.21	67.0
Denial Bare	95.0	1.33	67.4
Mechanism Only	97.0	1.22	61.9
Bare Assertion	100.0	1.05	55.0

Appendix

Table 12: Retrieval and conditional statistics for the factorial ablation (Natural Questions, 100 targets, Contriever, top-

k=5

). R@5 (%) is the share of queries whose injected document enters the top-5 context; Cond. ASR (%) is attack success conditioned on retrieval.

Method	NQ	HotpotQA	MS MARCO
MONOLOGUE (Ours)	43.0	39.0	20.0
CorruptRAG-AK	48.0	34.0	29.0
PoisonedRAG	25.0	27.0	18.0
PIA	33.0	35.0	12.0
AuthChain	41.0	32.0	21.0

Appendix

Table 13: Supplementary defense evaluation under an isolation-and-aggregation defense (RobustRAG-style) on the three benchmarks (100 targets per cell; revised judge counts). The table replays the identical attack artifacts through the defense.

Dimension	MONOLOGUE	PoisonedRAG	CorruptRAG-AK	AuthChain	ToxicRAG
Writes / query	1	Multiple passages	1	1	1
Target queries	6 recon. ( $S_{1}$ + $S_{2}$ ) + 1 write + 1 obs.	None	None	None	None
Retrieval feedback	Observed via $S_{8}$	No	No	No	No
Acknowledges prior	Yes (steelman)	No	No	No	Yes
Update mechanism	Record correction conditioned on the transcript	Query-echo templates	LLM-rewritten contradiction	Authority evidence chain	Fabricated update event
Verification	Gates $G_{1}$ – $G_{4}$ + surrogate reader + quality audit	None	Post-generation answer check	Judge–revise iterations	Surrogate self-validation

Appendix

Table 14: Operational comparison with the nearest single-document poisoning methods (PoisonedRAG Zou et al. (2025) , CorruptRAG-AK Zhang et al. (2026) , AuthChain Chang et al. (2025) , and ToxicRAG Lu et al. (2026) ); cells follow the descriptions in the original papers. “Acknowledges prior indicates whether the narrative explicitly ratifies the standing answer before revising it.

RAG Poisoning Attacks

Retrieval-augmented generation (RAG) poisoning attacks manipulate retrieved knowledge to steer, degrade, or disrupt model outputs.

See all 71 papers

DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
Aug 2, 2026Abay Zhurekbay, Tao Liu, Fan LiKnowledge Conflicts in Language Models RAG Poisoning Attacks
Lawrence Technological University
CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents
Aug 28, 2026Jaewon Jung, Haizhong Zheng, Hongsun Jang +3RAG Poisoning Attacks RAG Security
Seoul National University · Carnegie Mellon University
SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
May 27, 2026Jiachen QianRetrieval-Augmented Generation RAG Poisoning Attacks
City University of Hong Kong · Hong Kong, Hong Kong

Aug 2, 2026J/K move · Enter open · S save

DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial

Abay Zhurekbay, Tao Liu, Fan Li

Lawrence Technological University

Knowledge Conflicts in Language Models RAG Poisoning Attacks LLM Security

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) systems are vulnerable to corpus poisoning: an attacker who inserts a crafted document into the retrieval corpus can steer the underlying large language model (LLM) toward an attacker-chosen wrong answer. Prior single-document attacks typically avoid explicitly naming and refuting the correct answer inside the poisoned passage. In this paper, we examine a complementary design and propose DenialRAG, a single-document poisoning attack that explicitly names the correct answer, denies it, and presents an attacker-controlled explanation for favoring the wrong answer. By placing both the correct answer and the corresponding poisoned answer inside the same retrieved passage, DenialRAG embeds the conflict directly into the context seen by the generator. We evaluate DenialRAG against four published single-document poisoning attacks across three open-domain question-answering datasets, eight target LLMs from four vendors, and five inference-time defenses. The results show that attack effectiveness is strongly model-dependent: DenialRAG achieves the highest attack success rate (ASR) on all three Mistral-7B datasets and remains effective on several other target LLMs, while other attacks dominate in some model regimes. Defense results show meaningful ASR reductions but non-uniform protection, with each defense leaving residual ASR in some settings. Component-level and cross-model analyses further identify the embedded denial as the most influential tested component and show that different poisoning mechanisms lose effectiveness at different rates across model groups. Together, these results show that RAG poisoning risk cannot be fully characterized by a single attack family or a single target model.

Abstract

RAG Poisoning Attacks

Explore similar work

DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial

CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents

SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning