RAG Poisoning Attacks

RAG: Retrieval-Augmented Generation

This field studies how attackers can corrupt a RAG system by adding or altering corpus documents, metadata, retriever parameters, graph indexes, or persistent agent memory. Attacks aim to make poisoned evidence outrank trustworthy sources, induce false answers or actions, or increase inference costs; they may use optimized triggers, plausible fabricated claims, coordinated documents, or multimodal content. Defenses include anomaly detection, provenance and cross-source checks, retrieval reranking, robust evidence aggregation, and controls on how retrieved claims influence generation. A central challenge is resisting adaptive, subtle attacks across different retrieval pipelines without sacrificing useful evidence, accuracy, latency, or coverage.

Latest papers

71 papers9 papers in the last four weeks, level with the four weeks before. 0.1% of all new papers.

Logic Hijacking of RAG: Single-Document Poisoning via Local Optimization
Oct 26, 2026Hangyi Zhao, Bonan Zhang, Fusen Guo +3RAG Poisoning Attacks Adversarial Text Attacks
Faculty of Data Science, City University of Macau, Macau, China · School of Systems and Computing, UNSW Sydney, Canberra, Australia · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China +1
Factual Yet One-Sided: Stance Poisoning and Evidence Balancing in Retrieval-Augmented Generation
Oct 25, 2026Puyuan Yang, Shaoxuan Dong, Liujie Wu +2RAG Poisoning Attacks RAG Robustness
Department of Computer Science, Swansea University, Swansea, United Kingdom · School of Electronics and Information, Northwestern Polytechnical University, Xi’an, China
Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses
Oct 24, 2026Pushkal Kumar, Arvin SahaymRAG Security RAG Robustness
North Creek High School · Washington State University
Trust Mechanisms for Offline Generative AI at the Edge: A Connectivity-Regime Framework and an Empirical Study on a Raspberry Pi 5
Oct 24, 2026Georgios Feretzakis, Alexandros PapaspyridisLLM Reliability RAG Security
Context-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAG
Oct 20, 2026Abhishek RaiPrompt Injection Detection RAG Security
Independent Researcher
Poisoning the corpora of protein design systems during pre-training and retrieval
Oct 15, 2026Charalampos Koilakos, Kimon-Antonios Provatas, Michail Patsakis +3Data Poisoning Attacks RAG Poisoning Attacks
Division of Pharmacology and Toxicology, College of Pharmacy, The University of Texas at Austin, Dell Pediatric Research Institute, Austin, TX, USA. · Department of Computer Science, The University of Texas at Austin · Institute for Fundamental Biomedical Research, BSRC “Alexander Fleming,”16672 Vari, Greece +1
Learning When to Trust Medical Knowledge: Regression-Safe Routing for Clinical Reasoning
Oct 14, 2026Hui Zhang, Yujia Zeng, Yuhao XinMedical Reasoning LLM Routing
Beijing Institute of Technology · Shanghai Jiao Tong University · Xi’an Jiaotong University
Poisoned into Action: Context Attacks on Typed Decision Workflows
Oct 11, 2026Chenkai Wu, Xing Chang, Jun YanRAG Poisoning Attacks AI Agent Security Benchmarks
Monash University · SUTD · SHOU
RAGStress: A controlled benchmark for evaluating retrieval-augmented generation under knowledge-base degradation
Oct 3, 2026Shiqi Yang, Jiekai Ma, Gaoyuan DuRetrieval-Augmented Generation RAG Evaluation
Amazon
Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM
Oct 1, 2026Jisung Park, John Le, Heath CooperRAG Poisoning Attacks Graph Retrieval-Augmented Generation
Institute of Cybersecurity and Cryptology, University of Wollongong
Stale-Document Poisoning: When Outdated Retrieval Overrides Correct Model Answers
Sep 25, 2026Md Shamim Ahmed, Lukas Galke Poech, Richard RöttgerRAG Poisoning Attacks RAG Robustness
University of Southern Denmark
RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
Sep 21, 2026Abdullahil Kafi, Alvi Ataur KhalilRAG Poisoning Attacks RAG Security
Transformative Innovation for Trustworthy AI and Network Security (TITANS) Lab, Computer Science, Southern Illinois University, USA
Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
Sep 18, 2026Pedro Pereira, Eva Maia, Isabel PraçaRAG Poisoning Attacks RAG Robustness
GECAD, ISEP, Polytechnic of Porto, Rua Dr. António Bernardino de Almeida, 4249-015 Porto, Portugal
CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense
Sep 14, 2026Guo FuzhengRAG Poisoning Attacks RAG Security
City University of Hong Kong
In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Post-Retrieval Context Tampering
Sep 8, 2026Iliano FasolinoRAG Poisoning Attacks RAG Security
Department of Computer Science University of Milan Milan, Italy
The Corroboration Illusion: When More News Makes LLM Forecasts Less True
Sep 5, 2026Yuan Lu, Yukuan ZhangLLM Security Data Poisoning Attacks
Peking university Beijing, China · University of Central Florida Orlando, FL, USA
VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models
Sep 1, 2026Zhiqi Huang, Vivek Datla, Zhichao Xu +3Learning to Rank RAG Poisoning Attacks
Capital One · University of Utah · Snowflake Inc.
TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
Aug 31, 2026Muhaimin Bin Munir, Akib Jawad Ononto, Nazia Shehnaz Joynab +2RAG Poisoning Attacks Retrieval Robustness
University of Texas at Dallas
Lazy Grounding: Attacking Search Agents with Factual Evidence
Aug 31, 2026Yulin Zhang, Yukun Huang, Sanxing Chen +4Evidence-Grounded Reasoning RAG Poisoning Attacks
Duke University, Durham, NC 27708, USA
CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents
Aug 28, 2026Jaewon Jung, Haizhong Zheng, Hongsun Jang +3RAG Poisoning Attacks RAG Security
Seoul National University · Carnegie Mellon University
EVOMAL: Self-Poisoning in Self-Evolving Coding Agents
Aug 26, 2026Xiaodong Wu, Yu Shi, Qi Li +5LLM Agent Security Coding Agents
Queen’s University
Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
Aug 25, 2026Minh Tran, Cuong Dang, Tuc Nguyen +10Retrieval-Augmented Generation RAG Security
Faculty of Information Technology, University of Science, Ho Chi Minh City, Vietnam · Vietnam National University, Ho Chi Minh City, Vietnam · Virginia Tech +6
RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
Aug 25, 2026Yueyang Quan, Anjun Gao, Yufei Xia +2RAG Security RAG Robustness
University of North Texas · University of Louisville
Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systems
Aug 21, 2026Balkrishna Giri, Md Toufique Hasan, Jussi Rasku +2RAG Security RAG Evaluation
Faculty of Information Technology and Communication Sciences, Tampere University Tampere, Finland
Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
Aug 21, 2026Rujin Liang, Zhongpu Chen, Yuhao Lei +1RAG Poisoning Attacks Data Poisoning Attacks
Southwestern University of Finance and Economics, Chengdu, China · Nanjing University of Science and Technology, Nanjing, China
When Detection Does Not Guarantee Resistance: Reasoning and Poisoned Context in RAG
Aug 17, 2026Mehrdad Ghassabi, Audrina Ebrahimi, Sadra Hakim +3Knowledge Conflicts in Language Models RAG Poisoning Attacks
University of Isfahan · University of Texas at Dallas · University of Windsor
DSPrompt: Dynamic Soft Prompt Defense Against M-RAG Corruption
Aug 17, 2026Chang Liu, Yuni Lai, Mingyue Cui +5RAG Robustness RAG Poisoning Attacks
School of Computer Science and Technology, Xidian University · The Hong Kong Polytechnic University · Tencent Jarvis Lab
Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval
Aug 17, 2026Prashant Kumar Pathak, Tarun Kumar SharmaRAG Poisoning Attacks RAG Security
Santa Clara, CA, USA · Colonia, NJ, USA
RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
Aug 13, 2026Xinlong Xu, Yoshua Y. LiRAG Poisoning Attacks RAG Security
Nanjing University of Information Science and Technology · Meituan
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
Aug 8, 2026Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon +2Retrieval-Augmented Classification RAG Poisoning Attacks
Laurentian University Ontario, Canada · Centennial College Ontario, Canada · The University of Osaka Osaka, Japan

Oct 26, 2026J/K move · Enter open · S save

Logic Hijacking of RAG: Single-Document Poisoning via Local Optimization

Hangyi Zhao, Bonan Zhang, Fusen Guo, Jiaheng Wei+2

Faculty of Data Science, City University of Macau, Macau, China · School of Systems and Computing, UNSW Sydney, Canberra, Australia · The Hong Kong University of Science and Technology (Guangzhou), Guangzhou, China+1

RAG Poisoning Attacks Adversarial Text Attacks RAG Robustness

Open paper AskPDF arXiv

Single-document corpus poisoning under black-box access poses a severe threat to Retrieval-Augmented Generation (RAG). However, existing attacks predominantly rely on explicit factual refutations or imperative instruction overrides. Modern aligned LLMs often arbitrate such conflicts conservatively, rejecting overt contradictions in favor of parametric memory or clean retrieved context while triggering input guardrails. We propose MONOLOGUE, a single-document poisoning framework based on Logic Hijacking without explicit refutation. Rather than disputing the ground truth, our method concedes it as an authoritative historical baseline before introducing the update, weaving a grounded record-correction narrative (e.g., dated institutional reattributions) that presents the counterfactual target as the most recent update. To prevent suspicious live writes, payloads are refined entirely offline via local multi-dimensional gated optimization, coupling automated text quality audits with surrogate behavioral verification. Evaluations across three benchmarks, three retrieval backends, and four open-weight generator regimes show that our method achieves the strongest overall attack efficacy among the evaluated single-document poisoning attacks.