RAG Poisoning Attacks

RAG: Retrieval-Augmented Generation

Follow this topic Ask about this topic

Momentum

3 papers in the last four weeks, down 40% on the four weeks before. 0.0% of all new papers.

Jul 13Week of Sep 28

Latest papers 40

All topics

RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
Sep 21, 2026Abdullahil Kafi, Alvi Ataur KhalilRAG Poisoning Attacks RAG Security
Transformative Innovation for Trustworthy AI and Network Security (TITANS) Lab, Computer Science, Southern Illinois University, USA
CiteShade: Citation Laundering in Multi-Source Retrieval-Augmented Generation and Its Counterfactual Defense
Sep 14, 2026Guo FuzhengRAG Poisoning Attacks RAG Security
City University of Hong Kong
In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning
Sep 10, 2026Iliano FasolinoRAG Poisoning Attacks RAG Security
Department of Computer Science University of Milan Milan, Italy
VerTox: Verifiable Reward-Guided Corpus Poisoning Against Neural Ranking Models
Sep 1, 2026Zhiqi Huang, Vivek Datla, Zhichao Xu +3Learning to Rank RAG Poisoning Attacks
Capital One · University of Utah · Snowflake Inc.
TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
Aug 31, 2026Muhaimin Bin Munir, Akib Jawad Ononto, Nazia Shehnaz Joynab +2RAG Poisoning Attacks Retrieval Robustness
University of Texas at Dallas
Lazy Grounding: Attacking Search Agents with Factual Evidence
Aug 31, 2026Yulin Zhang, Yukun Huang, Sanxing Chen +4Evidence-Grounded Reasoning RAG Poisoning Attacks
Duke University, Durham, NC 27708, USA
When Detection Does Not Guarantee Resistance: Reasoning and Poisoned Context in RAG
Aug 17, 2026Mehrdad Ghassabi, Audrina Ebrahimi, Sadra Hakim +3Knowledge Conflicts in Language Models RAG Poisoning Attacks
University of Isfahan · University of Texas at Dallas · University of Windsor
RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
Aug 13, 2026Xinlong Xu, Yoshua Y. LiRAG Poisoning Attacks RAG Security
Nanjing University of Information Science and Technology · Meituan
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
Aug 8, 2026Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon +2Retrieval-Augmented Classification RAG Poisoning Attacks
Laurentian University Ontario, Canada · Centennial College Ontario, Canada · The University of Osaka Osaka, Japan
EvoTrustRAG: Evolution-Aware Conflict Attribution and Evidence Handling for Reliable Retrieval-Augmented Generation
Aug 8, 2026Xi Nie, Hongwei Li, Shenghao Wu +3Retrieval-Augmented Generation Knowledge Conflicts in Language Models
School of Computer Science and Engineering, University of Electronic Science and Technology of China · Institute of Information Engineering, Chinese Academy of Sciences
PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates
Aug 5, 2026Zijian Wang, Yubo Zhu, Muzhi Dong +7Knowledge Conflicts in Language Models RAG Poisoning Attacks
School of Computer Science, Nanjing University, Nanjing 210023, China · State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing 210023, China
Combating Knowledge Corruption in Agent Systems: A Byzantine-Tolerant Secure Collaborative RAG Framework
Aug 5, 2026Zhaoqi Wang, Daqing He, Zijian Zhang +13RAG Poisoning Attacks AI Agent Security
Beijing Institute of Technology, Beijing, China
DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
Aug 2, 2026Abay Zhurekbay, Tao Liu, Fan LiKnowledge Conflicts in Language Models RAG Poisoning Attacks
Lawrence Technological University
RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
Jul 28, 2026Pushkal Kumar, Tucker Nielson, Tanish Kolhe +2RAG Poisoning Attacks RAG Security
TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
Jul 26, 2026Susil Kumar Mohanty, Rohit Patel, Kosuru Yuvaraj +2Retrieval-Augmented Generation RAG Poisoning Attacks
Department of Computer Science and Engineering, Indian Institute of Technology Jodhpur, Jodhpur, India
Is Deep Research Reliable? Misleading Knowledge Induces False Conclusions
Jul 23, 2026Pengyu Zhu, Lijun Li, Longju Yang +2Deep Research Agents RAG Poisoning Attacks
1Beijing University of Posts and Telecommunications · 2Shanghai Artificial Intelligence Laboratory · 3Chongqing University of Posts and Telecommunications
GPE: Evaluating Robust Evidence Aggregation for Fact Verification under Controllable GEO-Style Poisoning
Jul 22, 2026Zhaoqi Wang, Zijian Zhang, Xiaomei Yuan +4RAG Poisoning Attacks Automated Fact-Checking
School of Cyberspace Science and Technology, Beijing Institute of Technology · School of Computer Science, The University of Auckland
MIRAGE: Defending Long-Form RAG Against Misinformation Pollution
Jul 6, 2026Saadeldine Eletter, Ruihong Zeng, Yuxia Wang +3RAG Poisoning Attacks Retrieval Robustness
Mohamed bin Zayed University of Artificial Intelligence (MBZUAI) · INSAIT, Sofia University St. Kliment Ohridski
FORGE: Research-Trajectory Hijacking Attacks on Deep Research Agents
Jul 6, 2026Yue Pan, Ziheng Zhang, Junxiang Lei +3Deep Research Agents RAG Poisoning Attacks
Fudan University · Huazhong University of Science and Technology · Explore Academy, JD
A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAG
Jul 4, 2026Donghyun Lee, Juntae KimRAG Poisoning Attacks RAG Security
Dongguk University · Department of Computer Engineering Dongguk University Seoul, Republic of Korea
Retrieval Observability Bounds on Provenance Detection for Agent Memory Poisoning: Measured Coverage and a Falsified Standalone Detector
Jun 29, 2026Jun Wen LeongRAG Poisoning Attacks Agent Memory Poisoning
Why Trust Your Agent? Empirical Security Gains from TRiSM-Guided Agentic Workflows in Healthcare
Jun 27, 2026Liam KearnsMedical Report Generation RAG Poisoning Attacks
AuraQ Malvern Worcestershire UK
MIRROR: Novelty-Constrained Memory-Guided MCTS Red-Teaming for Agentic RAG
Jun 25, 2026Inderjeet Singh, Andrés Murillo, Motoyoshi Sekiya +2Multimodal RAG Tool-Augmented Language Model Agents
Fujitsu Research of Europe, United Kingdom · Fujitsu Limited, Japan
Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution
Jun 24, 2026Yan-Lun Chen, Pin-Yu Chen, Chia-Mu Yu +3RAG Poisoning Attacks RAG Security
National Yang Ming Chiao Tung University · IBM Research · Hon Hai Research Institute
Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
Jun 24, 2026Balamurugan Palanisamy, G S S Chalapathi, Vikas Hassija +1Retrieval-Augmented Generation Privacy-Preserving Language Models
Department of Electrical and Electronics Engineering Birla Institute of Technology and Science, Pilani, Pilani Campus Vidya Vihar, Pilani, Rajasthan 333031, India · Department of Computer Engineering, KIIT University Bhubaneshwar, Odisha 751024, India · Quantum Cloud Computing and Distributed Systems (qCLOUDS) Laboratory Department of Computing and Information Systems The University of Melbourne, Melbourne, Australia
Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systems
Jun 16, 2026Xinru Liu, Xianglong Zhang, Di Cai +3Knowledge Editing RAG Poisoning Attacks
Shandong University, China · Tsinghua University, China
SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems
Jun 10, 2026Tarun SharmaRAG Poisoning Attacks Agent Memory Poisoning
Independent Researcher
When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines
Jun 9, 2026Xi Nie, Hongwei Li, Shenghao Wu +3RAG Poisoning Attacks RAG Security
School of Computer Science and Engineering, University of Electronic Science and Technology of China, China · School of Criminal Investigation, People’s Public Security University of China, China · School of Computer Science and Artificial Intelligence, Wuhan University of Technology, China
Inference Cost Attacks for Retrieval-Augmented Large Language Models
May 31, 2026Chengliang Liu, Liangbo Ning, Yujuan Ding +1Retrieval-Augmented Generation Adversarial Attacks
The Hong Kong Polytechnic University Hong Kong, Hong Kong
DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generation
May 31, 2026Yuyang Gong, Miaokun Chen, Jiawei Liu +5RAG Poisoning Attacks RAG Security
Wuhan University · East China Normal University · Nanyang Technological University +1
SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
May 27, 2026Jiachen QianRetrieval-Augmented Generation RAG Poisoning Attacks
City University of Hong Kong · Hong Kong, Hong Kong
Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control
May 26, 2026Zhe Yu, Wenpeng Xing, Gaolei Li +4RAG Poisoning Attacks Information Flow Control
Binjiang Institute of Zhejiang University · Zhejiang University · Shanghai Jiao Tong University +3
Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generation
May 18, 2026Yizhu Wen, Shuhao Zhang, Nan Zhang +2Text-to-Music Generation RAG Poisoning Attacks
University of Hawai'i at M¯anoa · Clemson University · Michigan State University
Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation
May 11, 2026Peiru Yang, Haoran Zheng, Tong Ju +6Multimodal RAG Adversarial Attacks on VLMs
1Tsinghua University · 2Beijing University of Posts and Telecommunications · 3Northwestern Polytechnical University +1
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
May 8, 2026Xue Tan, Yi Zheng, Chang Huo +7Retrieval-Augmented Generation RAG Poisoning Attacks
School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · Department of Computer Science, Worcester Polytechnic Institute, MA, USA
Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
May 7, 2026Samuel KornRetrieval-Augmented Generation RAG Poisoning Attacks
MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents
May 5, 2026Ishrith GowdaRAG Poisoning Attacks Agent Memory Poisoning
University of California, Berkeley · Department of Electrical Engineering and Computer Sciences University of California, Berkeley · Work conducted at the Song Lab, Berkeley AI Research, University of California, Berkeley.
CleanBase: Detecting Malicious Documents in RAG Knowledge Databases
May 1, 2026Weifei Jin, Xilong Wang, Wei Zou +2RAG Poisoning Attacks RAG Security
Duke University · The Pennsylvania State University
Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
Oct 1, 2025Yen-Shan Chen, Sian-Yao Huang, Cheng-Lin Yang +1Language Model Steering RAG Poisoning Attacks
CyCraft AI Lab, Taiwan · National Taiwan University
BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models
Jun 3, 2024Jiaqi Xue, Mengxin Zheng, Yebowen Hu +3LLM Backdoor Attacks RAG Poisoning Attacks
University of Central Florida · Emory University · Samsung Research America

Sep 21, 2026, cs.AIJ/K move · Enter open · S save

RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation

Abdullahil Kafi, Alvi Ataur Khalil

Transformative Innovation for Trustworthy AI and Network Security (TITANS) Lab, Computer Science, Southern Illinois University, USA

RAG Poisoning Attacks RAG Security RAG Robustness

Open paper AskPDF arXiv

Retrieval augmented generation (RAG) systems have emerged as the dominant architecture for grounding large language model (LLM) outputs in verifiable external knowledge, yet their structural reliance on a dynamic retrieval pipeline introduces a largely unexplored class of adversarial vulnerability. Existing knowledge-base poisoning attacks are fundamentally static. Adversarial documents are pre-computed and injected without any awareness of what the victim system will actually retrieve for a given query, leaving the attack blind to the competitive documentary landscape that surrounds its payload in the generator's context window. Unlike traditional static poisoning attacks that are blind to the retrieved context, we introduce RAG-NAROK (Retrieval-Anchored Generation Negation And Response Quality Collapse), a RAG attack framework that adapts to the query text. RAG-NAROK exploits the transparency inherent in RAG pipeline to first extract the legitimate source identities, then generate Anchor-Specific Refutation documents that explicitly name and devalue retrieved sources while leveraging recency and authority biases to steer the text generation toward a target answer. Our results demonstrate that RAG-NAROK significantly outperforms static baselines across diverse domains, revealing a fundamental tension between RAG transparency and AI security.

Momentum

Related topics

Latest papers 40