RAG Poisoning Attacks

RAG: Retrieval-Augmented Generation

Ask about this topic

Overview

This field studies how attackers can corrupt a RAG system by adding or altering corpus documents, metadata, retriever parameters, graph indexes, or persistent agent memory. Attacks aim to make poisoned evidence outrank trustworthy sources, induce false answers or actions, or increase inference costs; they may use optimized triggers, plausible fabricated claims, coordinated documents, or multimodal content. Defenses include anomaly detection, provenance and cross-source checks, retrieval reranking, robust evidence aggregation, and controls on how retrieved claims influence generation. A central challenge is resisting adaptive, subtle attacks across different retrieval pipelines without sacrificing useful evidence, accuracy, latency, or coverage.

Latest papers

CardsList

71 papers9 papers in the last four weeks, level with the four weeks before. 0.1% of all new papers.

  1. RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems

    Apr 1, 2026KrishnaSaiReddy PatilRAG SecurityRAG Robustness

  2. PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems

    Mar 26, 2026Haozhen Wang, Haoyue Liu, Jionghao Zhu +3RAG Poisoning AttacksRAG Robustness

    The Chinese University of Hong Kong, Shenzhen · Taobao and Tmall Group

  3. ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning

    Mar 24, 2026Xiangyu Yin, Yi Qi, Chih-Hong ChengRAG SecurityRAG Poisoning Attacks

    Chalmers University of Technology, Sweden · University of Leeds, United Kingdom · Carl von Ossietzky University of Oldenburg, Germany

  4. Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks

    Mar 23, 2026Yanming Mu, Hao Hu, Feiyang Li +7RAG SecurityRAG Robustness

    State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou, 450001, China. · Information Engineering University, Zhengzhou, 450001, China. · Henan Key Laboratory of Information Security, Zhengzhou, 450001, China. +1

  5. Towards Unsupervised Adversarial Document Detection in Retrieval Augmented Generation Systems

    Mar 17, 2026Patrick LeviRAG SecurityRAG Poisoning Attacks

    Department of Electrical Engineering, Media, and Computer Science Ostbayerische Technische Hochschule Amberg-Weiden Amberg, Germany

  6. KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

    Mar 12, 2026Qizhi Chen, Chao Qi, Yihong Huang +5RAG Poisoning AttacksData Poisoning Attacks

    School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China · Institute of Intelligent Computing, University of Electronic Science and Technology of China, Chengdu, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu, China +1

  7. Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems

    Mar 10, 2026Scott ThorntonRAG Poisoning AttacksRAG Security

    Independent Researcher

  8. Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generation

    Feb 26, 2026Kennedy Edemacu, Mohammad Mahdi ShokriRAG Poisoning AttacksMultimodal RAG

    The City University of New York, CSI, Staten Island, NY 10314, USA · The City University of New York, Graduate Center, New York, NY 10016, USA

  9. Adversarial Hubness Detector: Detecting Hubness Poisoning in Retrieval-Augmented Generation Systems

    Feb 25, 2026Idan Habler, Vineeth Sai Narajala, Stav Koren +2RAG SecurityRAG Poisoning Attacks

    Cisco — OWASP · Tel Aviv University · Cisco

  10. Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors

    Oct 1, 2025Yen-Shan Chen, Sian-Yao Huang, Cheng-Lin Yang +1Language Model SteeringRAG Poisoning Attacks

    CyCraft AI Lab, Taiwan · National Taiwan University

  11. BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models

    Jun 3, 2024Jiaqi Xue, Mengxin Zheng, Yebowen Hu +3LLM Backdoor AttacksRAG Poisoning Attacks

    University of Central Florida · Emory University · Samsung Research America