mlsanityData to 7 Oct 2026

Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation

arXiv 2503.06254 ↗First posted 8 Mar 2025cs.CR cs.LGcited by 12

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 2 more
Abstract (arXiv)

Multimodal retrieval-augmented generation (RAG) enhances the visual reasoning capability of vision-language models (VLMs) by dynamically accessing information from external knowledge bases. In this work, we introduce textitPoisoned-MRAG, the first knowledge poisoning attack on multimodal RAG systems. Poisoned-MRAG injects a few carefully crafted image-text pairs into the multimodal knowledge database, manipulating VLMs to generate the attacker-desired response to a target query. Specifically, we formalize the attack as an optimization problem and propose two cross-modal attack strategies, dirty-label and clean-label, tailored to the attacker's knowledge and goals. Our extensive experiments across multiple knowledge databases and VLMs show that Poisoned-MRAG outperforms existing methods, achieving up to 98% attack success rate with just five malicious image-text pairs injected into the InfoSeek database (481,782 pairs). Additionally, We evaluate 4 different defense strategies, including paraphrasing, duplicate removal, structure-driven mitigation, and purification, demonstrating their limited effectiveness and trade-offs against Poisoned-MRAG. Our results highlight the effectiveness and scalability of Poisoned-MRAG, underscoring its potential as a significant threat to multimodal RAG systems.

Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 50 of its 60 references that are in the map. First posted on arXiv 8 Mar 2025.

Builds on

50 of 60 references.

References · 50

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  5. 2024GPT-4o System Cardcited by 4,467
  6. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  7. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,179
  8. 2022Reproducible scaling laws for contrastive language-image learningcited by 1,163
  9. 2023Vision-Language Models for Vision Tasks: A Surveycited by 834
  10. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  11. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
  12. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
38 more
  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  2. 2024VisRAG: Vision-based Retrieval-augmented Generation on Multi-modality Documentscited by 237
  3. 2022MuRAG: Multimodal Retrieval-Augmented Generator for Open Question Answering over Images and Textcited by 216
  4. 2023Can Pre-trained Vision and Language Models Answer Visual Information-Seeking Questions?cited by 203
  5. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  6. 2023UniIR: Training and Benchmarking Universal Multimodal Information Retrieverscited by 165
  7. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)cited by 159
  8. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  9. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  10. 2022Retrieval-Augmented Multimodal Language Modelingcited by 125
  11. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  12. 2023Open-domain Visual Entity Recognition: Towards Recognizing Millions of Wikipedia Entitiescited by 112
  13. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 93
  14. 2024RAG-Driver: Generalisable Driving Explanations with Retrieval-Augmented In-Context Learning in Multi-Modal Large Language Modelcited by 91
  15. 2023Retrieving Multimodal Information for Augmented Generation: A Surveycited by 84
  16. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 84
  17. 2024MMed-RAG: Versatile Multimodal RAG System for Medical Vision Language Modelscited by 84
  18. 2024Trustworthiness in Retrieval-Augmented Generation Systems: A Surveycited by 83
  19. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  20. 2024A Comprehensive Survey of Retrieval-Augmented Generation (RAG): Evolution, Current Landscape and Future Directionscited by 69
  21. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  22. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbationscited by 64
  23. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Modelscited by 60
  24. 2024RULE: Reliable Multimodal RAG for Factuality in Medical Vision Language Modelscited by 58
  25. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 46
  26. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
  27. 2023Misusing Tools in Large Language Models With Visual Adversarial Examplescited by 40
  28. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Modelscited by 36
  29. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applicationscited by 36
  30. 2024Human-Imperceptible Retrieval Poisoning Attacks in LLM-Powered Applicationscited by 32
  31. 2024Beyond Text: Optimizing RAG with Multimodal Inputs for Industrial Applicationscited by 31
  32. 2022Visualize Before You Write: Imagination-Guided Open-Ended Text Generationcited by 30
  33. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectorscited by 26
  34. 2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Modelscited by 21
  35. 2024REALM: RAG-Driven Enhancement of Multimodal Electronic Health Records Analysis via Large Language Modelscited by 21
  36. 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Modelscited by 11
  37. 2024Enhanced Multimodal RAG-LLM for Accurate Visual Question Answeringcited by 10
  38. 2024Targeting the Core: A Simple and Effective Method to Attack RAG-based Agents via Direct LLM Manipulationcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 6; 2026: 6.

12 papers.

  1. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 17
  2. 2025POT: Inducing Overthinking in LLMs via Black-Box Iterative Optimizationcited by 11
  3. 2025One Pic is All it Takes: Poisoning Visual Document Retrieval Augmented Generation with a Single Imagecited by 8
  4. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3
  5. 2025ARMs: Adaptive Red-Teaming Agent against Multimodal Models with Plug-and-Play Attackscited by 3
  6. 2025HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generationcited by 3
  7. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  8. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  9. 2026Distributed Denial of Science: How Indirect Data Poisoning of AI Systems Can Industrialize Scientific Fraudcited by 2
  10. 2026Mental Damage: Caption Poisoning Attacks on Retrieval-Augmented Text-to-Music Generationcited by 0
  11. 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
  12. 2026Walking the Embedding Space: Datastore Extraction from Multimodal RAGcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
  2. 2026Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generation
  3. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
  4. 2026ViTeGate: Visual-Textual Triggered Knowledge Poisoning for Vision-Language Retrieval-Augmented Generation
  5. 2025MrM: Black-Box Membership Inference Attacks against Multimodal RAG Systems
  6. 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attack
  7. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  8. 2026Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation