mlsanityData to 14 Oct 2026

Practical Poisoning Attacks against Retrieval-Augmented Generation

arXiv 2504.03957 ↗First posted 4 Apr 2025cs.CR cs.IR cs.LGcited by 36

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Large language models (LLMs) have demonstrated impressive natural language processing abilities but face challenges such as hallucination and outdated knowledge. Retrieval-Augmented Generation (RAG) has emerged as a state-of-the-art approach to mitigate these issues. While RAG enhances LLM outputs, it remains vulnerable to poisoning attacks. Recent studies show that injecting poisoned text into the knowledge database can compromise RAG systems, but most existing attacks assume that the attacker can insert a sufficient number of poisoned texts per query to outnumber correct-answer texts in retrieval, an assumption that is often unrealistic. To address this limitation, we propose CorruptRAG, a practical poisoning attack against RAG systems in which the attacker injects only a single poisoned text, enhancing both feasibility and stealth. Extensive experiments conducted on multiple large-scale datasets demonstrate that CorruptRAG achieves higher attack success rates than existing baselines.

Key facts. Cited by 36 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 45 of its 54 references that are in the map. First posted on arXiv 4 Apr 2025.

Builds on

45 of 54 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models18 Jul
  2. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  3. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  4. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models22 May
  5. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr
  6. 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning13 Feb

Other references · 39

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2023GPT-4 Technical Reportcited by 18,396
  3. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  4. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  5. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  6. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  7. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  9. 2021Improving language models by retrieving from trillions of tokenscited by 1,293
  10. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,252
  11. 2022LaMDA: Language Models for Dialog Applicationscited by 1,220
  12. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
27 more
  1. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 849
  2. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  4. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  5. 2023Active Retrieval Augmented Generationcited by 516
  6. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  7. 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 493
  8. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  9. 2023Detecting Language Model Attacks with Perplexitycited by 431
  10. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  11. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
  12. 2023Benchmarking Large Language Models in Retrieval-Augmented Generationcited by 312
  13. 2017Certified Defenses for Data Poisoning Attackscited by 303
  14. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  15. 2022Demystifying Prompts in Language Models via Perplexity Estimationcited by 216
  16. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
  17. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 115
  18. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 94
  19. 2024Evaluating Retrieval Quality in Retrieval-Augmented Generationcited by 90
  20. 2023RewriteLM: An Instruction-Tuned Large Language Model for Text Rewritingcited by 67
  21. 2020Influence Function based Data Poisoning Attacks to Top-N Recommender Systemscited by 63
  22. 2018Poisoning Attacks to Graph-Based Recommender Systemscited by 56
  23. 2020TREC-COVID: Constructing a Pandemic Information Retrieval Test Collectioncited by 23
  24. 2023QASiNa: Religious Domain Question Answering using Sirah Nabawiyahcited by 15
  25. 2024Poisoning Federated Recommender Systems with Fake Userscited by 15
  26. 2024Learning to Rewrite: Generalized LLM-Generated Text Detectioncited by 13
  27. 2021Data Poisoning Attacks and Defenses to Crowdsourcing Systemscited by 12

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 12; 2026: 24.

36 papers.

Sort:

By area:

  1. 2025MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrievalcited by 72
  2. 2025Secure Retrieval-Augmented Generation against Poisoning Attackscited by 19
  3. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 18
  4. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 13
  5. 2025POT: Inducing Overthinking in LLMs via Black-Box Iterative Optimizationcited by 11
  6. 2025ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checkingcited by 10
  7. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surfacecited by 8
  8. 2026When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAGcited by 4
  9. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarkscited by 4
  10. 2025Through the Stealth Lens: Attention-Aware Defenses Against Poisoning in RAGcited by 3
  11. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3
  12. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systemscited by 2
24 more
  1. 2026Distributed Denial of Science: How Indirect Data Poisoning of AI Systems Can Industrialize Scientific Fraudcited by 2
  2. 2025Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractorscited by 1
  3. 2026Retrieval Pivot Attacks in Hybrid RAG: Measuring and Mitigating Amplified Leakage from Vector Seeds to Graph Expansioncited by 1
  4. 2026ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Coveringcited by 1
  5. 2026RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systemscited by 1
  6. 2026Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Controlcited by 1
  7. 2026SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoningcited by 1
  8. 2026DiscourseFlip: An Oblique Discourse-Level Opinion Manipulation Attack against Black-box Retrieval-Augmented Generationcited by 1
  9. 2026A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAGcited by 1
  10. 2025Provably Secure Retrieval-Augmented Generationcited by 0
  11. 2025Highlight & Summarize: RAG without the jailbreakscited by 0
  12. 2026Hidden in the Metadata: Stealth Poisoning Attacks on Multimodal Retrieval-Augmented Generationcited by 0
  13. 2026Adaptive Defense Orchestration for RAG: A Sentinel-Strategist Architecture against Multi-Vector Attackscited by 0
  14. 2026From Clouds to Hallucinations: Atmospheric Retrieval Hijacking in Remote Sensing Vision-Language RAGcited by 0
  15. 2026Influence Factors on RAG Poisoningcited by 0
  16. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systemscited by 0
  17. 2026Fixed-Set Robustness in Programming by Example: Example Corruption and Semantic Partition Recoverycited by 0
  18. 2026Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerabilitycited by 0
  19. 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
  20. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denialcited by 0
  21. 2026Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injectioncited by 0
  22. 2026Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputscited by 0
  23. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  24. 2026RAGStress: A controlled benchmark for evaluating retrieval-augmented generation under knowledge-base degradationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
  2. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
  3. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation
  4. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
  5. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
  6. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
  7. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  8. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems