mlsanityData to 7 Oct 2026

One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems

arXiv 2505.11548 ↗First posted 15 May 2025cs.CR cs.AIcited by 28

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Large Language Models (LLMs) enhanced with Retrieval-Augmented Generation (RAG) have shown improved performance in generating accurate responses. However, the dependence on external knowledge bases introduces potential security vulnerabilities, particularly when these knowledge bases are publicly accessible and modifiable. While previous studies have exposed knowledge poisoning risks in RAG systems, existing attack methods suffer from critical limitations: they either require injecting multiple poisoned documents (resulting in poor stealthiness) or can only function effectively on simplistic queries (limiting real-world applicability). This paper reveals a more realistic knowledge poisoning attack against RAG systems that achieves successful attacks by poisoning only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. Our proposed AuthChain address three challenges to ensure the poisoned documents are reliably retrieved and trusted by the LLM, even against large knowledge bases and LLM's own knowledge. Extensive experiments across six popular LLMs demonstrate that AuthChain achieves significantly higher attack success rates while maintaining superior stealthiness against RAG defense mechanisms compared to state-of-the-art baselines.

Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 20 of its 42 references that are in the map. First posted on arXiv 15 May 2025.

Builds on

20 of 42 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  2. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun

Other references · 18

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  4. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  5. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  6. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  7. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  8. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  9. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  10. 2024Retrieval-Augmented Generation for AI-Generated Content: A Surveycited by 352
  11. 2020Overview of the TREC 2019 deep learning trackcited by 282
  12. 2023Evaluating ChatGPT's Information Extraction Capabilities: An Assessment of Performance, Explainability, Calibration, and Faithfulnesscited by 130
6 more
  1. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 100
  2. 2023Making LLMs Worth Every Penny: Resource-Limited Text Classification in Bankingcited by 36
  3. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 29
  4. 2023Opportunities for Retrieval and Tool Augmented Large Language Models in Scientific Facilitiescited by 27
  5. 2023QASiNa: Religious Domain Question Answering using Sirah Nabawiyahcited by 14
  6. 2025Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 25.

28 papers.

Sort:

By area:

  1. 2026Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injectionscited by 44
  2. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 17
  3. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 12
  4. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systemscited by 5
  5. 2025RAG-Pull: Turning Retrieval into a Code-Injection Channel via Invisible Unicode Perturbationscited by 4
  6. 2026When Safety Becomes a Vulnerability: Exploiting LLM Alignment Homogeneity for Transferable Blocking in RAGcited by 4
  7. 2026Addressing Corpus Knowledge Poisoning Attacks on RAG Using Sparse Attentioncited by 3
  8. 2026MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agentscited by 3
  9. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  10. 2026Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoningcited by 2
  11. 2026Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidencecited by 1
  12. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
16 more
  1. 2026FORGE: Research-Trajectory Hijacking Attacks on Deep Research Agentscited by 1
  2. 2026When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapsecited by 1
  3. 2026From Clouds to Hallucinations: Atmospheric Retrieval Hijacking in Remote Sensing Vision-Language RAGcited by 0
  4. 2026VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutationcited by 0
  5. 2026Influence Factors on RAG Poisoningcited by 0
  6. 2026Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attributioncited by 0
  7. 2026Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerabilitycited by 0
  8. 2026TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAGcited by 0
  9. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denialcited by 0
  10. 2026PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updatescited by 0
  11. 2026RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generationcited by 0
  12. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 0
  13. 2026ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attackscited by 0
  14. 2026Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agentscited by 0
  15. 2026Micro-Collaborative Poisoning: A Distributed Attack on RAG Systemscited by 0
  16. 2026Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
  2. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  3. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
  4. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
  5. 2025Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation
  6. 2026PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems
  7. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
  8. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems