Influence Factors on RAG Poisoning
On the map: Retrieval-augmented generation → Privacy and security of RAG
Abstract (arXiv)
Retrieval-Augmented Generation (RAG) systems enhance large language models by grounding responses in retrieved documents from external knowledge sources at inference time. However, this reliance on retrieved content introduces vulnerabilities to poisoning attacks, in which adversarial documents can manipulate both the retrieval process and the generated outputs. This paper investigates poisoning robustness in RAG through a full factorial experimental study covering 432 configurations. We analyze the impacts of dataset, retriever type, retrieval depth, database composition, chunking strategy, and generator model on retrieval-level and generation-level metrics. The results show that retriever architecture, dataset, and retrieval depth are the strongest factors affecting poisoning exposure, while generator choice and database composition have a major impact on downstream attack success. Dense and graph-based retrievers generally improve robustness relative to BM25, whereas larger retrieval depth increases the likelihood of retrieving poisoned passages. We further show that replicating poisoned content across multiple databases amplifies adversarial influence, while additional clean sources can mitigate it. These findings highlight that poisoning vulnerability in RAG is not attributable to a single component, but instead arises from the interaction of retrieval, generation, and knowledge-base configuration.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 14 of its 18 references that are in the map. First posted on arXiv 9 Jun 2026.
Builds on
14 of 18 references.
Closest ancestors · 7
Same direction, newest first
- 2025DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)27 Aug
- 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation4 Aug
- 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
- 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
- 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model28 Jan
- 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
- 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb
Other references · 7
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
- 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
- 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
- 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
- 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
- 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 786
- 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 450
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
- 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
- 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems
- 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
- 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation
- 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation
- 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
- 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models