mlsanityData to 7 Oct 2026

A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAG

arXiv 2607.03739 ↗First posted 4 Jul 2026cs.CR cs.AI cs.CLcited by 1

Not on the map. Why?

Abstract (arXiv)

We release a benchmark and failure-mode-aware evaluation framework for grounded QA under coordinated retrieval poisoning. The framework partitions reader outputs into four mutually exclusive categories (gold, hijack, abstention, drift), with instance-level paired clean-to-poison transition matrices and a Forced Exposure protocol isolating reader-side conflict resolution from retrieval variance. We introduce polymorphic sybil poisoning, a coordinated attack class in which S lexically diverse passages jointly support an attacker-chosen target while evading lexical near-duplicate filters that fully detect monomorphic baselines (capturing the residual 14.2% with E5 cosine raises false-positive rate 9× on legitimate same-topic pairs). A monomorphic-polymorphic ablation under Forced Exposure isolates the diversity dimension and reveals a +18.8pp hijack amplification (95% paired bootstrap CI [+15.4, +22.4], B=5,000): monomorphic copies register only 4.0% as hijack while polymorphic surface diversity recovers 22.8% -- a 5.7× amplification of the ASR-visible attack channel. ASR alone treats every non-target output identically; under attack, abstention and drift together hold 47-66% of output mass, unmonitored by ASR+ACC, and two readers at nearly identical ASR (within 0.2pp) differ by 16.5pp on abstention and 17.2pp on drift -- failure profiles invisible to ASR. We release the frozen benchmark (3,145 questions, 2,982 retained sybil groups; S=6 chosen to dominate top-10 retrieval slots, Srefsec:setup), the official four-way evaluator, paired-transition utilities, and the Forced Exposure harness across five readers (7B-120B), two retrievers, and two cross-validation datasets (TriviaQA, 2Wiki), under CC~BY-SA~4.0 (data) and MIT (software); release information in Srefsec:release.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 18 of its 19 references that are in the map. First posted on arXiv 4 Jul 2026.

Builds on

18 of 19 references.

References · 18

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  4. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,895
  5. 2020Constructing A Multi-hop QA Dataset for Comprehensive Evaluation of Reasoning Stepscited by 1,259
  6. 2022Text Embeddings by Weakly-Supervised Contrastive Pre-trainingcited by 1,216
  7. 2019Latent Retrieval for Weakly Supervised Open Domain Question Answeringcited by 691
  8. 2021ColBERTv2: Effective and Efficient Retrieval via Lightweight Late Interactioncited by 464
  9. 2023Benchmarking Large Language Models in Retrieval-Augmented Generationcited by 307
  10. 2024Don't Hallucinate, Abstain: Identifying LLM Knowledge Gaps via Multi-LLM Collaborationcited by 176
  11. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  12. 2024ClashEval: Quantifying the tug-of-war between an LLM's internal prior and external evidencecited by 109
6 more
  1. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 84
  2. 2024RAGChecker: A Fine-grained Framework for Diagnosing Retrieval-Augmented Generationcited by 59
  3. 2024Do LLMs Know When to NOT Answer? Investigating Abstention Abilities of Large Language Modelscited by 55
  4. 2025Practical Poisoning Attacks against Retrieval-Augmented Generationcited by 35
  5. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Modelcited by 31
  6. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generationcited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Epistemic Sybil Resistance: Multiplying AI Agents Without Multiplying Evidencecited by 2

Similar, not cited

Close in wording, no citation either way

  1. 2026PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates
  2. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
  3. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems
  4. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
  5. 2026Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
  6. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
  7. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  8. 2026When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelines