mlsanityData to 14 Oct 2026

PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates

arXiv 2608.04756 ↗First posted 5 Aug 2026cs.CR cs.AIcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

In Retrieval-Augmented Generation (RAG), post-retrieval conflict resolution arbitrates among noisy or contradictory retrieved passages. However, the robustness of this safeguard against knowledge poisoning has not been adequately studied. Existing black-box poisoning methods all assert the target answer in frontal contradiction with what the resolver treats as settled, the very signal these methods are built to detect. We propose PURPOSE, a strict black-box poisoning attack that reframes the injection as an update that minimizes conflict, rather than as a counter-claim. PURPOSE extracts query-related facts approximating the resolver's possible reference, then grounds a pivot event in them to keep the injection consistent with what the resolver might verify while steering the generator toward the target answer. Across three QA benchmarks, five generators, and three conflict-resolution methods, PURPOSE attains the highest attack success rate (ASR) in 35 of 45 settings and exceeds the strongest prior attack with +9.7 mean ASR points. These results show that our poisoning method is effective against conflict resolution in RAG and identify non-contradicting injection as a practical mode to enhance poisoning attack.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 34 of its 42 references that are in the map. First posted on arXiv 5 Aug 2026.

Builds on

34 of 42 references.

Closest ancestors · 8

Same direction, newest first

  1. 2026Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning7 May
  2. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
  3. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimization10 Apr
  4. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
  5. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  6. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  7. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  8. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr

Other references · 26

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  4. 2023Lost in the Middle: How Language Models Use Long Contextscited by 3,455
  5. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
  6. 2019Language Models as Knowledge Bases?cited by 1,936
  7. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
  8. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  9. 2022When Not to Trust Language Models: Investigating Effectiveness of Parametric and Non-Parametric Memoriescited by 1,128
  10. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 849
  11. 2023Making Retrieval-Augmented Language Models Robust to Irrelevant Contextcited by 369
  12. 2023Adaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflictscited by 341
14 more
  1. 2024Knowledge Conflicts for LLMs: A Surveycited by 283
  2. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 159
  3. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 101
  4. 2024Tug-of-War Between Knowledge: Exploring and Resolving Knowledge Conflicts in Retrieval-Augmented Language Modelscited by 93
  5. 2025Retrieval-Augmented Generation with Conflicting Evidencecited by 63
  6. 2024Context-DPO: Aligning Language Models for Context-Faithfulnesscited by 50
  7. 2025Parameters vs. Context: Fine-Grained Control of Knowledge Reliance in Language Modelscited by 39
  8. 2024RAGAR, Your Falsehood Radar: RAG-Augmented Reasoning for Political Fact-Checking using Multimodal Large Language Modelscited by 27
  9. 2024KnowPO: Knowledge-aware Preference Optimization for Controllable Knowledge Selection in Retrieval-Augmented Language Modelscited by 20
  10. 2025ArgRAG: Explainable Retrieval Augmented Generation using Quantitative Bipolar Argumentationcited by 12
  11. 2025TruthfulRAG: Resolving Factual-level Conflicts in Retrieval-Augmented Generation with Knowledge Graphscited by 12
  12. 2025LegalWiz: A Multi-Agent Generation Framework for Contradiction Detection in Legal Documentscited by 7
  13. 2025LLM-based Corroborating and Refuting Evidence Retrieval for Scientific Claim Verificationcited by 5
  14. 2025HealthContradict: Evaluating Biomedical Knowledge Conflicts in Language Modelscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation
  2. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  3. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks
  4. 2026Influence Factors on RAG Poisoning
  5. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation
  6. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
  7. 2026Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control
  8. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems