mlsanityData to 14 Oct 2026

ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks

arXiv 2609.11082 ↗First posted 10 Sep 2026cs.CRcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) can ground large language model (LLM) outputs in external evidence, but it also exposes the system to knowledge poisoning. Representative attacks use multiple injected documents or templates that directly assert a target answer. We present ToxicRAG, a one-document-per-target attack that expresses misinformation as a coherent knowledge-update narrative. The generated document first acknowledges the previously accepted answer, introduces fabricated events that appear to invalidate it, and then attributes the attacker-selected answer to a set of purported authorities. An answer-focused self-validation loop optionally revises a candidate when a surrogate language model does not reproduce the target answer. We evaluate the attack on 100 target questions from each of Natural Questions, HotpotQA, and MS-MARCO, using four victim LLMs and four dense retrievers. In the sampled-corpus setting reported in this paper, ToxicRAG obtains ASRs between 0.61 and 0.91 across the twelve dataset--model combinations. It matches or exceeds the strongest evaluated baseline in every combination, with margins ranging from 0 to 11 percentage points. These results show that narrative-form poisoned documents can remain influential under the evaluated RAG configurations and motivate further study of factual consistency and source provenance in RAG systems.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 38 of its 43 references that are in the map. First posted on arXiv 10 Sep 2026.

Builds on

38 of 43 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks28 Oct
  2. 2025Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation17 Sep
  3. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models26 May
  4. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
  5. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation30 Apr
  6. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  7. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 31

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  4. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  5. 2022Survey of Hallucination in Natural Language Generationcited by 2,075
  6. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  7. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  9. 2021Improving language models by retrieving from trillions of tokenscited by 1,293
  10. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,252
  11. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  12. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
19 more
  1. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  2. 2023Active Retrieval Augmented Generationcited by 516
  3. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
  4. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  5. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 328
  6. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  7. 2020Overview of the TREC 2019 deep learning trackcited by 286
  8. 2023Poisoning Language Models During Instruction Tuningcited by 269
  9. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 183
  10. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstructioncited by 107
  11. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Modelscited by 106
  12. 2024CRAG -- Comprehensive RAG Benchmarkcited by 97
  13. 2024Evaluating Retrieval Quality in Retrieval-Augmented Generationcited by 90
  14. 2023Ignore This Title and HackAPrompt: Exposing Systemic Vulnerabilities of LLMs through a Global Scale Prompt Hacking Competitioncited by 68
  15. 2023Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injectioncited by 59
  16. 2023Making LLMs Worth Every Penny: Resource-Limited Text Classification in Bankingcited by 37
  17. 2023PromptCARE: Prompt Copyright Protection by Watermark Injection and Verificationcited by 32
  18. 2023RLHFPoison: Reward Poisoning Attack for Reinforcement Learning with Human Feedback in Large Language Modelscited by 32
  19. 2024PAPILLON: Efficient and Stealthy Fuzz Testing-Powered Jailbreaks for LLMscited by 21

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
  2. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
  3. 2026RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
  4. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  5. 2025CtrlRAG: Black-box Document Poisoning Attacks for Retrieval-Augmented Generation of Large Language Models
  6. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation
  7. 2026Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
  8. 2026TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning