Practical Poisoning Attacks against Retrieval-Augmented Generation

2025/04/04 by Zhang, Baolei, Chen, Yuxi, Fang, Minghong +4 · 10 citations
#Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information Retrieval (cs.IR) #Machine Learning (cs.LG)

paper · doi:10.48550/arxiv.2504.03957

Abstract

Large language models (LLMs) have demonstrated impressive natural language processing abilities but face challenges such as hallucination and outdated knowledge. Retrieval-Augmented Generation (RAG) has emerged as a state-of-the-art approach to mitigate these issues. While RAG enhances LLM outputs, it remains vulnerable to poisoning attacks. Recent studies show that injecting poisoned text into the knowledge database can compromise RAG systems, but most existing attacks assume that the attacker can insert a sufficient number of poisoned texts per query to outnumber correct-answer texts in retrieval, an assumption that is often unrealistic. To address this limitation, we propose CorruptRAG, a practical poisoning attack against RAG systems in which the attacker injects only a single poisoned text, enhancing both feasibility and stealth. Extensive experiments across multiple datasets demonstrate that CorruptRAG achieves higher attack success rates compared to existing baselines.

Cited by

• TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
• MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval
• Secure Retrieval-Augmented Generation against Poisoning Attacks
• ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking
• SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAG
• Eyes-on-Me: Scalable RAG Poisoning through Transferable Attention-Steering Attractors
• RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
• UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generation
• Highlight & Summarize: RAG without the jailbreaks
• Provably Secure Retrieval-Augmented Generation

Related

• PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
• Traceback of Poisoning Attacks to Retrieval-Augmented Generation
• Secure Retrieval-Augmented Generation against Poisoning Attacks
• POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
• One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems