PoisonedRAG: A RAG Corruption Attack

• PoisonedRAG is a targeted knowledge corruption attack on retrieval-augmented generation that manipulates retrieved evidence by injecting malicious texts.
• It divides malicious texts into a retrieval-oriented prefix and an answer-inducing suffix to maximize retrieval similarity and guide generation.
• Empirical results show up to 90% attack success with few injected texts, establishing it as a benchmark in RAG security research.

PoisonedRAG is a knowledge corruption attack on retrieval-augmented generation in which an attacker injects a few malicious texts into the knowledge database so that, for an attacker-chosen target question, the RAG system retrieves those texts and the LLM generates an attacker-chosen target answer (Zou et al., 2024). Introduced as the first knowledge corruption attack to RAG, it established the external knowledge database as a practical attack surface and later became a standard reference point for pre-retrieval knowledge-substrate corruption in RAG security taxonomies (Zou et al., 2024).

1. Concept and threat model

PoisonedRAG assumes a standard dense-retrieval pipeline in which a question encoder $f_Q$ maps a query $Q$ to an embedding, a text encoder $f_T$ maps each database text $T_i$ to an embedding, and retrieval uses a similarity score

$\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$

The retrieved evidence is

$$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$

and answer generation is represented as $LLM(Q, \mathcal{E}(Q; \mathcal D))$ (Zou et al., 2024).

The attack is targeted. The attacker selects one or more target questions $Q_1,\dots,Q_M$ and, for each, a target answer $R_i$. The poisoned texts are denoted $\Gamma=\{P_i^j\}$, where $Q$0 is the $Q$1-th poisoned text for target question $Q$2. The clean database is $Q$3. The attacker’s optimization objective is

$Q$4

subject to

$Q$5

This formalizes PoisonedRAG as a corpus-side attack on grounded generation rather than on model weights or user prompts (Zou et al., 2024).

The threat model is deliberately restrictive. The attacker cannot access the texts in the clean database, cannot access or query the victim LLM, and can inject only a small number $Q$6 of poisoned texts per target question. In the black-box setting, the attacker also lacks retriever parameters and cannot query the retriever directly. In the white-box setting, the attacker knows the retriever parameters $Q$7 and $Q$8, but still does not access the clean database or the victim LLM (Zou et al., 2024).

Later surveys classify PoisonedRAG as a retrieval poisoning or adversarial corpus injection benchmark centered on top-$Q$9 displacement and misinformation injection, and place it under pre-retrieval knowledge-substrate corruption rather than prompt-only manipulation (Palanisamy et al., 24 Jun 2026).

2. Attack formulation and poisoning workflow

Directly optimizing the full end-to-end objective is difficult because the attacker would need gradients through discrete retrieval and through a generator they usually cannot access. PoisonedRAG therefore decomposes the attack into two heuristic conditions. First, a poisoned text $f_T$0 should satisfy the retrieval condition $f_T$1. Second, it should satisfy an effectiveness condition: when used as context for the target question, it should cause the LLM to generate the target answer $f_T$2 (Zou et al., 2024).

Each poisoned text is written as

$f_T$3

where $f_T$4 is retrieval-oriented and $f_T$5 is generation-oriented. The $f_T$6 component is produced by an attacker-controlled LLM from a prompt of the form: “This is my question: [question]. This is my answer: [answer]. Please craft a corpus such that the answer is [answer] when prompting with the question [question]. Please limit the corpus to $f_T$7 words.” The attacker regenerates $f_T$8 up to $f_T$9 trials until the chosen LLM outputs the target answer when given the target question and $T_i$0 as context (Zou et al., 2024).

In the black-box solution, the paper sets

$T_i$1

so the final poisoned text is

$T_i$2

The rationale is that the target question is naturally highly similar to itself in retrieval space, while the fabricated supporting passage $T_i$3 preserves the target answer effect (Zou et al., 2024).

In the white-box solution, the attacker explicitly optimizes the retrieval-oriented prefix against the known retriever: $T_i$4 The paper uses HotFlip by default to optimize $T_i$5, and also notes an extended joint variant

$T_i$6

In practice, the resulting optimized prefixes can be semantically odd but highly effective at raising retriever similarity (Zou et al., 2024).

This decomposition—retrieval-oriented $T_i$7 plus answer-inducing $T_i$8—became one of the defining design patterns in subsequent RAG poisoning work. Later research explicitly described PoisonedRAG as a coarse-grained “Separate-and-Concatenate” strategy and used that framing as the basis for refinements and critiques (Wang et al., 8 Apr 2026).

3. Empirical behavior and attack efficacy

PoisonedRAG was evaluated on Natural Questions, HotpotQA, and MS-MARCO, with database sizes of 2,681,468, 5,233,329, and 8,841,823 texts, respectively. The main retrievers were Contriever, Contriever-ms, and ANCE, and the evaluated generators included PaLM 2, GPT-3.5-Turbo, GPT-4, LLaMA-2-7B, LLaMA-2-13B, Vicuna-7B, Vicuna-13B, and Vicuna-33B. The default setting used Contriever, top-$T_i$9, temperature $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$0, and $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$1 poisoned texts per target question (Zou et al., 2024).

Dataset	Database size	Reported ASR with $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$2
Natural Questions	2,681,468	$\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$3 to $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$4
HotpotQA	5,233,329	$\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$5 to $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$6
MS-MARCO	8,841,823	$\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$7 to $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$8

These results underpin the paper’s headline claim that PoisonedRAG can achieve a 90% attack success rate when injecting five malicious texts for each target question into a knowledge database with millions of texts (Zou et al., 2024).

Retrieval-side metrics were also strong. On Natural Questions, the retrieval F1 was $\mathcal{S}(Q, T_i)=Sim(f_{Q}(Q), f_{T}(T_i)).$9 for the black-box attack and $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$0 for the white-box attack; on HotpotQA, the retrieval F1 was $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$1 in both settings; on MS-MARCO, the retrieval F1 was $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$2 in black-box mode and $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$3 in white-box mode (Zou et al., 2024). The attack therefore works not by globally corrupting the corpus, but by making a tiny number of malicious passages dominate the top-$$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$4 evidence set for a target query.

Ablations clarified why the two-part construction matters. Using only $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$5 produced high retrieval F1 but very low attack success rate; using only $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$6 produced moderate attack success but weaker retrieval. The full $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$7 construction achieved the highest ASR, showing that retrieval manipulation alone is insufficient and answer-inducing content alone is insufficient (Zou et al., 2024).

The original paper also evaluated several defenses and found them inadequate. Paraphrasing reduced ASR but did not stop the attack; perplexity-based detection had unfavorable true-positive/false-positive trade-offs; duplicate-text filtering had essentially no effect; and knowledge expansion by increasing $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$8 only diluted poisoning partially, since the attack still achieved 41% ASR in black-box mode and 43% ASR in white-box mode on HotpotQA with $$\mathcal{E}(Q; \mathcal{D})=Retrieve(Q, f_Q, f_T, \mathcal{D}),$$9 and $LLM(Q, \mathcal{E}(Q; \mathcal D))$0 (Zou et al., 2024).

4. Successors and reformulations

Later work did not simply replicate PoisonedRAG; it repeatedly reinterpreted its assumptions and limits.

Direction	Representative paper	Stated shift
Source-poisoning realism	"The RAG Paradox" (Choi et al., 28 Feb 2025)	From internal corpus poisoning to poisoning public sources revealed by source transparency
Arbitrary-query compound attack	"PIDP-Attack" (Wang et al., 26 Mar 2026)	From targeted $LLM(Q, \mathcal{E}(Q; \mathcal D))$1-specific poisoning to universal query-time suffix plus poisoned passages
Query-agnostic end-to-end poisoning	"POISONCRAFT" (Shao et al., 10 May 2025)	From exact-query knowledge to shadow-query, retrieval-plus-generation optimization
Word-level refinement	"RefineRAG" (Wang et al., 8 Apr 2026)	From separate-and-concatenate to holistic word-level refinement
Agentic RAG poisoning	"KidnapRAG" (Choi et al., 1 Jul 2026)	From single-step evidence corruption to multi-step reasoning-chain hijacking

“The RAG Paradox” reframed deployed poisoning as a black-box source-poisoning problem created by source transparency. Its core claim is that publicly cited sources such as LinkedIn, Wikipedia, Reddit, Blogger, or arXiv reveal where an attacker should inject content, so the attack surface shifts from internal corpus access to poisoning publicly visible, uploadable source ecosystems (Choi et al., 28 Feb 2025). This suggests a broader operational reading of PoisonedRAG: the same attack logic persists even when the attacker never sees the internal corpus.

PIDP-Attack explicitly positioned PoisonedRAG as a strong but query-specific baseline and argued that requiring prior knowledge of the exact target question is a major practical limitation. It combined database poisoning with a universal injection suffix, improving attack success rates by 4% to 16% on Natural Questions and 5% to 12% on MS-MARCO relative to PoisonedRAG under matched settings, while keeping a small poison budget of $LLM(Q, \mathcal{E}(Q; \mathcal D))$2 passages and top-$LLM(Q, \mathcal{E}(Q; \mathcal D))$3 retrieval (Wang et al., 26 Mar 2026).

POISONCRAFT removed the need for exact target-query knowledge without modifying the user query at inference time. It constructed each poisoned document as

$LLM(Q, \mathcal{E}(Q; \mathcal D))$4

where $LLM(Q, \mathcal{E}(Q; \mathcal D))$5 steers generation, $LLM(Q, \mathcal{E}(Q; \mathcal D))$6 contains common high-frequency words from a shadow query set, and $LLM(Q, \mathcal{E}(Q; \mathcal D))$7 is a retriever-optimized adversarial suffix. With a poisoning ratio of $LLM(Q, \mathcal{E}(Q; \mathcal D))$8, it achieved on Natural Questions under GPT-4o-mini plus Contriever $LLM(Q, \mathcal{E}(Q; \mathcal D))$9 ASR-r and $Q_1,\dots,Q_M$0 ASR-t at top-5, and on HotpotQA $Q_1,\dots,Q_M$1 ASR-r and $Q_1,\dots,Q_M$2 ASR-t at top-5 (Shao et al., 10 May 2025).

RefineRAG directly criticized PoisonedRAG-style separate-and-concatenate attacks as coarse-grained and detectable. It replaced the $Q_1,\dots,Q_M$3 structure with “Macro Generation” to produce toxic seeds and “Micro Refinement” to optimize them via retriever-in-the-loop word-level substitutions. On Natural Questions it reported 90% ASR and lower grammar errors and repetition rates than PoisonedRAG baselines (Wang et al., 8 Apr 2026).

KidnapRAG then argued that PoisonedRAG’s one-shot retrieval logic does not transfer cleanly to Agentic RAG, where retrieval, reasoning, and action are interleaved. Its central claim is that in agentic systems the decisive vulnerability is not merely retrieving one poisoned document, but steering the sequence of retrieval intents through Bait, Chain-Link, and Mal-Ins documents so that the system leaves the user’s intended reasoning path (Choi et al., 1 Jul 2026).

5. Defenses, detection, and persistent weaknesses

Defense work after PoisonedRAG split into query-conditioned filtering, corpus sanitization, and retrieval-structure defenses.

FilterRAG and ML-FilterRAG defend specifically against PoisonedRAG by inserting a filtration phase between retrieval and generation. Their key statistic is Freq-Density,

$Q_1,\dots,Q_M$4

where $Q_1,\dots,Q_M$5 is a small-language-model output for query $Q_1,\dots,Q_M$6 and candidate document $Q_1,\dots,Q_M$7. FilterRAG uses a threshold $Q_1,\dots,Q_M$8, while ML-FilterRAG combines Freq-Density with perplexity, joint log probability, and semantic-frequency features. On MS-MARCO with GPT-4, ML-FilterRAG reduced ASR from $Q_1,\dots,Q_M$9 under PoisonedRAG to $R_i$0 while preserving accuracy at $R_i$1, compared with $R_i$2 for CleanRAG (Edemacu et al., 4 Aug 2025).

CleanBase moved defense upstream to the knowledge base itself. It builds a $R_i$3-nearest-neighbor similarity graph over documents, prunes edges above

$R_i$4

and detects cliques of highly similar documents. Its premise is that malicious documents crafted for the same target question often form dense semantic clusters. Averaged over datasets, CleanBase reported about 1.9% false positive rate, 5.7% false negative rate on PoisonedRAG-B, and reduced average ASR from 52.7% to 8.3% for PoisonedRAG-B and from 58.3% to 29.5% for PoisonedRAG-W (Jin et al., 1 May 2026). The paper also showed that adaptive attacks that diversify malicious documents or reduce them below clique size can substantially weaken this defense.

BiRD proposed a retrieval-structure defense rather than a semantic-content defense. For each forward-ranked document $R_i$5, it performs backward retrieval and computes a ranking-consistency signal $R_i$6 using Spearman correlation, then combines it with forward relevance $R_i$7 in the score

$R_i$8

Documents with $R_i$9 are retained. The paper reported that BiRD reduces the attack success rate of PoisonedRAG by up to 54% while simultaneously improving task accuracy by up to 56%, with average additional latency under 1 second (Gao et al., 19 May 2026).

These later defenses make a recurring point already visible in the original paper: simple paraphrasing, duplicate removal, and quality heuristics are insufficient when poisoning is retrieval-aware and semantically plausible. A common misconception is that poisoned RAG can be neutralized by removing only obviously malicious or low-quality text. The subsequent defense literature instead treats the problem as one of corpus integrity, query-conditioned filtering, or ranking-structure anomaly detection (Zou et al., 2024).

6. Generalizations and place in the RAG security landscape

Later surveys place PoisonedRAG at the center of RAG security taxonomies. “Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions” classifies it primarily as pre-retrieval knowledge-substrate corruption, specifically corpus/document poisoning, and argues that its importance comes from persistence, transferability across users, and the need for corpus-level remediation rather than prompt-level fixes (Xu et al., 9 Apr 2026). A second survey extends that framing across centralized, on-device, federated, and hybrid RAG, treating PoisonedRAG as an adversarial corpus injection benchmark for top-$\Gamma=\{P_i^j\}$0 displacement and misinformation injection (Palanisamy et al., 24 Jun 2026).

The concept also generalized beyond text-only, one-shot RAG. “Poisoned-MRAG” introduced the first knowledge poisoning attack on multimodal RAG by injecting a few malicious image-text pairs into a multimodal knowledge base. It achieved up to 98% ASR-G with just five malicious image-text pairs injected into the InfoSeek database of 481,782 pairs (Liu et al., 8 Mar 2025). MM-PoisonRAG similarly showed that localized poisoning can reach 56.8% attack success on MultiModalQA, while its globalized poisoning attack can reduce accuracy to 0% with a single irrelevant knowledge injection in the strongest setting (Ha et al., 25 Feb 2025).

Graph-based RAG prompted another reformulation. LogicPoison argued that classic PoisonedRAG-style corpus poisoning is not the right abstraction for GraphRAG because graph construction filters many direct text attacks and reasoning depends on topology. It therefore attacked type-preserving entity swaps that corrupt logical pathways rather than explicit content, and substantially outperformed PoisonedRAG on GraphRAG benchmarks such as HotpotQA, 2WikiMultihopQA, and MuSiQue (Xiao et al., 3 Apr 2026).

Agentic systems prompted a parallel rethinking. KidnapRAG maintained that once retrieval is embedded in an Observation–Thought–Action loop, the attack surface shifts from single-retrieval evidence corruption to reasoning-chain hijacking, so the PoisonedRAG assumption that one decisive retrieval event controls the outcome no longer holds (Choi et al., 1 Jul 2026).

Taken together, this later literature suggests that PoisonedRAG now names both a specific 2024 attack and a broader research lineage. In its original form, it is a targeted knowledge corruption attack on standard RAG. In the subsequent literature, it also functions as a baseline, a benchmark, and a conceptual template against which more realistic black-box source poisoning, arbitrary-query attacks, multimodal poisoning, graph-topology attacks, and agentic reasoning-chain hijacks are defined (Zou et al., 2024).