RAGOrigin: Poisoned Text Attribution

• RAGOrigin is a black-box framework that precisely attributes malicious texts responsible for poisoned responses in Retrieval-Augmented Generation systems.
• It employs an adaptive, event-specific attribution scope that iteratively expands beyond the top-K retrieved passages to capture influential texts.
• By integrating embedding similarity, semantic correlation, and generation influence into unsupervised clustering, it isolates texts that trigger targeted poisoning attacks.

RAGOrigin is a black-box responsibility attribution framework for poisoned knowledge in Retrieval-Augmented Generation (RAG). It addresses a post-attack question: when a RAG system produces a poisoned or misleading answer, which text or texts in the external knowledge base are responsible for that generation (Zhang et al., 17 Sep 2025). The framework is designed for operational forensics rather than prevention. Its purpose is to localize the texts that caused a misgeneration so they can be removed, audited, or traced, a need made concrete by prior work showing that poisoning only a small number of corpus passages can strongly steer downstream RAG behavior without modifying LLM weights (Xue et al., 2024).

1. Conceptual role in the RAG security landscape

RAGOrigin is situated in the integrity and provenance layer of RAG security. Standard RAG systems combine a knowledge database, a retriever, and a generator; this architecture improves groundedness, but it also creates a distinct attack surface at the retrieval corpus itself (Zhang et al., 17 Sep 2025). In the poisoning setting, an attacker inserts malicious texts into the database so that, for targeted questions, the retriever surfaces adversarial content and the generator conditions on it. BadRAG showed that poisoning 10 adversarial passages could induce a 98.2\% success rate for retrieving adversarial passages, raising the reject ratio of RAG-based GPT-4 from 0.01\% to 74.6\% and the rate of negative responses from 0.22\% to 72\% on targeted queries (Xue et al., 2024).

This makes attribution distinct from prevention. RAGOrigin does not attempt to harden the retriever or generator before deployment. Instead, it assumes a misgeneration has already occurred and asks which texts in the database “taught” that lie (Zhang et al., 17 Sep 2025). This post-incident orientation complements broader threat modeling work that formalizes poisoning as a retrieval-layer integrity attack and treats the external knowledge base as a first-class security boundary in RAG systems (Arzanipour et al., 24 Sep 2025).

The framework’s central premise is that a responsible poisoned text should exhibit two properties simultaneously. First, it must be retrievable for the triggering question. Second, once retrieved, it must increase the probability of the observed incorrect response. RAGOrigin operationalizes both properties in a black-box setting, without requiring access to retriever internals, LLM parameters, or gradients (Zhang et al., 17 Sep 2025).

2. Formal problem setting and threat model

RAGOrigin takes as input a misgeneration event

$\varepsilon = (q, r),$

where $q$ is the user question and $r$ is the incorrect response produced by the RAG system (Zhang et al., 17 Sep 2025). This event-conditioned formulation is important: attribution is not global over the whole system, but specific to a concrete erroneous generation.

The poisoning objective that motivates the framework is stated as

$$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$

subject to

$$\mathcal{R}(\mathcal{D} \cup \{h\}, K) = \underset{\substack{S \subseteq \mathcal{D} \cup \{h\}, \ |S| = K}}{\arg\max} \sum_{s \in S} \text{sim}(E(q), E(s)).$$

Here $h$ is a poisoned text, $\mathcal{D}$ is the database, $\mathcal{R}$ is the retriever, $E(\cdot)$ is the embedding function, $\text{sim}(\cdot)$ is the retriever similarity, and $q$0 is the attacker-chosen target answer (Zhang et al., 17 Sep 2025). The formulation captures the dual retrieval-generation nature of poisoning: the poisoned text must both rank highly and steer generation.

RAGOrigin is explicitly black-box. The attacker may poison the knowledge database, but the attribution system itself does not assume access to retriever weights, generator parameters, or gradients. It assumes access to the poisoned database, the misgeneration event, and the same retriever or embedding interface and similarity metric used by the deployed RAG system (Zhang et al., 17 Sep 2025). This makes the method compatible with practical deployments where only inference-time interfaces are available. The design also aligns with broader formalizations of RAG security that distinguish black-box and white-box adversaries and treat poisoning as an attack on the external knowledge layer rather than only on model parameters (Arzanipour et al., 24 Sep 2025).

3. Adaptive attribution scope construction

A naive attribution procedure would score every text in the database, but poisoned texts are sparse and the database may contain millions of entries. RAGOrigin therefore first constructs an event-specific attribution scope $q$1, where $q$2 is the poisoned database (Zhang et al., 17 Sep 2025).

The procedure begins by ranking all texts by retriever similarity to the triggering question:

$q$3

This produces a ranked database $q$4. The ranked texts are then partitioned into contiguous groups of size $q$5, where $q$6 is the retriever top-$q$7 used by the target RAG system. At iteration $q$8, the segment is

$q$9

RAGOrigin does not stop at the original top-$r$0 retrieved texts. Instead, it iteratively expands the scope segment by segment and tests whether each segment, when provided to the LLM with question $r$1, reproduces the observed incorrect response $r$2. Because LLM outputs are stochastic, an external judgment LLM is used to determine whether the generated response matches the reported misgeneration (Zhang et al., 17 Sep 2025).

The stopping rule is event-conditioned. Expansion continues until at least half of the tested segments fail to reproduce the bad response. The paper writes this condition as

$r$3

This adaptive scope is not only an efficiency mechanism. It is also a recall mechanism: poisoned texts may reside outside the first retrieved block, and restricting attribution to the fixed top-$r$4 severely degrades performance on some attacks (Zhang et al., 17 Sep 2025).

Algorithmically, the method is simple. It initializes $r$5, ranks the database by similarity to $r$6, adds ranked blocks of size $r$7 to $r$8, and stops when the matching criterion above is satisfied. The result is a focused candidate set tailored to the specific misgeneration event.

4. Responsibility scoring and poisoned-text identification

Within the attribution scope, RAGOrigin assigns each candidate text a responsibility score by combining three signals: embedding similarity, semantic correlation, and generation influence (Zhang et al., 17 Sep 2025). The three signals target complementary aspects of poison behavior.

Component	Definition	Role
Embedding Similarity	$r$9	Retrieval affinity
Semantic Correlation	LM log-probability of question conditioned on context	Semantic relevance
Generation Characteristic	LM log-probability of incorrect response conditioned on context	Response influence

The first signal is the retrieval-side score

$$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$0

A poisoned text typically needs high retriever-space similarity to reach the generator, so this is a necessary indicator, but not a sufficient one, because benign texts may also rank highly (Zhang et al., 17 Sep 2025).

The second signal, semantic correlation, uses a proxy LLM and the prompt “Below is a query from a user and a relevant context. Answer the question given the information in the context.” If the tokenized prompt is

$$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$1

where $$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$2 are the tokens of $$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$3, then

$$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$4

This measures how well the context $$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$5 semantically supports the question (Zhang et al., 17 Sep 2025).

The third signal, generation characteristic, is the most directly causal. Using a prompt that includes the incorrect response as the answer field, and a tokenization

$$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$6

where $$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$7 are the tokens of $$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$8, the score is

$$\max_{h} \ \mathbb{P}_{\text{LLM}}(t \mid q, \mathcal{R}(\mathcal{D}\cup \{h\},K)),$$9

If a text truly induced the misgeneration, then conditioning on that text should increase the likelihood of the observed incorrect response (Zhang et al., 17 Sep 2025).

Because these three quantities live on different scales, RAGOrigin standardizes them with $$\mathcal{R}(\mathcal{D} \cup \{h\}, K) = \underset{\substack{S \subseteq \mathcal{D} \cup \{h\}, \ |S| = K}}{\arg\max} \sum_{s \in S} \text{sim}(E(q), E(s)).$$0-score normalization over the attribution scope and computes the final responsibility score as their mean:

$$\mathcal{R}(\mathcal{D} \cup \{h\}, K) = \underset{\substack{S \subseteq \mathcal{D} \cup \{h\}, \ |S| = K}}{\arg\max} \sum_{s \in S} \text{sim}(E(q), E(s)).$$1

The framework then performs $$\mathcal{R}(\mathcal{D} \cup \{h\}, K) = \underset{\substack{S \subseteq \mathcal{D} \cup \{h\}, \ |S| = K}}{\arg\max} \sum_{s \in S} \text{sim}(E(q), E(s)).$$2-means clustering with $$\mathcal{R}(\mathcal{D} \cup \{h\}, K) = \underset{\substack{S \subseteq \mathcal{D} \cup \{h\}, \ |S| = K}}{\arg\max} \sum_{s \in S} \text{sim}(E(q), E(s)).$$3 over the responsibility scores and labels the cluster with the higher average score as poisoned (Zhang et al., 17 Sep 2025). This unsupervised step replaces a fixed threshold with an event-specific dynamic split, which is better suited to unknown poisoning volume and heterogeneous attacks.

This design is deliberately multi-dimensional. Embedding similarity alone can miss texts that are not maximally optimized in retriever space; semantic correlation alone does not capture causal push toward the bad answer; generation influence alone can weaken under some prompt-adaptive settings. Their combination raises the attacker’s burden across retrieval and generation simultaneously (Zhang et al., 17 Sep 2025).

5. Empirical evaluation, robustness, and operational profile

RAGOrigin is evaluated across seven datasets and fifteen poisoning attacks, including adaptive poisoning strategies and multi-attacker scenarios (Zhang et al., 17 Sep 2025). The default large-scale QA datasets are Natural Questions, HotpotQA, MS MARCO, BoolQ, and SQuAD; additional evaluations use a 16.7 million text combined knowledge base and ELI5 (Zhang et al., 17 Sep 2025). The default RAG stack uses FlashRAG, E5-base-v2 as retriever, cosine similarity, top-$$\mathcal{R}(\mathcal{D} \cup \{h\}, K) = \underset{\substack{S \subseteq \mathcal{D} \cup \{h\}, \ |S| = K}}{\arg\max} \sum_{s \in S} \text{sim}(E(q), E(s)).$$4, and GPT-4o-mini as generator (Zhang et al., 17 Sep 2025).

The attack suite includes targeted-answer attacks such as PRAGB, PRAGW, ProInject, HijackRAG, and LIAR, along with denial or refusal attacks such as Jamming, BadRAG, Phantom, and AgentPoison (Zhang et al., 17 Sep 2025). The evaluation metrics are detection accuracy (DACC), false positive rate (FPR), false negative rate (FNR), and attack success rate (ASR). On the five main datasets, RAGOrigin typically achieves DACC in the range 0.98–1.00 with FPR 0.00–0.03 and FNR 0.00–0.01, while substantially outperforming baselines such as Norm, PPL, SELF-RAG, RobustRAG, PFDNN, and RAGForensics, especially on denial-style attacks (Zhang et al., 17 Sep 2025).

A central operational result is removal effectiveness. After removing the texts identified by RAGOrigin, ASR drops essentially to zero across almost all evaluated settings, whereas RAGForensics leaves substantial residual attack success in several denial-style scenarios (Zhang et al., 17 Sep 2025). This suggests that the framework is not merely identifying semantically suspicious texts; it is isolating texts that are causally responsible for the observed misgeneration.

The robustness analysis is unusually broad. The framework remains near-perfect under paraphrased target questions, different retrievers, different similarity metrics, different generator LLMs, different judgment LLMs, and different proxy LLMs for semantic and generation scoring (Zhang et al., 17 Sep 2025). It also remains strong under adaptive attacks designed specifically to evade attribution, multihop attacks, adaptive prompt injection attacks, dynamic numbers of poisoned texts, multi-attacker settings, noisy user-reported responses, and dynamic databases with new relevant texts added after the misgeneration but before attribution (Zhang et al., 17 Sep 2025).

The method is also lightweight enough for deployment. On a machine with 8 NVIDIA A800 GPUs and 64 AMD EPYC CPUs, RAGOrigin takes at most 2.11 seconds per misgeneration event, even on MS MARCO with over 8.5 million texts, and the per-event monetary cost using GPT-4o-mini is at most $0.0004 (Zhang et al., 17 Sep 2025).

6. Relation to provenance, limitations, and broader significance

RAGOrigin reframes provenance in RAG as an event-conditioned forensic problem. Earlier poisoning work had already shown that a system can appear grounded because it cites retrieved passages, while the retrieved source itself has been maliciously planted or optimized to trigger on a semantic region of query space (Xue et al., 2024). Broader RAG security work formalized this as a distinct integrity threat introduced by externalized, mutable knowledge bases (Arzanipour et al., 24 Sep 2025). RAGOrigin operationalizes a concrete response: after a bad generation is reported, identify the texts responsible and remove them.

This post-attack capability does not eliminate the need for preventive defenses, corpus curation, or provenance-aware retrieval. Rather, it supplies a missing recovery mechanism. A plausible implication is that RAG systems need both ex ante defenses and ex post observability. In practice, prevention can fail, especially under adaptive or sophisticated attacks, and attribution then becomes necessary for root-cause analysis and database cleanup (Zhang et al., 17 Sep 2025).

The framework nevertheless has clear limitations. It assumes honest user reports of misgeneration events, so false-flag reporting could induce removal of benign texts; the authors recommend human-in-the-loop verification (Zhang et al., 17 Sep 2025). It is currently designed for single-turn dialogue rather than multi-turn conversational history. It focuses on targeted poisoning, not non-targeted poisoning. It also presumes access to the database and the same retriever or embedding interface used by the deployed RAG system, even though it does not require deeper white-box access (Zhang et al., 17 Sep 2025).

The paper additionally notes a simple filter for distinguishing benign misgeneration events from poisoning-induced ones: directly ask the LLM the reported question and compare its output to the reported incorrect response. This simple approach identifies 97\% of benign misgeneration events in the reported analysis (Zhang et al., 17 Sep 2025). This suggests that the attribution framework is most valuable once the incident has already been localized to the retrieval-origin channel.

In the broader development of RAG, RAGOrigin marks a shift from viewing retrieved context as inherently trust-amplifying to treating it as an auditable, potentially compromised evidence channel. Its significance lies less in changing the architecture of RAG than in changing its operational security model: a grounded answer is not trustworthy merely because it came from retrieval; the origin of retrieved knowledge itself must be attributable, inspectable, and, when necessary, removable (Zhang et al., 17 Sep 2025).