Papers for

data platform administrators

Papers whose findings have a practical use for this group, as judged from the abstract. Open a paper to read what it means in practice.

Micro collaborative poisoning weakens retrieval augmented generation safety

Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems

Abstract: Retrieval-Augmented Generation (RAG) improves large language models by grounding outputs in external knowledge sources, but this dependency also creates a surface for poisoning attacks. This paper introduces Micro-Collaborative Poisoning, a distributed attack in which a false target claim is divided across multiple locally plausible documents instead of being concentrated in a single malicious passage. We evaluate the attack across 108 RAG configurations by varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. The results indicate that Micro-Collaborative Poisoning is not driven by a single dominant poisoned passage, but by the accumulation of weak adversarial signals across retrieved sources. Increasing top-$k$ and poisoning multiple databases make it more likely that these signals will appear together in the retrieved context, while clean database diversity and stronger retrievers can reduce their influence. The document-level poisoning visibility analysis further shows that this threat is difficult to expose through isolated document inspection, since Micro-Collaborative Poisoning achieves downstream influence while leaving a weaker explicit poisoning signature than direct poisoning.

Fri 18 SeptCryptography and SecurityArtificial Intelligence
The gist
Retrieval-Augmented Generation (RAG) is a way to make large language models more accurate by letting them check information from other documents. The authors found a new kind of attack called Micro-Collaborative Poisoning where false information is hidden across many innocent-looking documents instead of one obvious bad one. This makes it hard to detect because the false information adds up only after the model gathers several documents. They tested many setups and showed that better retrievers and more varied clean data can reduce this problem, but it remains a tricky security threat.
Open → 2609.21573v1