Micro collaborative poisoning weakens retrieval augmented generation safety
Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
Cryptography and SecurityArtificial Intelligence
Summary
Retrieval-Augmented Generation (RAG) is a way to make large language models more accurate by letting them check information from other documents. The authors found a new kind of attack called Micro-Collaborative Poisoning where false information is hidden across many innocent-looking documents instead of one obvious bad one. This makes it hard to detect because the false information adds up only after the model gathers several documents. They tested many setups and showed that better retrievers and more varied clean data can reduce this problem, but it remains a tricky security threat.
What this means in practice
- •For ai system developers: Detect vulnerabilities in retrieval-augmented generation systems by testing for widely distributed false data signals across retrieved documents.
- •For data platform administrators: Design data curation and retriever strategies that maintain diverse and clean document collections to reduce poisoning risk in RAG systems.
Authors
Pedro Pereira, Eva Maia, Isabel Praça
Abstract
Retrieval-Augmented Generation (RAG) improves large language models by grounding outputs in external knowledge sources, but this dependency also creates a surface for poisoning attacks. This paper introduces Micro-Collaborative Poisoning, a distributed attack in which a false target claim is divided across multiple locally plausible documents instead of being concentrated in a single malicious passage. We evaluate the attack across 108 RAG configurations by varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. The results indicate that Micro-Collaborative Poisoning is not driven by a single dominant poisoned passage, but by the accumulation of weak adversarial signals across retrieved sources. Increasing top-$k$ and poisoning multiple databases make it more likely that these signals will appear together in the retrieved context, while clean database diversity and stronger retrievers can reduce their influence. The document-level poisoning visibility analysis further shows that this threat is difficult to expose through isolated document inspection, since Micro-Collaborative Poisoning achieves downstream influence while leaving a weaker explicit poisoning signature than direct poisoning.