Rag attacks show new risks from retrieval aware poisoning
RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
Artificial Intelligence
Summary
Retrieval augmented generation (RAG) systems use external knowledge to help large language models give accurate answers. The authors found a new kind of attack that tricks these systems by creating fake documents that specifically mention and discredit real sources the system would use. This method, called RAG-NAROK, adapts the false information based on what the system retrieves for each question, making the attack more effective than older approaches that did not consider the system’s retrieved context. The work reveals a security weakness tied to how transparent and query-aware these systems are.
What this means in practice
- •For security engineers: Detect and defend against advanced poisoning attacks targeting retrieval-augmented language models to protect AI-powered information services.
- •For ai system developers: Design retrieval pipelines that minimize the impact of source-specific refutation attacks by managing transparency and source treatment in RAG architectures.
Authors
Abdullahil Kafi, Alvi Ataur Khalil
Abstract
Retrieval augmented generation (RAG) systems have emerged as the dominant architecture for grounding large language model (LLM) outputs in verifiable external knowledge, yet their structural reliance on a dynamic retrieval pipeline introduces a largely unexplored class of adversarial vulnerability. Existing knowledge-base poisoning attacks are fundamentally static. Adversarial documents are pre-computed and injected without any awareness of what the victim system will actually retrieve for a given query, leaving the attack blind to the competitive documentary landscape that surrounds its payload in the generator's context window. Unlike traditional static poisoning attacks that are blind to the retrieved context, we introduce RAG-NAROK (Retrieval-Anchored Generation Negation And Response Quality Collapse), a RAG attack framework that adapts to the query text. RAG-NAROK exploits the transparency inherent in RAG pipeline to first extract the legitimate source identities, then generate Anchor-Specific Refutation documents that explicitly name and devalue retrieved sources while leveraging recency and authority biases to steer the text generation toward a target answer. Our results demonstrate that RAG-NAROK significantly outperforms static baselines across diverse domains, revealing a fundamental tension between RAG transparency and AI security.