Logic hijacking weakens retrieval augmented generation with single document attacks
Logic Hijacking of RAG: Single-Document Poisoning via Local Optimization
Artificial Intelligence
Summary
Retrieval-Augmented Generation (RAG) helps AI models find and use information from documents to answer questions. The authors show that it is possible to trick these systems using just one poisoned document, without directly denying facts. Instead, their method cleverly inserts updated but false information that looks like a recent correction to true history. This makes the AI believe the false update is real, without triggering obvious warning signals that normally protect against attacks.
What this means in practice
- •For security engineers: Design defenses against subtle data poisoning attacks on AI systems that rely on document retrieval for generating answers.
- •For document management teams: Improve document validation and audit processes to detect sophisticated record-correction style manipulations that alter retrievable knowledge.
Authors
Hangyi Zhao, Bonan Zhang, Fusen Guo, Jiaheng Wei, Chao Chen, Tianqing Zhu
Abstract
Single-document corpus poisoning under black-box access poses a severe threat to Retrieval-Augmented Generation (RAG). However, existing attacks predominantly rely on explicit factual refutations or imperative instruction overrides. Modern aligned LLMs often arbitrate such conflicts conservatively, rejecting overt contradictions in favor of parametric memory or clean retrieved context while triggering input guardrails. We propose MONOLOGUE, a single-document poisoning framework based on Logic Hijacking without explicit refutation. Rather than disputing the ground truth, our method concedes it as an authoritative historical baseline before introducing the update, weaving a grounded record-correction narrative (e.g., dated institutional reattributions) that presents the counterfactual target as the most recent update. To prevent suspicious live writes, payloads are refined entirely offline via local multi-dimensional gated optimization, coupling automated text quality audits with surrogate behavioral verification. Evaluations across three benchmarks, three retrieval backends, and four open-weight generator regimes show that our method achieves the strongest overall attack efficacy among the evaluated single-document poisoning attacks.