PoisonedRAG: Five Bad Documents Hijack the Answer
You don't need to beat the whole corpus — just plant five documents that win the retrieval race.
| When | February 2024 |
|---|---|
| Target | RAG knowledge databases (8 LLMs incl. GPT-4) |
| Researchers | Zou, Geng, Wang, Jia |
| Technique | Corpus poisoning optimised for retrieval + generation |
| Impact | ~90% success with 5 injected texts per question in a million-doc corpus |
- 1An attacker crafts a few texts optimised to match a target question's retrieval
- 2They inject them into the RAG knowledge database
- 3For that question, the system retrieves them and returns the attacker's answer
What happened
In 2024, researchers introduced PoisonedRAG — the first knowledge-corruption attack on RAG. By injecting a small number of crafted texts into the knowledge database, a chosen target question yields an attacker-chosen answer. They reported ~90% attack success by injecting only 5 malicious texts per target question into a database of millions, and found tested defences (paraphrasing, perplexity filtering) insufficient.
How it works
Each injected text is optimised to satisfy two objectives at once: rank highly for the target question's retrieval similarity search, and steer the generator toward the attacker's answer once retrieved.
Root cause
Retrieved documents are trusted as context, and anyone able to add to the corpus can plant content that both gets retrieved and controls the answer.
Why it matters
Corpus size is no defence — five crafted documents suffice. Any RAG system that ingests user- or third-party-supplied content is exposed.
How to prevent it
- Control and review who/what can add to indexed corpora.
- Verify provenance of retrieved content; prefer trusted sources.
- Don't treat retrieved text as instructions to obey.
Feel it yourselfThe replay lab plants content that wins retrieval and steers the answer — the RAG-poisoning class.
FAQ
How does poisoning a knowledge base work?
Each injected text is optimised to do two things at once: win the retrieval similarity search (so it gets pulled into context) and steer the generator's answer. Five such texts per question was enough for ~90% success.
Isn't a corpus of millions safe by size?
No. The attack needs only ~5 crafted documents per targeted question regardless of corpus size — and tested defences (paraphrasing, perplexity filtering) were insufficient.
How do you defend RAG?
Control who can add to indexed corpora, verify provenance of retrieved content, and don't treat retrieved documents as trusted instructions.
Sources
- PoisonedRAG: Knowledge Corruption Attacks to RAG (arXiv:2402.07867) — arXiv
- PoisonedRAG (presentation) — USENIX Security 2025