Poisoned retrieval corpora: how a few planted documents can steer a RAG system's answers

What it is

In retrieval-augmented generation (RAG), a retriever selects passages from a corpus and the model answers from them. Zou et al. ("PoisonedRAG", arXiv 2402.07867) describe knowledge corruption attacks: an attacker who can add texts to the knowledge database crafts them to be retrieved for a target question and to lead the model to a target answer. OWASP's 2025 Top 10 lists vector and embedding weaknesses (LLM08) and data poisoning (LLM04) as separate risks that cover this ground.

Why it matters

Many corpora are writable by more people than their owners assume: public wikis, support forums, shared drives, crawled web pages, tickets, pull-request descriptions. A poisoned passage does not need to be common; it needs to rank highly for one question. It may also carry an injected instruction instead of a false fact, so the retrieval path becomes an injection carrier.

How to apply

• Inventory who can write to each source feeding the index, and index untrusted sources in separate collections with a visible trust label.
• Store provenance per chunk: source URL or document ID, author or account, ingestion time, and revision. Show it with the answer.
• For high-stakes questions, require agreement between passages from independent sources, or answer from curated sources only.
• Monitor for new documents that are near-duplicates of a common question or contain phrasing aimed at the model ("when asked about…, answer…").
• Keep the ability to remove a source and rebuild the index quickly, and log which answers used a removed passage.
• Treat retrieved passages as data in the prompt, never as instructions.

Pitfalls

• Relying on embedding similarity as a quality signal; the attack optimises exactly for it.
• Deduplication that keeps the newest version of a document, letting an attacker replace a good passage with an edited copy.
• Assuming a private corpus is safe when it ingests e-mail or tickets from outside.