ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking

1 INTRODUCTION

• RAG combines a retriever that selects relevant documents with an LLM that generates responses conditioned on retrieved context.Its external knowledge is presented as addressing outdated information, hallucinations, and domain-specific knowledge gaps.Source: §1 · p. 1
• Existing attacks often assume malicious context dominates, justifications are unnecessary, or reliable sources are unavailable, unlike fact-checking settings where trustworthy evidence remains prevalent.Modern RAG-FC systems also use agent-driven reasoning to assess evidence consistency and produce justified conclusions.Source: §1 · p. 2
• ADMIT generates and iteratively refines adversarial passages under a proxy verification setup, assuming black-box access to LLMs and retrievers.Figure 1 contrasts this few-shot approach with prompt injection and general knowledge poisoning: one minimal passage is intended to override evidence and elicit a plausible deceptive justification.Source: §1 · p. 2, Figure 1 · p. 2
• At a poisoning rate of 0.93 × 10^-6, ADMIT achieves 86% average ASR across settings and improves ASR by 11.2% over prior state of the art.The experiments span 4 cross-domain benchmarks, 11 LLMs, and 4 retrievers; ADMIT remains effective with factual counter-evidence.Source: §1 · p. 2

RAG-based Fact Checking

• RAG fact-checking uses retrieved evidence to determine whether claims are supported or refuted, often drawing on trusted sources such as Wikipedia, health repositories, and scientific literature.Prior work integrates multi-source evidence and LLM reasoning into verification pipelines.Source: §2 · pp. 2–3

Knowledge Poisoning Attacks

• Prior attacks include prompt injection, fabricated misinformation, and retriever-targeted methods, with some relying on retriever-specific assumptions or system access.Examples include Misinfo-QA, PoisonedRAG, FlipedRAG, AgentPoison, and BadRAG.Source: §2 · p. 3
• Many existing attacks assume full-context poisoning or large-scale injection, whereas fact-checking aggregates diverse sources and risky injections may be flagged.Isolated instructions or weakly grounded content may be ineffective in this setting.Source: §2 · p. 3
• ADMIT addresses these constraints by crafting targeted adversarial passages intended to override factual evidence with a minimal injection budget.It is proposed for practical fact-checking scenarios with mixed-quality evidence.Source: §2 · p. 3

3 PROPOSED ATTACK

• The threat model limits attackers to injecting a small number of readable passages per claim, without access to the retriever or LLM, while credible evidence remains in context.The goal is to flip verification outcomes and produce persuasive justifications; one-shot injection means a single adversarial passage.Source: §3 · p. 3

3.1 ADVERSARIAL MULTI- INJECTION TECHNIQUE (ADMIT)

• ADMIT uses proxy passages and a proxy verifier to simulate the victim setting, generating passages intended to rank in top-k, override clean evidence, and mislead verification.The verifier is an LLM-based fact-checker; single-turn generation uses proxy passages, while multi-turn generation updates passages through textual feedback when needed.Source: §3.1 · pp. 3–4
• Multi-turn refinement repeats until the target verdict is achieved or the iteration limit T is reached, selecting the final passage if the goal remains unmet.ADMIT also periodically clears its passage memory to avoid degraded performance and reduce overhead.Source: §3.1 · p. 4

3.2 PROXY PASSAGE CONSTRUCTION

• Search-based proxy construction retrieves documents for diverse claim queries, segments them into passages up to 50 words, and filters for the stance opposite the target verification.A complementary LLM-based strategy generates proxy passages from the model’s answer when web-scale sources may not approximate the victim’s retrieval space.Source: §3.2 · pp. 4–5

3.3 ADVERSARIAL PREFIX AUGMENTATION

• ADMIT prepends its decomposed, semantically rich search queries to adversarial passages to improve retrievability without white-box retriever access or superficial query patterns.The paper also explores LLM-based rerankers as a potential defense.Source: §3.3 · p. 5

4.1 EXPERIMENTAL SETUP

• The evaluation used four datasets, sampled 100 claims per dataset, tested 1–5-shot attacks across 11 verifiers, and measured ASR, recall, and deceptive-justification rate.ASR counted only Support↔Refuted flips, not NEI outputs; baselines were adapted to the same attack budget.Source: §4.1 · p. 5

4.2 MAIN RESULTS

• ADMIT achieved the highest ASRs in 88.3% of configurations, improving over PoisonedRAG by 8% at 1-shot and 14% at 5-shot on average.CorruptRAG and PIA achieved 49–50% ASR on some open-source settings but fell as low as 6% on GPT-4o.Source: Table 1 · p. 6, §4.2 · p. 6
• With k = 5, ADMIT’s ASR reached or exceeded 85% at 5-shot and remained above 50% at 1-shot across verifiers and datasets.With k = 10 and up to 5-shot injection, ASR remained strong, including 80% on open-source LLMs.Source: Figure 2 · p. 6, §4.2 · p. 6
• ADMIT produces semantically coherent misinformation that is more deceptive to humans than prior attacks’ unreadable text or overt malicious instructions.Table 2 compares the deception strategies used by the attack methods.Source: Table 2 · p. 7, §4.2 · p. 7
• Across four retrievers, ADMIT remained effective when only one adversarial passage was retrieved, despite variable recall on HealthVer queries with typos and informal phrasing.Manual inspection, ROUGE, and perplexity analyses linked HealthVer’s recall variability to these query artifacts.Source: §4.2 · p. 7
• ASR did not rise strictly linearly with larger shot budgets because the metric excludes Supported/Refuted-to-NEI transitions; closed-ended claims also sometimes elicited hedged justifications.Models could produce the target verdict while expressing doubts about evidence quality.Source: §4.2 · p. 7
• Per-claim generation may limit large-scale poisoning; fine-tuning Qwen 2.5 32B on 6,000 adversarial passages yielded single-step RAQ attacks and emergent multilingual capabilities.The generator was trained exclusively on English inputs.Source: §4.2 · p. 7

4.3 POTENTIAL DEFENSES

• Defenses remain vulnerable: FakeWatch misses nearly all adversarial passages, statistical detectors fail, voting may amplify attacks, clustering remains vulnerable, and ReAct ASR reaches 88–94%.Clustering-based consolidation performs better than passage-level voting, but does not eliminate vulnerability.Source: §4.3 · pp. 7–8

5 ABLATION STUDIES

• ADMIT’s robustness evaluation spans over 700 experiments, including unseen retrievers and LLMs, proxy-passage ablations, and proxy-construction variations.The main paper reports key findings, with extensive results in Appendix G.3.Source: §5 · p. 8

Performance Across Different LLM Configurations

• 90% ASR on open-source, 84% on commercial, and 86% on reasoning models under 5-shot injection; at k = 10 with five clean passages, ASR remains 65–80%.Open-source Qwen2.5-32B performs on par with GPT-4o as a generator.Source: §5 · pp. 8–9, Table 5 · p. 9

Proxy Passage: Web Search vs. LLM

• Search-based and LLM-based proxy strategies both exceed 99% recall; search yields 17% higher ASR on HealthVer, while LLM proxies gain 11% on FEVER.The reported results characterize the strategies as complementary across domain-specific and general claims.Source: Table 4 · p. 9, §5 · p. 9

Component Ablation

• Proxy verification improves ASR by 20–24% over PoisonedRAG across settings; moderate resets (L=5), 30 iterations, and three proxy passages yield the reported best configuration.Single-turn generation performs markedly worse, and adding more than three proxy passages introduces noise without improving performance.Source: §5 · p. 9

6 COMPUTATIONAL COST

• 41% of sampled FEVER claims succeeded with single-turn generation; within five iterations, 65% produced passages passing the proxy verifier at an average cost of $0.013 per successful passage.Most successful cases converged within one to three iterations.Source: §6 · p. 9

7 LIMITATION

• The study tests text-level injection, one claim at a time, and relies on search-engine proxy passages; specialized-domain adaptation remains an open challenge.Real-world fact-checking also uses source, publisher, and timestamp metadata as credibility signals.Source: §7 · p. 9

8 CONCLUSION

• ADMIT overturns fact-checking verdicts with minimal injection even under strong retrieval settings, and its effectiveness spans domains, retrievers, and reasoning-oriented LLMs.The findings indicate that factual robustness does not automatically follow model scale or reasoning ability.Source: §8 · pp. 9–10
• Fake-news detection, PPL filtering, and LLM-based consolidation only partially mitigate the identified risk, motivating defenses that track provenance, assess uncertainty, and reason beyond surface consistency.Source: §8 · p. 10

ETHICS STATEMENT

• The stated intent is to study targeted knowledge-poisoning vulnerabilities and inform more robust fact-checking systems.The authors acknowledge the risks of adversarial misinformation while arguing that open study can support safer RAG fact-checking.Source: ETHICS STATEMENT · p. 10
• They withhold raw adversarial passages and restrict experiments to academic benchmarks, with no real-world deployment.The experiments use publicly available fact-checking benchmarks and involve no human subjects, private data, or sensitive personal information.Source: ETHICS STATEMENT · p. 10
• The authors identify adversarial misinformation research as inherently risky and emphasize defensive insights and future mitigation strategies.They cite the existing circulation of adversarial misinformation as context for studying vulnerabilities.Source: ETHICS STATEMENT · p. 10

A IMPLEMENTATION DETAILS

• The implementation evaluates four retrievers and three LLM groups using 1–5 injected passages per claim, retrieval size k ∈ {5, 10}, and up to 50 optimization steps.The setup uses original dataset corpora, a default Contriever-ms retriever, GPT-4o as proxy verifier and generator, and passages and explanations capped at 50 words.Source: A IMPLEMENTATION DETAILS · p. 17

A.1 DATASETS

• HealthVer is manually converted to a BEIR-compatible format, alongside FEVER, Climate-FEVER, and SciFact as the cross-domain evaluation datasets.The datasets cover general-domain, climate-related, scientific, and health claims, respectively.Source: §A.1 · p. 17

B IMPACT OF LLMS’ PRE-TRAINED KNOWLEDGE

• ASR is 0.52 for Gold claims, 0.75 for Gray claims, 0.98 for Black claims, and 0.63 for the default FEVER distribution.Gold denotes agreement among the LLM, RAG, and ground truth; Gray denotes LLM–RAG disagreement; Black denotes that all say NEI.Source: B IMPACT OF LLMS’ PRE-TRAINED KNOWLEDGE · pp. 17–18, Table 7 · p. 18
• ADMIT is most effective when prior knowledge is weak or inconclusive: Black claims reach ASR 0.98, versus 0.52 for Gold claims.The authors connect this pattern to greater susceptibility when reliable information is scarce, including in health or climate domains.Source: B IMPACT OF LLMS’ PRE-TRAINED KNOWLEDGE · p. 18

C.1 ALGORITHM

• ADMIT retrieves and validates proxy passages, then iteratively proposes and evaluates adversarial passages using black-box verifier feedback.The search-based path uses claim decomposition, query generation, web snippets, and passage filtering; the craft-based path generates a stance-aligned passage when external retrieval fails.Source: §C.1 · pp. 18–19, §C.3.1 · p. 19, §C.3.2 · p. 19

D COMPUTATIONAL COST

• 41% of target claims succeed on the first generation, and most remaining cases converge within three iterations.For 65% of FEVER claims attacked within five iterations using GPT-4o, the reported total cost is approximately $0.85, or $0.013 per successful claim; Figure 3 shows the skewed iteration distribution.Source: D COMPUTATIONAL COST · pp. 19–20, Figure 3 · p. 21, Table 12 · p. 21
• The authors report that most successful generations need few iterations, with only a very small fraction reaching the optimization cap.Single-turn generation can be used broadly, while multi-turn optimization may be reserved for harder-to-flip examples, with early stopping and iteration caps as controls.Source: D COMPUTATIONAL COST · pp. 20–21, Figure 3 · p. 21

E.1.1 POTENTIAL PATTERN IN ADMIT PASSAGES

• Attacker LLMs produce varied styles, including fabricated official statements, contrarian scientific claims, and sensational or conspiratorial framings, complicating surface-level detection.The examples include credible-sounding press releases, nonexistent affiliations, and fabricated URLs.Source: §E.1.1 · p. 22

E.1.2 MULTI-TERM OPTIMIZATION AND TRAJECTORY ANALYSIS

• In the Netherlands-capital example, optimization succeeds by emphasizing The Hague’s administrative role without denying Amsterdam’s legal title.The analysis describes later probes shifting toward semantic boundaries already suggested by the proxy evidence, rather than inventing an unrelated story.Source: §E.1.2 · pp. 22–23

E.2 DECEIVED JUSTIFICATION RATE (DJR)

• Among successful attacks, ADMIT’s DJR is 100% across models and datasets, meaning justifications align with flipped verdicts without revealing manipulation.The authors also report deceptive justifications from reasoning-oriented LLMs when passages contradict their underlying world knowledge.Source: §E.2 · p. 23

E.3 REJECTION RATE

• Most tested attacker LLMs show 0% rejection, while Claude-3.5-Sonnet reaches 23.0% on HealthVer and 17.7% on SciFact.The evaluation covers 800 claims, with 200 per dataset.Source: §E.3 · p. 24

F.1–F.3 DEFENSE EVALUATIONS

• FakeWatch fails to separate clean from adversarial passages, PPL detection is inverted (AUC 0.23), and ROUGE-N scores do not significantly distinguish clean-clean from adversarial pairs.For PPL, over 60% of clean passages are misclassified and more than 80% of adversarial passages remain undetected; ROUGE-N pairs can be slightly higher for adversarial passages in some domains.Source: §F.1 · p. 24, Figure 4 · p. 24, §F.2 · p. 25

F.4 LLMS-BASED KNOWLEDGE CONSOLIDATION

• Divide-and-vote predicts labels per passage or cluster and uses majority voting; consolidate-then-select combines internal and retrieved passages, then selects the group answer with highest confidence.In the second strategy, generated internal content is tagged [INT] and retrieved passages [EXT].Source: §F.4 · pp. 25–26

G.1 IMPACT OF MODELS

• With the augmentation prefix, dense-retriever average recall rises from 82.4% to 95.7%; over 1–5-shot injection across four datasets, all retrievers except on HealthVer achieve over 97% recall after prefixing.Qwen2.5-14B also records ASR of 0.72 on LLaMA3.1-8B and 0.78 on GPT-3.5-turbo.Source: §G.1 · p. 27, Figure 7 · p. 27

G.2 IMPACT OF MODULES IN ADMIT

• Proxy-guided ADMIT exceeds PoisonedRAG by 20.7%–24.0% average ASR margins; search-based and craft-based construction trade wins by domain.Search-based construction has higher ASR on HealthVer by 17% and Climate-FEVER by 4%, while craft-based construction performs better on FEVER by 11%.Source: §G.2 · p. 27

G.3 IMPACT OF HYPERPARAMETERS IN ADMIT

• ASR rises with iteration budget, with gains tapering near T=40, and with reset intervals from L=1 to 5; large or absent resets can stall refinement through minimal edits.At T=1, ADMIT becomes a single-turn attack and performance drops across domains.Source: §G.3 · p. 28, Figure 9 · p. 29, Figure 8 · p. 29
• Across V=20–60, ASR is mostly stable, with approximately 2% gains per 10 words in HealthVer and SciFact; more proxy passages can add noise, making m=3 the balance.Source: §G.3 · p. 28, Figure 10 · p. 29, Figure 11 · p. 29

H FINE-TUNING A GENERATOR FOR SCALED KNOWLEDGE POISONING

• Fine-tuning Qwen 2.5–32B on 6,000 adversarial passages enables one-pass generation; on 100 reframed HotPotQA examples, attack success rises with shots while recall stays near-perfect.The examples recast question–answer pairs as claims and use supporting documents as proxy context.Source: H FINE-TUNING A GENERATOR FOR SCALED… · p. 30, Figure 12 · p. 30

I.1 ATTACK REACT AGENT

• As more poisoned passages are injected, ASR rises from 51% to 92% on FEVER, 57% to 91% on Climate-FEVER, 65% to 94% on SciFact, and 37% to 88% on HealthVer.Source: §I.1 · p. 32
• Retrieved recall remains ≥0.99 for ReAct agents, which tend to converge on definitive answers despite conflicting evidence; the authors link this behavior to vulnerability to crafted passages.The evaluation uses a multi-step agent that searches, observes, and reflects.Source: §I.1 · pp. 31–32, Figure 13 · p. 32

I.2 CROSS-QUERY RETRIEVAL

• With full-query retrieval prefixes, cross-contamination is 0% on FEVER, Climate-FEVER, and SciFact, and 0.8% on HealthVer, localizing passages to intended queries.Source: §I.2 · p. 32
• With coarse claim keywords, non-target passages influenced 26% of 100 HealthVer claims; prefix design can trade query-level specificity for broader multi-claim retrieval.The experiment injected five adversarial passages per claim and used top-k=5 retrieval.Source: §I.2 · p. 33

• Appendix tables summarize four retrievers’ recall, baseline ASR and recall, and 1–5-shot ADMIT results across 11 verifiers at k=5 and k=10.Source: J ADDITIONAL RESULT · p. 33
• Further appendices catalog dense/sparse retrieval-prefix recall effects, comparative examples, attack failures, and claim categorization.Source: Table 19 · p. 34, Table 23 · p. 38, Table 24 · p. 39
• Examples show clean Supported→Refuted flips for claims about Florida’s borders and fatty-acid supplementation.Source: J ADDITIONAL RESULT · pp. 38, 40
• Other examples show clean Refuted→Supported flips for claims about pets spreading COVID-19 and Tuvalu sea-level rise.Source: J ADDITIONAL RESULT · pp. 39, 41