Source-linked AI summary
Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
Rujin Liang, Zhongpu Chen, Yuhao Lei, Xin Miao
TL;DR
Multimodal RAG systems remain vulnerable to visual knowledge corruption, especially where existing poisoning attacks depend on textual payloads. Vis-Poison makes the image itself malicious and shows strong attack success across diverse pipelines and generators, including when models possess correct parametric knowledge.
Problem
Existing multimodal RAG poisoning attacks are predominantly text-centric, while visual evidence can sometimes answer queries without text and textual payloads may be filtered.
Method
Vis-Poison introduces an image-only visual knowledge poisoning attack whose malicious payload is embedded entirely in the visual evidence.
Results
End-to-end attack success remains above 40% across six generators on a 30k-entry knowledge base, while POR averages 62.4%.
Takeaways & Limitations
Visual knowledge can be an effective poisoning payload across diverse multimodal RAG pipelines and can override correct parametric knowledge in MLLMs.
Takeaways & Limitations
The study is restricted to visual modality and single-image queries, while construction relies on large models and does not exhaustively explore model choices or combinations.
Abstract
from arXiv · showhide
While multimodal retrieval-augmented generation (RAG) systems increasingly rely on images as external knowledge sources, the introduction of poisoned visual evidence can severely compromise multimodal large language model (MLLM) generation. Unlike prior attacks that rely on altering textual metadata, we introduce Vis-Poison, a novel visual knowledge poisoning attack where the poisoned image itself is the attacker-controlled payload, without manipulating captions, summaries, metadata, or other associated text. Specifically, this attack is instantiated through an automated multi-agent method that constructs visually plausible poisoned images. To assess its impact, we evaluate Vis-Poison across two representative multimodal RAG pipelines, four embedding models, and six generation models. Empirically, Vis-Poison achieves an end-to-end attack success rate of 40.16\% to 65.40\% against 30k-entry multimodal knowledge bases in \emph{black-box} settings. Moreover, Vis-Poison remains effective against various MLLMs that can answer correctly from parametric knowledge alone, with an average success rate above 60\%. Code and data are available at https://github.com/SWUFE-DB-Group/Vis-Poison.
1 Introduction
Multimodal RAG increasingly uses images as external knowledge, but existing poisoning attacks are often text-centric and limited in black-box settings. Vis-Poison addresses this gap with image-only visual payloads, automated construction, knowledge-aware evaluation, and broad experiments.
- Motivation: Images can provide direct evidence for MLLM answers, making multimodal RAG vulnerable to corruption of visual knowledge.Retrieved images may answer questions without textual snippets explicitly stating the same fact.
- Limitations of Existing Attacks: Existing multimodal RAG attacks primarily manipulate captions, instructions, or other textual payloads, which can be auto-generated, unnecessary, or filtered.Gradient-based visual-document attacks also remain restricted to white-box settings.
- Vis-Poison: Vis-Poison injects malicious payloads directly into image content without manipulating associated text.The attack is designed to subvert both retrieval and generation in black-box multimodal RAG systems.
- Evaluation: The paper introduces a knowledge-aware evaluation framework that separates attacks exploiting missing model knowledge from those overriding correct parametric knowledge.It uses closed-book generator responses to proxy internal epistemic state and defines three corresponding metrics.
- Attack Construction: An automated multi-agent procedure constructs visually plausible poisoned images that preserve overall image semantics while steering generators toward targeted outcomes.The attack exploits localized visual perturbations that may appear benign during captioning but become decisive when query-directed attention reaches the manipulated region.
- Experiments: The study evaluates Vis-Poison comprehensively across multimodal RAG pipelines, retrievers, generators, and defenses.The experiments also include analyses and defense discussions.
2 Related Work
Prior multimodal RAG poisoning attacks manipulate image-text pairs, optimize multimodal entries, or poison image metadata. This work differs by targeting visual evidence directly rather than relying on textual payloads or metadata.
- Multimodal Poisoning: Prior attacks construct poisoned image-text pairs or optimize multimodal entries for stronger poisoning.Examples include PoisonedEye, MRAG-Corrupter, MM-PoisonRAG, and Spa-VLM.
- Metadata Poisoning: MM-MEPA poisons image metadata, extending multimodal RAG attacks beyond directly modified image-text content.The passage situates metadata poisoning alongside other multimodal poisoning strategies.
3 Background and Threat Model
The paper studies multimodal RAG systems that retrieve image evidence for textual queries and generate answers from that evidence. Its threat model restricts attackers to injecting one poisoned image in a black-box setting without control over associated text.
- RAG Systems: A RAG system contains a knowledge base, retriever, and generator; retrieval returns top-k evidence that conditions final answer generation.The paper denotes the knowledge base by D, retriever by R, generator by M, retrieved evidence by Zk, and answer by ˆa.
- RAG Systems: The studied setting uses textual queries and image-only retrieved evidence.The retrieved evidence Zk consists only of images.
- Retrieval Pipelines: The victim systems include caption-based retrieval and shared-embedding retrieval.In caption-based retrieval, images are captioned and retrieval operates over caption embeddings; shared-embedding retrieval matches encoded queries and images.
- Retrieval Pipelines: Both pipelines return top-k images as visual evidence, with k = 1 in the evaluated attack setting.Retrieval scores use text and image encoders with a similarity function such as cosine similarity.
- Attacker’s Goals: Vis-Poison targets successful retrieval and semantic alignment between the poisoned image and the attacker-desired answer.The same poisoned image is expected to work across both representative retrieval pipelines.
- Attacker’s Goals: The attacker prefers visually natural poisons whose generated captions remain benign and that can pass optional safeguards.These safeguards may include text fact-checking and image forgery detection.
- Threat Model: The threat model permits one injected poisoned image per query, no control over associated text, and no access to victim internals.The attacker is black-box with respect to the retriever, captioner, generator, and prompts.
4 Method
Vis-Poison constructs poisoned images by editing query-relevant clean images so localized visual evidence supports an attacker-desired answer while preserving retrieval-relevant semantics. Its multi-agent procedure uses planning, image editing, and verification to produce plausible poisons.
- Attack Overview: Vis-Poison edits a query-relevant clean image to support an attacker-specified wrong answer while preserving its main visual content.This design aims to keep the poisoned image retrievable for the target query.
- Attack Overview: Direct text-to-image generation may lose fine-grained visual attributes, motivating edits to source images instead.A generic blue bird may fail to preserve distinctive traits of a blue-chinned sapphire bird.
- Attack Overview: Localized edits can remain less exposed during captioning but become activated when the target query directs attention to the manipulated region.Captioning emphasizes global content, whereas visual question answering can focus on query-relevant local details.
- Attack Overview: In P2, preserving the source image’s overall semantics keeps the poisoned image close to the query in image-query embedding space.The localized evidence remains available to elicit the attacker-desired answer.
- Poisoned Image Construction: The automated construction procedure uses a Planner, an instruction-guided Editor, and a Verifier to create and assess poisoned images.The Planner produces an editing prompt from the query, desired answer, source image, and optional feedback; the Verifier returns a binary judgment and feedback when verification fails.
10 end
Figure 3 measures cosine distance between clean and poisoned representations under P1 and P2, showing that the localized edits generally preserve retrieval representations.
- Representation Similarity: 88.3% of P1 and 98.9% of P2 samples have cosine distance below 0.2 between clean and poisoned representations.The calculation uses 180 sampled clean-poisoned pairs.
5 Knowledge-Aware Evaluation Framework
The knowledge-aware framework uses closed-book responses to distinguish generators’ prior knowledge and measures how clean or poisoned visual evidence affects each regime. It separates poison overriding known answers from poison inducing answers when prior knowledge is absent.
- Knowledge Regimes: The framework uses the generator’s closed-book response as a proxy for its internal parametric knowledge.Question-only prompting separates cases where the generator answers correctly without retrieval from cases where it does not.
- Knowledge Regimes: Poison Override Rate measures whether poisoned evidence forces the attacker-desired answer when the generator already knows the correct answer.This isolates attacks that override correct parametric knowledge.
- Knowledge Regimes: Clean Help Rate measures whether clean evidence guides the generator to the correct answer when it cannot answer correctly without retrieval.This metric evaluates the contribution of the clean image in the low-prior-knowledge regime.
- Knowledge Regimes: Poison Induction Rate measures whether poisoned evidence induces the attacker-desired answer when the generator lacks the correct answer from parametric knowledge.Together with CHR, PIR evaluates poisoned and clean evidence in the low-prior-knowledge regime.
6 Experiments
Experiments evaluate Vis-Poison across multimodal RAG pipelines, retrievers, generators, knowledge-base sizes, edit types, and defenses. The attack remains effective end-to-end, overrides prior knowledge, and is only partially mitigated by filtering or additional retrieved images.
- Experimental setup: The study covers two multimodal RAG pipelines, four embedding models, and six generation models, passing only the retrieved image to the generator.P1 retrieves over caption embeddings, while P2 uses image retrievers; generators include proprietary and open-source MLLMs.
- Attack effectiveness: 66.75% to 87.70% ASR-R is achieved on Flickr30k-30k in P2, while COCO-30k ranges from 66.75% to 84.05% across shared-embedding retrievers.In P1, ASR-R reaches 57.2–79.8% on COCO-30k and 67.0–88.0% on Flickr30k-30k across captioners.
- Attack effectiveness: On 30k knowledge bases, end-to-end ASR remains above 40% for P1 and 45% for P2 at the lower bound, with upper bounds between 55% and 65% across generators.The same poisoned images mislead diverse generators after retrieval across pipelines, captioners, and retrievers in black-box settings.
- Knowledge-aware evaluation: 62.4% average POR shows that poisoned images can redirect generators even when they already know the correct answer from parametric knowledge.Across six generators, POR remains above 59%.
- Edit types and defenses: 86.9% and 83.0% average ASR-G are achieved by color and replace edits, whereas layout, count, scene, and shape edits average 54% to 59%.More visually salient or answer-bearing edits are easier for generators to follow; top-3 retrieval lowers mean ASR-G from 70.6% to 63.1%, providing only partial mitigation.
7 Conclusion
Vis-Poison exposes visual knowledge corruption as a critical multimodal RAG vulnerability. The findings motivate defenses that assess the consistency and factual integrity of retrieved visual evidence.
- Vis-Poison is an image-only poisoning attack independent of textual payloads and model-specific perturbations.
- Experiments demonstrate strong transferability across diverse multimodal RAG pipelines and resilience against large-scale knowledge bases.
- The attack can forcefully override correct parametric knowledge in multimodal large language models.
- Trustworthy multimodal RAG requires reasoning about the consistency and factual integrity of visual evidence, not only its relevance.
Limitations
The study’s limitations concern modality coverage, construction-pipeline model choices, and query complexity. It focuses on image-based, single-image settings and does not exhaustively examine construction-model combinations.
- The study is restricted to the visual modality, leaving video and audio vulnerabilities unexplored.
- The construction pipeline relies on large models for planning, editing, and verification, but inference costs limit exhaustive exploration of model choices and combinations.
- The current scope is limited to single-image queries, while complex multi-image scenarios such as cross-entity comparisons remain future work.
Ethical Considerations
The paper frames its research as security evaluation and defense-oriented work, while describing a visual-poisoning construction process and associated evaluation prompts. It states that the dataset follows ethical guidelines and excludes private personal data.
- The research aims to identify latent multimodal RAG security vulnerabilities and support robust defense mechanisms.
- The authors acknowledge potential dual-use implications and state that the methods are intended solely for security evaluation and defense-oriented research.
- The dataset contains no sensitive personal data regarding private individuals and is stated to comply with established ethical guidelines.
- The construction prompts direct an image-editing planner to make the wrong answer correct through detailed, natural-looking, minimal edits.
- A verifier checks whether an image provides clear visible evidence supporting the target answer, accepting it only when the evidence positively supports that answer.
B Details of Dataset
The constructed poisoned-image dataset contains 4,416 instances spanning nine visual edit types, with color edits most frequent. The evaluation uses multimodal datasets, multiple model types, and automated judgments checked against human annotations.
- 4,416 poisoned images comprise 1,842 easy instances and 2,574 hard instances.
- The dataset groups poisoned images into nine edit types, with color edits most frequent, followed by count and replace edits.
- The edit categories cover localized semantic modifications, while person and layout edits are less frequent.
- Gemma 4-31B serves as the primary consistency judge and is reused for answer alignment to avoid judge-dependent criterion shift.
- Human agreement is high across the automatic judgment tasks reported in Table 10.
- The evaluation data is based on WebQA and uses COCO and Flickr30k as benign multimodal knowledge bases.