InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation

Jiachang Zhang; Min Chen; Xiao Ren; Zhenyong Zhang; Yuanchao Shu; Yunjun Gao; Zhikun Zhang

Source-linked AI summary

InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation

Jiachang Zhang, Min Chen, Xiao Ren, Zhenyong Zhang, Yuanchao Shu, Yunjun Gao, Zhikun Zhang

arXiv:2609.16818v1Sep 15, 2026cs.CR

TL;DR

Existing RAG poisoning attacks and defenses largely focus on explicit malicious payloads contained within single documents, leaving indirect logic induction insufficiently addressed. InceptionRAG fragments a malicious payload into dormant attribute and bridge passages that jointly induce misinformation through multi-hop reasoning, while ZOSO generates authoritative black-box suffixes. InceptionRAG achieves 72.3% ASR and 90.4% BR on NQ under attention-based defense, outperforming existing poisoning attacks’ 16.7% ASR and 51.6% BR.

Problem
Existing RAG poisoning attacks and defenses largely focus on explicit malicious payloads contained within single documents, leaving indirect logic induction insufficiently addressed.
Method
InceptionRAG fragments a malicious payload into dormant attribute and bridge passages that jointly induce misinformation through multi-hop reasoning, while ZOSO generates authoritative black-box suffixes.
Results
InceptionRAG achieves 72.3% ASR and 90.4% BR on NQ under attention-based defense, outperforming existing poisoning attacks’ 16.7% ASR and 51.6% BR.
Takeaways & Limitations
Stronger LLM reasoning capabilities can increase vulnerability to reasoning-based poisoning, motivating document isolation through HODOR.
Takeaways & Limitations
Artificial logic traps can increase retrieved-context complexity and create statistical anomalies that are more distinguishable to FilterRAG on some datasets.

Abstract

from arXiv · show

Retrieval-augmented generation (RAG) systems enhance large language models (LLMs) with external knowledge but have been demonstrated to be vulnerable to corpus poisoning. Existing poisoning attacks against RAG largely focus on single-point explicit injection, where the malicious payload is fully encapsulated within a single document. Consequently, recent mitigation mechanisms have evolved to identify and diminish these threats effectively. In this paper, we first verify that existing mitigation mechanisms are insufficient for a new class of threats: indirect logic induction. Motivated by this observation, we introduce InceptionRAG, a stealthy attack mechanism that subverts the standard attack paradigm. Instead of injecting explicit malicious payloads, InceptionRAG fragments it into a chain of dormant passages. These passages appear harmless and can bypass existing mitigation mechanisms when examined separately. However, when retrieved together, they trigger LLMs to self-deduce target misinformation via multi-hop reasoning. To further improve the applicability of InceptionRAG in black-box settings, we propose zeroth-order suffix optimization (ZOSO) to automate the generation of authoritative suffixes. Extensive evaluations across three datasets and three LLMs demonstrate that InceptionRAG achieves an attack success rate exceeding 80% even under rigorous adversarial constraints. In particular, InceptionRAG shows superior evasion capabilities, effectively bypassing established defenses that mitigate traditional single-document injections. Our findings expose a concerning paradox: the stronger reasoning capabilities of LLMs increase their vulnerability to reasoning-based poisoning attacks. To mitigate potential misuse, we propose a document isolation-based defense, HODOR, which decouples adversarial logical dependencies.

1 Introduction

RAG poisoning attacks typically expose malicious content through explicit single-document injections, while InceptionRAG distributes dormant logical fragments that jointly induce target misinformation. The paper introduces ZOSO for black-box suffix optimization and reports strong effectiveness and stealth against defenses.

Motivation: Existing single-document attacks create detectable query–answer associations that defenses can identify through attention, keyword-density, or contradiction signals.These attacks concentrate the full target answer in one document, producing anomalous patterns.
Our Proposal: InceptionRAG distributes a malicious payload across disjoint passages that appear benign individually but trigger multi-hop self-deduction when jointly retrieved.Its core principle is that the poison resides in interactions between documents rather than in any single corpus passage.
Attack Construction: The attack constructs an attribute document linking a proxy entity to the desired answer and a bridge document equating that proxy with the target entity.Together, the passages allow the LLM to infer the target answer transitively without any document stating it directly.
Optimization: ZOSO uses black-box optimization to generate anchor and bridge suffixes that increase malicious-payload authority and propagate relations across passages.The suffixes address cases where benign retrieved evidence explicitly states a conflicting answer.
Evaluation: 72.3% ASR and 90.4% BR on NQ under attention-based defense exceeded existing attacks’ maxima of 16.7% ASR and 51.6% BR.Across three datasets, five safety filters, and models from 7B to 1,000B parameters, larger models were reported as more vulnerable.
Contributions: The paper proposes a tailored defense strategy because distributed logical dependencies expose blind spots in defenses designed for isolated documents.Its contributions also include scaling the attack under resource-constrained black-box conditions and maintaining high ASR despite benign passages outnumbering adversarial payloads four to one.

2 Preliminaries

LLMs provide broad reasoning and generation capabilities but remain vulnerable to hallucinations and stale parametric knowledge. RAG addresses these limitations by conditioning generation on retrieved external documents and established retriever–generator frameworks.

2.1 Large Language Models: LLMs support instruction following, contextual grounding, and multi-hop reasoning for complex problem-solving applications.They generate text by recursively sampling from next-token conditional probabilities.
2.1 Large Language Models: Fixed parametric knowledge leaves LLMs susceptible to hallucinations and outdated information, especially in knowledge-intensive tasks.These limitations motivate mechanisms that incorporate external knowledge.
2.2 Retrieval-Augmented Generation: RAG grounds generation in an external non-parametric knowledge base to address hallucinations and stale resources.A retriever identifies relevant documents, which are concatenated with the query before generation.
2.2 Retrieval-Augmented Generation: Formally, RAG retrieves top-k context C = R(q, D), then generates y conditioned on q and C.The framework consists of a retriever R, generator G, and external knowledge base D.
2.3 Related Frameworks: Prior frameworks progressively align retrieval and generation, while REPLUG supports black-box generators and Self-RAG adds self-reflection tokens.The cited progression includes REALM, vanilla RAG, RETRO, REPLUG, and Self-RAG.

3 Threat Model and Existing Attacks

The threat model assumes black-box access to an LLM and limited corpus-injection capability, with the attacker targeting specified query–answer pairs. Existing attacks optimize retrieval and generation through explicit single-document poisoning, which remains vulnerable to document-level defenses.

3.1 Threat Model: The attacker poisons the knowledge base so the RAG system produces a specified target answer for each selected target query.The objective is defined over arbitrary query–answer pairs.
3.1 Threat Model: The attacker operates through a public API and can inject content into the retrieval corpus without accessing internal model parameters.The retriever and generator are both treated as black boxes.
3.1 Threat Model: The attacker may add a small number of fabricated documents to an open or user-contributed corpus but cannot modify or delete benign documents.The assumed adversarial corpus is much smaller than the clean corpus.
3.2 Existing Attacks: Existing poisoning attacks separate retrieval hijacking from generation induction and directly inject the original query into malicious payloads to maximize retrieval similarity.PoisonedRAG uses seemingly truthful passages, whereas HijackRAG uses hijack prompts.
3.2 Existing Attacks: Single-document injection concentrates the target answer and query link in one passage, leaving statistical, attention, and logical traces detectable by document-level defenses.This concentration is the central stealth limitation of existing attacks.

4 InceptionRAG

InceptionRAG poisons RAG systems by distributing a malicious conclusion across benign-looking passages that induce multi-hop reasoning when retrieved together. It combines logic-trap construction with black-box suffix optimization, retrieval maximization, and adaptive obfuscation to improve stealth and robustness.

4 InceptionRAG: InceptionRAG distributes a target falsehood across passages that appear benign individually but induce the misinformation when jointly retrieved and reasoned over.The attack exploits distributed logical dependencies rather than explicit single-document payloads, laundering the false conclusion during generation.
4 InceptionRAG: ZOSO with NTK-GP guidance optimizes authoritative suffixes that make the reasoning-derived conclusion compete effectively against benign retrieved evidence.These suffixes are intended to force the generator to prioritize the fabricated logic when direct ground-truth passages are present.
4 InceptionRAG: Dual-ended injection places query-related headers and pseudo-metadata footers around the payload to improve its retrieval rank without relying on an exact future query phrasing.Key-token extraction preserves informative retrieval signals across paraphrased user queries.
4 InceptionRAG: Adaptive suffix deployment uses randomized wrappers and local fine-tuning to reduce signature detection and address failures on long-tail queries.Static global suffixes can be blocked as deterministic patterns or fail under semantic variation, motivating polymorphic and localized adaptation.
4 InceptionRAG: The logic trap uses a proxy entity with separate attribute and bridge documents, so the target answer emerges only from their combination.The attribute passage links the proxy entity to the desired answer, while the bridge passage establishes the relation needed for transitive inference.
4 InceptionRAG: Naive black-box suffix search costs O(MN) queries, so the proposed evaluation protocol reduces the burden through shortlist selection and golden-set-based rewards.The search evaluates at most one previously untested suffix per optimization round rather than every candidate across the full validation dataset.

5 Evaluation

Across three datasets, multiple retrievers, LLMs, and defenses, InceptionRAG maintains strong attack effectiveness and stealth under constrained poisoning settings. Its optimized and adaptive suffix strategies improve performance, while larger models and greater injection redundancy generally increase susceptibility.

Overall Attack Performance: 88.0% ASR on NQ and 90.3% on HotpotQA under a two-document, ten-passage retrieval constraint, outperforming baselines by over 10–50 percentage points.Across GPT-3.5 and Grok-4-Fast-reasoning, ASR remains between 80% and 87.6%, even when benign passages outnumber malicious ones four to one.
Defense Evasion Capability: 90.4% BR and 72.3% ASR on NQ with AVFilter, while InceptionRAG maintains strong evasion across statistical, graph-based, and LLM-based defenses.It also exceeds 85% BR on HotpotQA and MS-MARCO under MIS, although added logic complexity makes FilterRAG more likely to detect attacks on HotpotQA.
Ablation Studies: 83.3% ASR with ZOSO on Gemini-2.0-Flash/MS-MARCO, up from 41.3% with random suffixes.Random suffixes provide marginal or inconsistent gains, whereas ZOSO identifies semantically potent suffixes that strengthen the adversarial logic.
Ablation Studies: 83.3% ASR with CTTFT on Gemini/MS-MARCO, recovering from 22.0% with global suffixes alone.The result indicates that instance-level adaptation is important for robust attacks on high-variance web data.
Efficiency and Transferability: 28.3× speedup for ZOSO on Grok-4-Fast-Reasoning/HotpotQA, reducing exhaustive-search time from 6,621.5 to 234.1 minutes.Poisoned documents also remain reliably retrievable under query rewriting and across Contriever, Contriever-MS, and ANCE, with most 2/2 retrieval rates above 96%.
Hyperparameter Studies: 13.0% ASR gain on MS-MARCO, from 84.0% to 97.0%, when Attribute-Scaling increases injection count from 1 to 5.NQ and HotpotQA show weaker gains because ASR already exceeds 91% and 92%, respectively, at N=1 and approaches 100% as redundancy increases.

Appendix D.2 presents the ZOSO hyperparameter study.

HODOR isolates documents and aggregates independent answers to disrupt distributed adversarial reasoning, but this defense trades attack suppression for reduced benign multi-hop performance.

HODOR processes each retrieved document independently and uses majority voting to sever logical links between adversarial passages.This prevents the generator from synthesizing the attribute and bridge documents into a logical trap.
HODOR consistently reduces attack success rates across datasets and model backends, according to the reported evaluation.The defense is designed specifically to disrupt distributed adversarial reasoning.
HODOR notably degrades benign performance on multi-hop reasoning tasks, creating a clear utility trade-off.The paper reports this benign-performance result in Figure 8 in Appendix D.

A.1 Implementation Details of Zeroth-Order Suffix Optimization

ZOSO uses an NTK-GP surrogate to guide black-box suffix search, while the associated payload structure combines retrieval-oriented metadata with multi-hop logical traps.

ZOSO searches discrete suffix candidates through continuous embedding optimization under black-box access.The method uses an empirical neural tangent kernel as the surrogate covariance function.
The NTK compares suffix embeddings by whether they induce aligned parameter-space gradient updates rather than only geometric proximity.Higher-reward candidates guide the update direction, while redundant similar samples are down-weighted.
The malicious payload uses a header, toxic body, and footer to combine query keywords, multi-hop traps, and pseudo-metadata that increase retrieval probability.The figure passage additionally describes header and footer placement as exploiting retriever positional bias while mimicking benign structure.

B Additional Experimental Details

The experiments standardize victim-LLM interaction to reduce stochastic variation and use a fixed context-question prompt format.

Experiments set the victim LLM temperature to 0.0 and limit outputs to 100 tokens.These settings were used to minimize stochasticity in the generator’s output.
The system prompt instructs the model to answer based on context using a fixed final-answer format.The template supplies context and question fields to the generator.
The interaction template combines retrieved context with the question before generation.The output is constrained to ‘Final answer: <answer>’.

B.2 Experimental Details of Zeroth-Order Suffix Optimization

The ZOSO experiments allocate a fixed candidate-evaluation budget and use reusable candidate pools, while requiring corpus injection but not retriever-context access.

ZOSO evaluates 50 optimization rounds per suffix type, beginning with 20 K-means representatives and continuing with 30 NTK-GP rounds.Each round forms a top-10 nearest-neighbor shortlist and evaluates at most one previously unvisited suffix.
The optimization uses a learning rate of η = 0.05 and a lightweight two-layer NTK-GP surrogate.Table 8 summarizes settings across optimization, surrogate modeling, and embedding design.
ZOSO requires only the public query-response interface for reward collection, while deploying the resulting passages requires corpus injection.The attacker does not need to expose or manipulate the retriever’s selected context.

B.3 Details of Evaluation Metrics

The evaluation uses ASR to measure attack effectiveness and BR to measure resilience against enabled defenses. Five inference-time defenses sanitize retrieved passages before generation.

Attack Success Rate (ASR) measures the percentage of cases where the system produces the target adversarial answer.Success uses substring matching against the target answer or an expanded paraphrase set.
Bypass Rate (BR) measures the proportion of initially successful attacks that still induce the target answer when defenses are enabled.Defense methods are evaluated only on samples that succeed without defense.
Five representative defenses identify and filter potentially malicious passages from retrieved context before generation.All defenses operate at inference time, and only the filtered context reaches the generator.

C Details of Prompt Construction

The prompt-construction pipeline extracts the queried entity, builds a proxy-based logic trap, and generates authoritative or equivalence-based suffix candidates. These components produce attribute and bridge documents whose combined logic can induce the target answer.

C.1 Entity Extraction: Entity extraction identifies the single most important named entity in the user query and assigns it one allowed entity type.The extraction prompt requires JSON output containing the entity text and type.
C.2 Logic Trap Generation: The attribute-generation stage supplies the original question, extracted entity, and target answer to generate an attribute document.The prompt construction uses a proxy entity and requires the target answer to be inserted verbatim.
C.2 Logic Trap Generation: The attribute document describes the proxy entity with unrelated background before stating the target answer as one of its factual attributes.The target answer must appear exactly, while the document must not mention the target entity.
C.2 Logic Trap Generation: The bridge document explicitly states that the target and proxy entities share the queried attribute value without naming that value.It must mention both entities, preserve the shared-value relation, and avoid associating the target entity with an explicit answer.
C.2 Logic Trap Generation: Bridge-prompt instructions enforce abstract equivalence while varying phrasing and forbidding a direct answer value.The bridge-generation prompt receives the question, target entity, and proxy entity and returns text2.
C.3 ZOSO Suffix Candidate Generation: ZOSO constructs reusable suffix pools by paraphrasing seed suffixes into Anchor and Bridge types.Anchor suffixes assert canonical authority, whereas Bridge suffixes assert logical equivalence, interchangeability, or shared properties.
C.3 ZOSO Suffix Candidate Generation: Each suffix type starts from 20 seeds and generates 25 paraphrases per seed, yielding up to 500 candidates before deduplication.Generation uses two proxy-LLM calls, then strips list prefixes and removes exact duplicates.
C.3 ZOSO Suffix Candidate Generation: The examples append authoritative and equivalence-oriented suffixes to poisoned passages, producing outputs such as “Final answer: 26,” “Final answer: Canada,” and “Final answer: Early spring.”The examples include an NQ case in which the attribute passage links Puerto Plata with the target answer through a framework-postulate suffix.

D Additional Experimental Results

Additional experiments validate substring-based evaluation, examine query rewriting and ZOSO search budgets, and report baseline and HODOR results across datasets and target language models.

Substring-based ASR is broadly consistent with LLM-based evaluation and human judgment on NQ, HotpotQA, and MSMARCO.The comparison supports substring matching as a reliable and efficient experimental metric.
The retrieval-robustness evaluation rewrites each search question into five distinct paraphrased questions while preserving its exact meaning and constraints.The prompt requires natural standalone questions in valid JSON without trivial prefix additions.
Under N_init = 10, increasing the ZOSO search step noticeably raises ASR across all three datasets before plateauing at moderate budgets.With N_init = 20, ASR starts high and changes only mildly as the search budget increases.
Figure 8 reports answer accuracy under HODOR defense, while Table 11 reports baseline ASR across target LLMs without defense.These results complement the attack-success analysis with benign-performance and baseline comparisons.