PaperlayerView exact revision on arXiv

Source-linked AI summary

RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation

Abdullahil Kafi, Alvi Ataur Khalil

arXiv:2609.25469v1cs.AI

TL;DR

RAG corpus poisoning is a concern because adversarial documents can steer systems that rely on externally managed knowledge, while prior attacks may not account for the retrieved evidence competing with their payload. RAG-NAROK observes the target's retrieval context and creates source-specific refutations. Across legal, financial, and cybersecurity corpora, it shows retrieval dominance and anomaly-detection evasion up to 88.37%.

  • Problem

    Existing corpus-poisoning attacks may assume white-box access or optimize retrieval without accounting for legitimate retrieved passages that contradict and can neutralize the attack.

    Source: §I · p. 1

  • Method

    RAG-NAROK uses black-box retriever fingerprinting and observed top-k context to synthesize anchor-specific adversarial documents.

    Source: §I · pp. 1–2

  • Results

    Across legal, financial, and cybersecurity corpora, RAG-NAROK achieves first-position retrieval dominance and anomaly-detection evasion rates up to 88.37%.

    Source: §I · p. 2

  • Takeaways & Limitations

    The authors conclude that RAG-NAROK corrupts generated-response conclusions across the evaluated domains and call for context-aware defenses.

    Source: §VIII · p. 6

    The threat model assumes sources are transparent in the RAG pipeline and would fail when sources cannot be observed.

    Source: §VII · p. 6

Abstract

from arXiv · show

Retrieval augmented generation (RAG) systems have emerged as the dominant architecture for grounding large language model (LLM) outputs in verifiable external knowledge, yet their structural reliance on a dynamic retrieval pipeline introduces a largely unexplored class of adversarial vulnerability. Existing knowledge-base poisoning attacks are fundamentally static. Adversarial documents are pre-computed and injected without any awareness of what the victim system will actually retrieve for a given query, leaving the attack blind to the competitive documentary landscape that surrounds its payload in the generator's context window. Unlike traditional static poisoning attacks that are blind to the retrieved context, we introduce RAG-NAROK (Retrieval-Anchored Generation Negation And Response Quality Collapse), a RAG attack framework that adapts to the query text. RAG-NAROK exploits the transparency inherent in RAG pipeline to first extract the legitimate source identities, then generate Anchor-Specific Refutation documents that explicitly name and devalue retrieved sources while leveraging recency and authority biases to steer the text generation toward a target answer. Our results demonstrate that RAG-NAROK significantly outperforms static baselines across diverse domains, revealing a fundamental tension between RAG transparency and AI security.

I. INTRODUCTION

RAG addresses staleness, hallucination, and provenance limitations of static LLMs by grounding generation in external documents, but this makes corpus trust a critical vulnerability. RAG-NAROK adapts poisoned documents to the retrieved context; the paper evaluates its retrieval dominance and defense evasion across three domains.

I. INTRODUCTION

  • Corpus poisoning can steer RAG systems toward misleading conclusions without gradient computation, because externally managed corpora can accept adversarial documents.Answers may remain confidently grounded in corrupted evidence, making the failure invisible to users.Source: §I · p. 1
  • Prior attacks may assume white-box embedding access or produce anomalous passages, while retrieved legitimate documents can contradict and neutralize an injected claim.The paper identifies evading both anomaly-detection defenses and conflict-resolution mechanisms as an unmet objective.Source: §I · p. 1
  • RAG-NAROK is a black-box, context-adaptive corpus-poisoning framework that degrades RAG question-answering response quality.It first fingerprints the retriever, then observes retrieved sources to create anchor-specific refutations.Source: §I · pp. 1–2
  • Retriever Fingerprinting uses black-box query probing, without embedding or index access, to optimize adversarial documents for retrieval.The paper also identifies fingerprinting and evaluation as contributions, with RAG-NAROK assessed across three domain corpora.Source: §I · p. 2
  • Across legal, financial, and cybersecurity corpora, RAG-NAROK achieves first-position retrieval dominance and anomaly-detection evasion rates up to 88.37%.The evaluation covers retrieval dominance, defense evasion, and generation influence.Source: §I · p. 2

A. Large Language Model

A language model assigns probabilities to token sequences and generates text one token at a time. RAG adds retrieval and context assembly before generation, grounding outputs in documents from a knowledge corpus.

A. Large Language Model

  • A language model is a probability distribution over token sequences drawn from a fixed vocabulary.It assigns probabilities to tokens given a sequence of input tokens.Source: A. Large Language Model · p. 2
  • LLMs generate text one token at a time, conditioning each new token on previously generated tokens, and are trained with next-token prediction.The paper describes training on hundreds of billions to trillions of text tokens.Source: A. Large Language Model · p. 2

B. Retrieval-Augmented Generation

  • RAG retrieves the top-k documents for a query, concatenates them with the query into a prompt, then has a generator produce an output conditioned on that prompt.The retrieved documents come from a knowledge corpus, with the closest embeddings selected under a chosen distance metric.Source: B. Retrieval-Augmented Generation · p. 2

III. RELATED WORK

Prior RAG attacks target the knowledge corpus, but may rely on white-box access or fail amid coherent legitimate evidence; research also describes LLM biases in resolving conflicts. RAG-NAROK uses black-box observation and retrieved-source context to synthesize stealthy adversarial documents.

III. RELATED WORK

  • Retrieval-only poisoning can fail amid coherent legitimate passages, while PoisonedRAG jointly optimizes retrieval and generation and reports attack success rates up to 97–99%.Other attacks include gradient-based Joint-GCG and trigger-based TrojanRAG and BadRAG; many assume white-box access or struggle when benign documents outnumber adversarial ones.Source: §III · p. 2
  • LLMs show parametric bias but may defer to authoritative, corroborated external context; high-confidence adversarial framing and recency bias are also reported vulnerabilities.These findings concern Xu et al., Jin et al., and recency-bias research.Source: §III · pp. 2–3
  • Existing black-box corpus-poisoning attacks generally do not combine anomaly-detection evasion with undermining conflict resolution, a gap RAG-NAROK targets.The framework is presented as using stealthy documents and LLM biases under a black-box threat model.Source: §III · p. 3

IV. THE RAG-NAROK FRAMEWORK

  • RAG-NAROK's pipeline fingerprints the retriever, observes top-k sources, profiles their style, and synthesizes and iteratively verifies a payload that reverses the semantic conclusion.The adversary can query the system and inject documents, but has no access to embeddings, index internals, or model weights.Source: §IV · p. 3

V. TECHNICAL DETAILS

The technical details describe a black-box procedure for inferring retriever type from probe responses, then using a fingerprint vector and heuristic thresholds to classify the retriever.

A. Retriever Fingerprinting

  • RAG-NAROK injects synthetic probe documents containing unique canary terms and verifiable factual markers to infer retriever type without white-box access.The markers serve as retrieval activation identifiers.Source: A. Retriever Fingerprinting · p. 3
  • The retrieval activation score measures the fraction of probe identifiers surfaced in the target system’s generated output as a soft proxy for retrieval activation.Source: A. Retriever Fingerprinting · p. 3
  • The probes are tested across five query families, including exact matches, synonyms, paraphrases, lexical degradation, and token removal, to compute fingerprint vector (S, R).Source: A. Retriever Fingerprinting · p. 3
  • The heuristic classifies retrievers as dense when S > 0.70 and R < 0.30, sparse when S < 0.30 and R > 0.70, and hybrid otherwise.The thresholds were determined through experiments and observations to separate semantic robustness from lexical dependence.Source: A. Retriever Fingerprinting · p. 3

B. Anchor Extraction

Anchor extraction encodes the factual structure of the retrieved context, while stylometric profiling supplies characteristics used by the document synthesis engine.

B. Anchor Extraction

  • For each top-k retrieved document, anchor objects capture an atomic statement, named entity, entity type, and temporal anchor.Source: B. Anchor Extraction · p. 3
  • The full anchor set represents the factual structure of the competitive context window and serves as an input to document synthesis.Source: B. Anchor Extraction · p. 3

C. Stylometric Profiling

  • The stylometric profile combines readability, mean sentence length, and passive-voice ratio with an LLM-assisted prose-style label.Together with the inferred retriever type and anchor set, it forms the synthesis engine’s input specification.Source: C. Stylometric Profiling · p. 4

D. Adversarial Document Synthesis

The synthesis engine uses anchors, a stylometric profile, and inferred retriever type to construct adversarial documents, then verifies generated documents against the target profile.

D. Adversarial Document Synthesis

  • The synthesis engine takes the anchor set, stylometric profile, and inferred retriever type as inputs for adversarial payload construction.Source: D. Adversarial Document Synthesis · p. 4
  • Manifold-anchored semantic hijacking reproduces about 70% of the target document’s factual content and steers the remaining 30% toward the adversarial conclusion.The passage describes the resulting output as fluent and internally consistent but factually corrupted.Source: D. Adversarial Document Synthesis · p. 4
  • Stylometric mimicry matches the target profile within a tolerance and adopts its prose-style label to make the document distributionally indistinguishable from the corpus.Source: D. Adversarial Document Synthesis · p. 4
  • Authority framing uses an assistant-response prefill conditioned on an entity and retriever type to present adversarial content as an authoritative update.Because instruction-following is nondeterministic, synthesis is wrapped in an iterative loop that evaluates each generated document against the target profile.Source: D. Adversarial Document Synthesis · p. 4

VI. RESULTS & EVALUATION

  • The evaluation section examines attack impacts on retrieval ranking, defense evasion, and influence on response generation.Source: §VI · p. 4

A. Experimental Setup

The evaluation uses three domain-specific corpora and a direct-prompting baseline, assessing retrieval dominance, anomaly evasion, and generation influence with retrieval metrics.

A. Experimental Setup

  • The evaluation compares RAG-NAROK with a direct-prompting baseline across legal, technical, and financial corpora, measuring retrieval dominance, anomaly evasion, and generation influence.The baseline lacks stylometric mimicry, anchor extraction, and manifold-anchored framing.Source: A. Experimental Setup · p. 4
  • Figure 3 presents the distribution of Efficacy Margin versus Benign Document Displacement.Source: Figure 3 · p. 4

1) Metrics:

  • Highest Adversarial Rank Slot records the best rank position achieved by the injected document, while Efficacy Distance Margin measures its similarity-score advantage over the top benign competitor.Source: 1) Metrics · p. 4
  • Average Benign Document Rank Displacement measures average rank slots lost by benign documents after injection, and Reciprocal Rank Delta measures degradation in their effective retrieval quality.A negative reciprocal-rank delta means benign documents move to worse rank positions after injection.Source: 1) Metrics · p. 4

2) Results:

RAG-NAROK achieves near-complete retrieval dominance across three corpora, displacing benign documents from prominent ranks. It remains present in top-20 results under corpus inflation, though the effect varies by corpus.

2) Results:

  • RAG-NAROK achieves near-complete retrieval dominance across three corpora, placing adversarial documents near the top and increasing their similarity gap over benign documents.The retrieval-performance table covers cybersecurity and finance domains.Source: 2) Results · p. 4, Table I · p. 5
  • Feds-2026 shows the strongest retrieval disruption, while Cybersec-IT is the most challenging corpus despite clear adversarial dominance.Greater Efficacy Margin accompanies greater benign displacement.Source: 2) Results · pp. 4–5

3) Robustness to Corpus Dilution:

  • Under 5×, 10×, and 20× benign-corpus duplication, poisoned documents persist in top-20 results, though corpus inflation reduces their representation.CFR-21 is most resilient to dilution; Feds-2026 experiences the largest reduction.Source: 3) Robustness to Corpus Dilution · p. 5, Figure 4 · p. 5

C. Anomaly Detection Evasion

A dual-engine anomaly detector checks document embeddings and stylometric features. RAG-NAROK’s stylometric and manifold-anchored synthesis reduces detectability, with its generated documents clustering closer to legitimate documents in the Feds-2026 feature space.

1) Detector Architecture:

  • A dual-engine detector flags documents identified as anomalous by either an embedding-based or stylometric Isolation Forest trained on the legitimate corpus.The defense-evasion figure summarizes the analysis.Source: 1) Detector Architecture · p. 5, Figure 5 · p. 5

2) Results:

  • Stylometric mimicry and manifold-anchored synthesis reduce detectability, with the largest improvement on Cybersec-IT, where corpus-specific writing characteristics make alignment particularly important.The source describes the Cybersec-IT result as suggesting that stylometric alignment is particularly important in technical domains.Source: 2) Results · p. 5
  • For Feds-2026, RAG-NAROK-generated documents cluster closer to legitimate documents than the Naïve Baseline in stylometric feature space.The paper attributes this pattern to the stylometric verification loop constraining synthesis toward the benign corpus manifold.Source: 2) Results · p. 5

1) LLM-as-a-Judge:

The paper evaluates whether retrieved adversarial documents influence generated responses using an LLM judge. RAG-NAROK matches or exceeds the baseline on payload integration and receives higher cascade ratings across corpora, while the authors identify several limitations.

1) LLM-as-a-Judge:

  • The LLM judge measures adversarial influence through Payload Integration Rate and Mean Cascade Rating, a 0–10 measure of influence extent.The evaluation asks whether adversarial documents alter generated responses’ semantic conclusions.Source: 1) LLM-as-a-Judge · p. 5

2) Results:

  • RAG-NAROK matches or exceeds the Naïve Baseline on Payload Integration Rate across all corpora and consistently achieves higher Mean Cascade Ratings.The largest gain is on Feds-2026, mirroring its strong retrieval dominance.Source: 2) Results · p. 5, Table II · p. 6
  • The authors suggest retrieval success alone does not fully explain generation influence; manifold-anchored construction and authority framing contribute beyond favorable retrieval ranks.These are presented as contributors to generation-stage persuasion.Source: 2) Results · p. 6

VII. LIMITATIONS

  • The threat model assumes source transparency and would fail when sources cannot be observed; the authors also note unlearned fingerprinting parameters, judge biases, and computational expense.Structured output mitigates, but does not eliminate, positional and verbosity biases in LLM-as-a-Judge evaluation.Source: §VII · p. 6

VIII. CONCLUSION

  • The conclusion reports high retrieval ranking, anomaly-detection evasion up to 88.37%, and semantic-conclusion corruption across legal, financial, and cybersecurity corpora.The authors propose provenance-aware retrieval auditing, adaptive anomaly detection, and generation-layer conflict resolution as directions for defenses.Source: §VIII · p. 6
Loading 2609.25469v1…