Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generation

1 Introduction

• Correlated stylistic, semantic, and lexical patterns make independently constructed poison passages vulnerable to defenses that jointly analyze retrieved evidence.Surface paraphrasing alone does not address repeated support rationales.Source: §1 · pp. 1–2
• Doubt questions the evidential basis for the reference answer before presenting the attacker-selected answer as a later or independent cross-check.It neither names the reference answer nor directly instructs the model which source to trust.Source: §1 · p. 2
• DnD plans stylistically diverse direct-support passages, controls pairwise lexical overlap, and adds a Doubt passage to resolve competing evidence.A frozen surrogate checks target support and set consistency.Source: §1 · p. 2
• Across two QA datasets, three target LLMs, and nine RAG settings, DnD matches or outperforms prior attacks in most configurations, with its largest gains against clustering- and conflict-aware defenses.Evaluations cover black-box and white-box retriever access.Source: §1 · p. 2

Corpus poisoning attacks on RAG

• Prior attacks include retrieval-focused optimization, end-to-end poisoning, query-agnostic adversarial content, and methods that couple retrieval and generation (Zhong et al., 2023; Zou et al., 2025; Tan et al., 2024; Li et al., 2026; Wang et al., 2026).Other work explores self-contained evidence chains, attacker-chosen false evidence, or target-system feedback (Chang et al., 2025; Zhang et al., 2026a; Xi et al., 2026).Source: §2 · pp. 2–3
• CPA-RAG increases linguistic variation with prompt templates and heterogeneous generators, but filters candidates individually rather than constraining pairwise diversity in the retained set (Li et al., 2025).DnD coordinates style, support framing, lexical overlap, and a complementary Doubt role across a bundle, without target-generator outputs or gradients.Source: §2 · p. 3

Defenses against corrupted retrieval

• RAG defenses use post-retrieval filtering, conflict-aware reasoning, or robust aggregation, including clustering, similarity analysis, denoising, consistency checks, and group-level aggregation.The cited methods include TrustRAG, RAGuard, RAGDefender, InstructRAG, SeCon-RAG, Astute RAG, RobustRAG, and ReliabilityRAG.Source: §2 · p. 3

3 Problem Formulation

• A RAG system retrieves top-K passages from a clean corpus, may apply a defense, and uses a target LLM; retrieval depth K and poison budget B are independent parameters.The downstream procedure covers filtering, reranking, grouping, and aggregation across passage groups.Source: §3 · p. 3

3.1 Targeted Corpus Poisoning

• For each evaluation question, the attacker preselects an incorrect target answer and constructs a question-specific poison set limited to B passages.The complete query-specific poison sets are inserted into a shared corpus.Source: §3.1 · p. 3
• The attacker modifies only the corpus; the question, deployed retriever, defense, and target LLM remain unchanged.The poison budget applies separately to each question even though the corpus is shared.Source: §3.1 · p. 4
• Strict success requires the final response to contain the target answer and exclude the reference answer; responses containing both count as failures.The objective maximizes strict targeted attack success subject to the per-question poison budget.Source: §3.1 · p. 4, §3.2 · p. 4

3.2 Threat Model

• The attacker knows each question, reference answer, and preselected target answer, and may use auxiliary language models and public embedding models.The target answer is fixed before candidate generation.Source: §3.2 · p. 5
• Black-box access reveals no deployed-retriever rankings, scores, parameters, or gradients; white-box access adds only retriever gradients for retrieval-facing optimization.In both settings, construction receives no clean retrieved passages, defense decisions, target-generator outputs or logits, or observed attack success.Source: §3.2 · p. 5

4.1 Overview

• DnD coordinates poison-passage realization and evidential roles to address uncontrolled set-level redundancy in independently generated passages.In the default multi-passage setting, Divide supplies direct support and Doubt contributes one complementary passage; with B = 1, Doubt is omitted.Source: §4.1 · p. 5
• Passage construction and validation precede retrieval adaptation, and neither receives feedback from the evaluated defense, target generator, or observed attack success.A writer proposes role-conditioned candidates, a frozen verifier checks them, and a deterministic controller enforces set-level overlap constraints.Source: §4.1 · p. 5

4.2 Divide: Diversifying Target Support

• Divide plans each direct-support passage relative to the already accepted set, while requiring every passage to preserve a recoverable path to the target answer.A style-and-support ledger tracks earlier plans so later passages add distinct routes rather than uncoordinated restatements.Source: §4.2 · p. 6
• Divide separately checks style fidelity and lexical overlap; style variation can disperse representations, while maximum and mean ROUGE-L F1 constraints limit pairwise wording reuse.The maximum catches an isolated near-duplicate pair, while the mean limits aggregate reuse; failed checks prompt local revision and revalidation.Source: §4.2 · p. 6

4.3 Doubt: Reframing Answer Conflict

• Doubt qualifies a plausible evidential route toward the reference answer and presents a later or independent cross-check supporting the target answer.It adds an answer-conflict role rather than another direct rationale, without stating the reference answer or instructing the model which source to trust.Source: §4.3 · pp. 6–7
• After role construction, the controller rechecks redundancy and the verifier jointly checks target consistency and recoverability across the assembled set before retrieval adaptation.A failed check triggers local revision followed by full-set revalidation.Source: §4.3 · p. 7

5.1 Experimental Setup

• Experiments use HotpotQA and Natural Questions; matched PR–DnD runs share corpora, poison budget, retrieval depth, systems, and evaluator.Source: §5.1 · pp. 7–8

5.2 Overall Attack Effectiveness

• 14.07 percentage points under BB and 16.15 points under WB: DnD raises mean ASR over PR from 53.37% to 67.44% and 52.26% to 68.41%, respectively.Source: §5.2 · p. 8
• 26.67 and 34.00 percentage-point TrustRAG gains and 24.00 and 35.33-point SeCon-RAG gains accompany DnD wins in all 12 matched comparisons.The gains are under BB and WB, respectively, for each defense.Source: §5.2 · p. 8, Table 1 · p. 9
• DnD gains 58.00 points against RAGuard under BB and 60.00 under WB; across 27 target-generator–configuration combinations, DnD-BB uniquely leads 16 and ties eight.Source: §5.2 · p. 9

5.3 Ablation Studies

• 6.4–7.3 percentage points: allocating one of B=2–5 poison slots to Doubt outperforms all-direct support at every budget.The comparison evaluates the set-level allocation policy, including Doubt’s interaction with direct support.Source: §5.3 · p. 10, Table 2 · p. 10
• Removing both ROUGE-L constraints cuts defended ASR from 43.6% to 26.5% and survival from 90.5% to 42.9%, while Vanilla remains 93.0–94.8%.Source: §5.3 · p. 10, Table 2 · p. 10
• Max-only nearly matches Max+Mean in defended ASR (43.8% vs. 43.6%) and survival (90.3% vs. 90.5%); Mean-only exceeds Neither on both measures.The maximum constraint is the stronger individual control, while the mean constraint remains beneficial on its own.Source: §5.3 · p. 10, Table 2 · p. 10
• ROUGE-L yields the highest defended ASR (43.6%) and survival (90.5%) among tested overlap metrics, with metric-dependent separation concentrated in filtering.Source: §5.3 · p. 10, Table 2 · p. 10

• DnD is a distributed corpus-poisoning attack designed for defenses that jointly compare retrieved evidence.Source: §6 · p. 11
• It combines distinct document styles and target-support framings, pairwise lexical-overlap control, and a passage casting doubt on evidence for the reference answer.Source: §6 · p. 11
• Across HotpotQA and Natural Questions, three target LLMs, and nine RAG settings, DnD matches or outperforms prior attacks in most configurations; the results motivate defenses against coordinated manipulation across stylistically distinct passages.Source: §6 · p. 11

• The evaluation uses fixed 100-question subsets of HotpotQA and Natural Questions, constrained by computational and API budgets.Source: Limitations · p. 11
• It evaluates three open-weight target generators and excludes proprietary closed-source models.Source: Limitations · p. 11
• Some recently proposed defenses are not evaluated, as the defense landscape is rapidly evolving.Source: Limitations · p. 11

Ethical Considerations

• The proposed techniques could manipulate answers from RAG systems that accept untrusted knowledge-base content; the stated aim is to evaluate defenses and motivate stronger protections.The work describes this as a dual-use security problem.Source: Ethical Considerations · p. 11
• Experiments used public benchmarks and local pipelines; no deployed services or third-party corpora were attacked, and poisoned passages remained within the benchmark environment.The work also reports no human participants or newly collected personal data.Source: Ethical Considerations · p. 11

A Additional Evaluation Results

• The appendix adds Natural Questions results, dense-retriever sensitivity, HotpotQA poison-budget sensitivity, and auxiliary target-answer precision and F1.BB and WB denote black-box and white-box retriever access, respectively.Source: A Additional Evaluation Results · p. 14

A.1 Results on Natural Questions

• 6.52 percentage points (BB) and 13.52 points (WB): DnD raises average NQ strict-ASR over PR from 54.11% to 60.63% and from 52.30% to 65.81%, respectively.Averaged across 27 matched target-generator–configuration cells; after per-generator averaging, DnD improves over PR for all three generators under both access settings, with especially consistent gains for InstructRAG, TrustRAG, SeCon-RAG, and RAGuard.Source: §A.1 · p. 14

A.2 Sensitivity to the Dense Retriever

• 59.0% versus 58.9% mean strict-ASR for ANCE and Contriever, while DPR-single yields 40.8%; poison retrieval recall is 81.1%, 85.9%, and 42.6%, respectively.The sensitivity run uses DnD-BB at B = K = 5; the table averages strict-ASR over both datasets and three target LLMs, with equal weighting across eight configurations in the mean row.Source: §A.2 · p. 15, Table 4 · p. 16
• The lower ASR with DPR-single co-occurs with lower poison retrieval recall, but the experiment does not isolate recall as the cause because retriever replacement also changes rankings and retrieved context.The authors describe the pattern as consistent with retrieval recall contributing to the difference, not as isolating that factor.Source: §A.2 · pp. 15–16

A.3 Poison-Budget Performance on HotpotQA

• DnD exceeds access-matched PR at all five poison budgets under both access settings, and its averages increase monotonically from B = 1 to B = 5.At K = 5, the averages cover three target LLMs and nine RAG configurations; the advantage appears in the single-passage case and persists through the evaluated multi-passage range, where passages include Doubt.Source: §A.3 · pp. 16–17, Figure 2 · p. 17

A.4 Auxiliary Metrics

• 6.3 and 6.5 percentage points: DnD-BB improves HotpotQA precision and F1 over PR-BB, respectively; DnD-BB ranks first on both metrics, with DnD-WB second.Across both benchmarks, a DnD variant achieves the highest precision and F1 on each.Source: §A.4 · p. 17
• 5.7 and 6.1 percentage points: DnD-WB outperforms PR-WB on NQ precision and F1, respectively, and ranks highest on both metrics.The metrics use normalized token overlap between the generated response and target answer, with F1 capturing precision and target-answer coverage.Source: §A.4 · p. 17

Final-bundle comparison

• Across all four dataset–access conditions, DnD has lower final-bundle Smean and Smax than matched PR, with paired 95% confidence intervals below zero (p < 0.0001 in all comparisons).Table 7 reports paired differences as DnD − PR; lower values indicate greater representation-space dispersion.Source: Table 7 · p. 18, §A.5 · p. 19

Metric

• For each exact B = 5 bundle, normalized Contriever embeddings yield Smean for aggregate within-bundle concentration and Smax for its most similar pair; lower values mean greater dispersion.Both statistics use the ten unordered passage pairs; ROUGE-L measures lexical overlap, while Contriever cosine similarity measures concentration in the evaluated retriever’s representation space.Source: §A.5 · pp. 17–18

Final-bundle comparison

• Under BB access, DnD reduces Smean by 0.1884 and 0.2122 and Smax by 0.1668 and 0.1647 on HotpotQA and NQ, respectively.Every BB question has lower Smean and Smax under DnD than under PR; DnD construction uses no evaluated Contriever rankings, scores, parameters, or gradients.Source: §A.5 · p. 19
• Under WB access, DnD has lower Smean for 88% of questions on each dataset, and lower Smax for 83% of HotpotQA and 89% of NQ questions.Paired confidence intervals remain separated from zero for both statistics.Source: §A.5 · p. 19

Pre-adaptation representation structure

• Before retrieval adaptation, DnD reduces body-level Smean by 0.1424 on HotpotQA and 0.1353 on NQ, and Smax by 0.1428 and 0.1397, respectively.The difference remains visible after BB and WB adaptation; passage construction establishes the representation structure and the retrieval-facing stage preserves it.Source: §A.5 · p. 19

Data Selection and Evaluation Protocol

• Each benchmark uses the first 100 eligible non-yes/no questions after seed=12 shuffling, with unambiguous reference answers and distinct type-compatible targets.Eligibility is set before construction without retrieval results, model outputs, defense outcomes, or strict-ASR, and the query–target sets are frozen across evaluations.Source: B Implementation Details · p. 19

Evaluation protocol

• The default evaluation uses poison budget B = 5, retrieval depth K = 5, three target LLMs, nine RAG configurations, and fixed 100-query sets.PoisonedRAG and DnD share query–target pairs, corpora, budgets, retrievers, target models, and configurations; each cell uses seed=12.Source: B Implementation Details · p. 19

Models

• Both attacks use gpt-5-mini for construction and Gemma-4-E4B-it for verification; target LLMs are Llama 3.1-8B-Instruct, Qwen2.5-7B-Instruct, and Mistral-7B-Instruct-v0.3.Gemma verifies construction constraints but does not access retrieval results, target-model outputs, defense outcomes, or ASR.Source: B Implementation Details · p. 19

Attack Construction

• At B = 5, each DnD bundle contains four complementary direct-support passages and one Doubt passage.Construction allows at most three trajectories per query and five accepted local repairs per trajectory; the first bundle passing checks is frozen without retrieval- or ASR-based selection.Source: B Implementation Details · pp. 19–20
• Passage diversity is measured with pairwise ROUGE-L F1 over all ten unordered pairs, with thresholds fixed before evaluation and not tuned on outcomes.Maximum and mean scores must be at most 0.25 and 0.220 for frozen bodies, and 0.25 and 0.235 after BB formatting.Source: B Implementation Details · p. 20

Retriever Access and Optimization

• BB construction uses no retriever gradients; WB applies HotFlip independently to each passage while keeping semantic bodies frozen.WB uses 30 iterations, 100 candidates per iteration, dot-product optimization, and seed=12; Contriever uses average pooling without L2 normalization, dot-product similarity, and exact retrieval.Source: B Implementation Details · p. 20

Target Generation and Compute

• Target generation uses LMDeploy PytorchEngine in FP16 with temperature 0.01, max_new_tokens=500, batch size 1, and maximum prefill length 8192.Evaluation used up to ten NVIDIA Quadro RTX 6000 GPUs and approximately 183 evaluation GPU-hours.Source: B Implementation Details · p. 20

RAG Configurations

• The nine RAG configurations comprise Vanilla and eight defenses, using official implementations and identical settings for every attack.TrustRAG and SeCon-RAG use threshold 0.88; other stated settings include RobustRAG α = 0.3 and β = 3, and RAGuard top five with clean-reference α = 0.025.Source: B Implementation Details · p. 20