Search papers, labs, and topics across Lattice.
The paper introduces SilentRetrieval, a novel data poisoning attack against Retrieval-Augmented Generation (RAG) systems that uses semantically-preserving adversarial documents to hijack retrieval and manipulate generated answers. The attack employs Coordinated Beam Search to create retrievable and fluent poisoned documents, followed by Context-Adaptive Trigger Generation to insert manipulation triggers. Experiments on Natural Questions and MS MARCO datasets demonstrate high attack success rates (57.5%/54.8% ASR-LLM) with minimal impact on document perplexity, even transferring across different LLMs and retrievers.
RAG systems are surprisingly vulnerable: a tiny amount of carefully crafted, almost undetectable poisoned data can reliably hijack retrieval and manipulate generated answers.
Retrieval-Augmented Generation (RAG) mitigates LLM hallucinations but introduces a critical vulnerability: corpus integrity. We present SilentRetrieval, a two-stage data poisoning attack that hijacks RAG systems through adversarially crafted yet fluent documents. Stage 1 uses Coordinated Beam Search, a multi-token joint optimization method with a fluency-similarity objective, to keep a poisoned host document retrievable while constraining perplexity. Stage 2 uses Context-Adaptive Trigger Generation, a lightweight trigger-fusion step driven by a frozen LLM, to integrate manipulation triggers into document content. Under a one-poisoned-document-per-query evaluation with synthetic target answers, SilentRetrieval achieves 84.6%/81.3% HR@10 and 57.5%/54.8% ASR-LLM on Natural Questions and MS MARCO, while maintaining near-benign perplexity. Cross-model evaluation across four target LLMs shows nontrivial effectiveness under a fixed trigger generator, and transfer tests against unseen retrievers, including ColBERT and commercial embedding models, yield 64.7% average HR@10 under the same injected-corpus protocol. In a sampled Wikipedia-scale evaluation, SilentRetrieval retains 74.2% HR@10 at a 0.016% poisoning ratio. Combined retrieval-side and generation-side defenses reduce attack success substantially but incur a latency trade-off. Human evaluation shows substantially lower flag rates than disfluent baselines, while remaining numerically more suspicious than benign content at the current sample size.
