Search papers, labs, and topics across Lattice.
This paper introduces PURPOSE, a novel black-box poisoning attack designed to enhance the effectiveness of knowledge poisoning in Retrieval-Augmented Generation (RAG) systems by reframing the injection of false information as a conflict-minimizing update. By extracting query-related facts and grounding them in a pivot event, PURPOSE allows the injected content to align with what the resolver might verify, thereby increasing the likelihood of steering the generator toward a target answer. The method achieves the highest attack success rate across multiple benchmarks and configurations, outperforming previous approaches by an average of 9.7 percentage points in attack success rate.
A novel poisoning attack that cleverly disguises misinformation as conflict-minimizing updates, achieving unprecedented success rates against RAG systems.
In Retrieval-Augmented Generation (RAG), post-retrieval conflict resolution arbitrates among noisy or contradictory retrieved passages. However, the robustness of this safeguard against knowledge poisoning has not been adequately studied. Existing black-box poisoning methods all assert the target answer in frontal contradiction with what the resolver treats as settled, the very signal these methods are built to detect. We propose PURPOSE, a strict black-box poisoning attack that reframes the injection as an update that minimizes conflict, rather than as a counter-claim. PURPOSE extracts query-related facts approximating the resolver's possible reference, then grounds a pivot event in them to keep the injection consistent with what the resolver might verify while steering the generator toward the target answer. Across three QA benchmarks, five generators, and three conflict-resolution methods, PURPOSE attains the highest attack success rate (ASR) in 35 of 45 settings and exceeds the strongest prior attack with +9.7 mean ASR points. These results show that our poisoning method is effective against conflict resolution in RAG and identify non-contradicting injection as a practical mode to enhance poisoning attack.
