Search papers, labs, and topics across Lattice.
This paper reveals a fundamental vulnerability in ingestion-time defenses against coordinated poisoning in retrieval-augmented generation (RAG) systems, demonstrating that such defenses can be circumvented by strategically injecting unremarkable documents that collectively manipulate query results. The authors conducted experiments using a BGE-large + HNSW + Qwen2.5-7B pipeline, showing that their attack successfully influenced the generator to emit false claims in 88% of cases, while traditional ingestion-time filters failed to detect the coordinated attack. They propose that robust defense mechanisms must shift focus from admission-time filters to retrieval-time demand detection, which can effectively identify and mitigate such attacks.
Ingestion-time defenses against coordinated poisoning are fundamentally flawed, allowing attackers to manipulate retrieval systems with minimal effort.
Retrieval-augmented generation (RAG) answers a question by retrieving passages from a vector store and trusting them as context, so anyone who can add documents can try to steer the answer. A recent, appealing defense filters poisoning at ingestion, rejecting any document that behaves like a hub. We show it -- and every ingestion-time filter -- is defeated by a coordinated adversary that injects a handful of individually unremarkable documents which together surround one target query and seize its top-k (on BGE-large / BEIR, m=10 documents take 10/10; 9.9/10 on a live HNSW index). The attack is not theoretical. Realized as ordinary fluent text and run end-to-end through a BGE-large + HNSW + Qwen2.5-7B pipeline, it makes the generator emit the attacker's planted claim in 88% of targets, versus 0% without the injection. And no admission-time defense stops it: at ingestion an attack cone is geometrically identical to a legitimate niche upload, so -- measuring this directly -- the strongest trained classifier, given every feature and thousands of examples, separates the two no better than chance, catching 4.2% of attacks at a 1% false-positive rate. We prove this limit for the entire class of ingestion-time statistics (any decision from documents and reference queries alone), and it reproduces -- and worsens -- across two corpora and five encoders. The one signal that separates an attack from legitimate niche ingestion -- a query's demand -- is invisible before retrieval, which is also the escape: a retrieval-time detector that observes demand catches 100% of the attacks at the same 1% false-positive rate. Coverage of the query space by an admission gate is not containment of coordinated poisoning; robust defense must move past the front door, to demand.
