Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems
Researchers demonstrate a Hub-Satellite poisoning attack on HNSW RAG with 31.29% success on two million Wikipedia documents.
Researchers present a topology-aware topic-level poisoning attack against large-scale RAG systems that use HNSW approximate nearest-neighbor indexes. Poisoned documents form a Hub-Satellite structure so graph search retrieves them for unseen topic queries, and an entity-claim promotion attack pushes a target claim. On a 2 million-document Wikipedia corpus the attack keeps over 72% retrieval success and reaches 31.29% attack success, outperforming baselines. Existing poisoning defenses do not stop it, which the authors attribute to HNSW graph structure.
- Hub-Satellite documents exploit HNSW reachability under limited search budgets.
- Entity-claim promotion anchors evidence and couples a target entity to a claim.
- On 2M Wikipedia documents, retrieval success stays above 72 percent.
- Attack success is 31.29 percent, and existing poisoning defenses fail.
From the original article
1 min read at arxiv.orgRetrieval-augmented generation (RAG) mitigates hallucinations and knowledge staleness in large language models using external knowledge. However, ingestion from public and third-party sources exposes RAG systems to poisoning attacks. Existing attacks are designed and evaluated under exact retrieval, where poisoned documents participate in global ranking.
By Yufei Chen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.