Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
Researchers present Micro-Collaborative Poisoning, which splits a false claim across documents to poison RAG systems.
The paper introduces Micro-Collaborative Poisoning, which divides a false target claim across several locally plausible documents instead of one malicious passage. The authors test 108 RAG configurations, varying dataset, retriever, retrieval depth, database mix, number of poisoned databases, and generator model. Success comes from accumulating weak adversarial signals, and it rises with larger top-k or several poisoned databases. Clean-database diversity and stronger retrievers reduce the effect, while isolated document checks leave a weaker signature than direct poisoning.
- False claims are split across multiple locally plausible documents.
- Evaluated across 108 RAG configurations and generator models.
- Larger top-k and multiple poisoned databases raise success.
- Isolated inspection shows a weaker signature than direct poisoning.
Full article169 words · extracted from arxiv.org · click to collapse
Retrieval-Augmented Generation (RAG) improves large language models by grounding outputs in external knowledge sources, but this dependency also creates a surface for poisoning attacks. This paper introduces Micro-Collaborative Poisoning, a distributed attack in which a false target claim is divided across multiple locally plausible documents instead of being concentrated in a single malicious passage. We evaluate the attack across 108 RAG configurations by varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. The results indicate that Micro-Collaborative Poisoning is not driven by a single dominant poisoned passage, but by the accumulation of weak adversarial signals across retrieved sources. Increasing top-$k$ and poisoning multiple databases make it more likely that these signals will appear together in the retrieved context, while clean database diversity and stronger retrievers can reduce their influence. The document-level poisoning visibility analysis further shows that this threat is difficult to expose through isolated document inspection, since Micro-Collaborative Poisoning achieves downstream influence while leaving a weaker explicit poisoning signature than direct poisoning.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.21573