LENS: The Sum Is Worse Than the Parts for Set-Level Poisoning in Retrieval-Augmented Generation
LENS poisons RAG by composing document sets whose attack succeeds only when the full set is retrieved.
LENS is a black-box multi-agent method for set-level compositional poisoning of retrieval-augmented generation. Individually plausible documents jointly steer a frozen RAG system to a target answer, while every proper subset fails to do so alone. Across four benchmarks and three generators, returned packets reach 0.852 full-set attack success and 0.784 post-retrieval ASR@5, versus 0.069 for the strongest proper subset. Against the same frozen manifest, LENS raises all-attempt E2E-Strict@5 from 0.244 to 0.363 and remains ahead of four published defenses by 0.141 average defended ASR@5.
- LENS composes document sets that redirect RAG only when the full set is used.
- Every proper subset is designed to remain insufficient to induce the target answer.
- Full-set ASR is 0.852 and post-retrieval ASR@5 is 0.784 across four benchmarks.
- The strongest proper subsets reach only 0.069 attack success.
- LENS leads four published defenses by 0.141 average defended ASR@5.
From the original article
1 min read at arxiv.orgRetrieval-augmented generation (RAG) aggregates evidence from multiple external documents, yet this joint integration creates an underexamined vulnerability: attack effects absent in individual documents can emerge through set-level composition. Existing coordinated attacks do not explicitly enforce that every proper subset remains insufficient in frozen single-round RAG.
By Kaisheng Fan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.