Technical Summary: Influence Factors on RAG Poisoning

Problem Statement

Retrieval-Augmented Generation (RAG) systems enhance Large Language Models (LLMs) by grounding responses in external knowledge retrieved at inference time. However, this reliance introduces a critical vulnerability: poisoning attacks. In such scenarios, adversarial documents inserted into the knowledge base can manipulate both the retrieval process and the final generated outputs. While prior research has established the feasibility of these attacks, there is a lack of systematic understanding regarding how specific RAG design choices interact to influence susceptibility. Existing work often examines factors in isolation, failing to quantify higher-order interaction effects between retrieval mechanisms, generation models, and knowledge base configurations. This paper addresses the gap by investigating how compound system configurations determine the effectiveness, stealth, and impact of poisoning attacks.

Methodology

The authors conducted a full factorial experimental study comprising 432 unique configurations to systematically evaluate poisoning robustness. The methodology involved varying core pipeline parameters across the following dimensions:

• Datasets: Two question-answering datasets were used: HotpotQA (multi-hop reasoning) and MS-MARCO (open-domain passage retrieval). A curated subset of 100 semantically similar question pairs was constructed to ensure aligned retrieval conditions.
• Retrieval Architectures: Three distinct paradigms were tested:
  • BM25: A sparse, lexical-based retriever.
  • Dense BGE: A dense vector-based retriever using semantic embeddings.
  • Graph-based: A structured approach retrieving evidence by traversing document relationships.
• Retrieval Depth ($k$): The number of retrieved passages was varied (2, 3, and 5) to assess how context window size affects the inclusion of poisoned content.
• Knowledge Base Configuration: The study simulated different risk profiles by varying the number of total databases (1 or 2) and the number of poisoned databases (1 or 2). This included scenarios of single-source compromise, dual-source redundancy with one poisoned source, and total system saturation.
• Document Preprocessing: Chunk sizes (512 vs. 768 tokens) and overlap values (64 vs. 100 tokens) were evaluated to determine the impact of segmentation on poisoning exposure.
• Generator Models: Two LLMs were tested: llama-4-scout-17b-16e-instruct and openai-gpt-oss-120b.
• Poisoning Strategy: Adversarial documents were automatically generated to promote incorrect claims. The strategy ensured high lexical overlap with queries to guarantee retrieval while explicitly avoiding the correct answer.
• Evaluation Metrics:
  • Retrieval-level: Poison@k (presence in top-k), Poison Rank, and Score Margin (difference between best poisoned and best clean score).
  • Generation-level: Abstention Rate, Correct Answer Rate, and Attack Success Rate (ASR).

Statistical analysis was performed using Ordinary Least Squares (OLS) regression to identify main effects and interaction terms (up to third-order) among the variables.

Key Contributions

1. Systematic Factor Analysis: Unlike prior work focusing on individual components, this study provides a comprehensive quantification of how dataset, retriever type, retrieval depth, database composition, chunking, and generator choice interact to influence poisoning outcomes.
2. Database Composition Variable: The paper introduces the "number of databases" and "number of poisoned databases" as experimental variables, analyzing how adversarial redundancy and clean-source competition affect attack success.
3. Interaction Effects: The study identifies that poisoning vulnerability is not attributable to a single component but arises from complex interactions, particularly between the dataset, retriever architecture, and retrieval depth.
4. Granular Metrics: The use of a full factorial design allows for the dissection of whether an attack succeeds due to retrieval failure (poisoned docs not found) or generation failure (poisoned docs found but ignored), providing a more nuanced view of system robustness.

Results

The experimental results highlight distinct drivers for retrieval exposure versus generation success:

• Retrieval-Level Factors:

  • Retriever Architecture: Dense (BGE) and graph-based retrievers generally demonstrated higher robustness than BM25, resulting in lower Poison@k, higher Poison Rank (poisoned docs ranked lower), and smaller Score Margins.
  • Dataset: MS-MARCO showed lower poisoning exposure compared to HotpotQA.
  • Retrieval Depth: Increasing $k$ (from 2 to 5) significantly increased the likelihood of retrieving poisoned passages (higher Poison@k) across all architectures.
  • Interaction: The strongest interaction effect was found between Dataset × Retriever, indicating that the benefit of robust retrievers is dataset-dependent (more effective on MS-MARCO).

• Generation-Level Factors:

  • Generator Choice: The openai-gpt-oss-120b model exhibited a lower Abstention Rate and higher ASR compared to llama-4-scout-17b-16e-instruct, suggesting it is more susceptible to following poisoned context once retrieved.
  • Database Composition:
    • Adversarial Redundancy: Replicating poisoned content across multiple databases ("2 Databases | 2 Poisoned") amplified attack success (higher ASR, lower Correct Answer Rate) by increasing the competitiveness of poisoned passages.
    • Clean Source Mitigation: The presence of an additional clean database ("2 Databases | 1 Poisoned") improved the Correct Answer Rate and pushed poisoned passages lower in the ranking, partially mitigating the attack.
  • Chunking: Variations in chunk size and overlap (512/768 tokens, 64/100 overlap) had a comparatively limited influence on metrics relative to retriever and dataset choices.

Significance and Claims

The paper claims that poisoning vulnerability in RAG is a systemic property arising from the interaction of retrieval, generation, and knowledge-base configuration, rather than a flaw in a single component.

• Design Implications: The findings suggest that improving robustness requires a system-level perspective. Secure design must consider how retrieval configuration (e.g., choosing dense/graph retrievers over BM25), database composition (avoiding adversarial redundancy), and generator behavior interact.
• Mitigation Strategies: The results motivate pre-generation mitigation strategies, such as filtering or down-ranking suspicious passages, as the choice of retriever and the balance of clean vs. poisoned evidence significantly dictate the final output quality.
• Future Directions: The authors modestly note that their findings are based on specific datasets and models. Future work should extend this analysis to larger, less curated query sets, additional poisoning strategies (including adaptive attacks), and a broader range of configuration parameters like re-ranking stages and hybrid pipelines. They also highlight the need to investigate how context window sizes in different LLMs affect susceptibility.