💻 computer science

DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial

This paper introduces DenialRAG, a novel single-document RAG poisoning attack that explicitly names and refutes the correct answer within a retrieved passage to steer LLMs toward attacker-chosen wrong answers, demonstrating that its effectiveness is highly model-dependent and that current defenses offer only partial, non-uniform protection.

Original authors: Abay Zhurekbay, Tao Liu, Fan Li

Published 2026-08-05

📖 3 min read☕ Coffee break read

CC BY 4.0

Original authors: Abay Zhurekbay, Tao Liu, Fan Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, chaotic library where every book, blog post, and wiki entry is a potential clue. Now, imagine a super-smart robot librarian who has read almost everything but gets stuck when it needs to know something very new or very specific. To fix this, we gave the librarian a special tool: a "Retrieval-Augmented Generation" (RAG) system. Think of this as a magical magnifying glass. When you ask a question, the glass instantly finds the most relevant pages from the library, hands them to the robot, and the robot uses those pages to write its answer. It's like having a genius who can instantly look up facts instead of relying only on what they memorized years ago. This is amazing for keeping information fresh, but it has a spooky side: what if someone sneaks a fake page into the library? If the librarian grabs that fake page, the robot might believe the lie and tell you a wrong answer with total confidence. This is the world of "corpus poisoning," where the danger isn't hacking the robot's brain, but tricking the library it trusts.

Enter DenialRAG, a new study that explores a sneaky way to trick these systems. The researchers asked a bold question: What if, instead of hiding the truth, we tell the robot the truth and then immediately tell it why the truth is wrong? Most previous tricks tried to whisper the wrong answer without mentioning the right one, fearing that mentioning the truth would wake up the robot's memory and ruin the trick. But the authors of this paper discovered that this fear might be unnecessary. They created a "poisoned" document that explicitly says, "You might think the answer is X, but that's actually a mistake! The real answer is Y, and here is why Y is better." They call this DenialRAG.

The study tested this idea against eight different robot brains (Large Language Models) and three different types of questions. They found that this "deny the truth" strategy is incredibly effective, especially on certain models. In fact, on some systems, it worked better than any other trick they tried, achieving a success rate as high as 94% on specific tests. The researchers also tried to stop the attack using five different safety nets, like asking the robot to be more skeptical or rewriting the question. While these safety nets helped, they didn't stop the attack completely; the "DenialRAG" trick still worked in many cases, leaving a significant chance of the robot giving the wrong answer.

The paper suggests that the secret sauce isn't just lying; it's the conflict. By putting the correct answer and the fake answer in the same paragraph and resolving the argument in favor of the fake one, the poison becomes a self-contained story that the robot finds hard to ignore. The study also showed that not all robots are equally gullible. Smaller, cheaper models were easily fooled, while the newest, most powerful models were harder to trick, though not impossible. The researchers conclude that there is no single "magic shield" that stops all these attacks. Instead, the danger depends heavily on how the attack is written and which robot is reading it. It's a reminder that in the age of AI, even a single sentence in a library can change the story the robot tells you.

Technical Summary of "DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial"

Problem Statement
Retrieval-Augmented Generation (RAG) systems, which condition Large Language Model (LLM) generation on external documents, are vulnerable to corpus poisoning. In this threat model, an adversary inserts a crafted document into the retrieval corpus to steer the generator toward an attacker-chosen wrong answer ( $Y$ ) without accessing the model weights, system prompts, or retriever internals. While prior single-document attacks (e.g., PoisonedRAG, AuthChain, CorruptRAG) have demonstrated that a single poisoned passage can mislead RAG systems, they typically avoid explicitly naming the correct answer ( $X$ ). The prevailing assumption is that mentioning $X$ might activate the model's parametric knowledge, causing it to reject the poisoned content. This paper investigates whether avoiding $X$ is necessary or if explicitly naming and refuting it could be a more potent attack vector.

Methodology: DenialRAG
The authors propose DenialRAG, a single-document poisoning attack that explicitly embeds the conflict between the correct answer ( $X$ ) and the attacker-chosen answer ( $Y$ ) within the poisoned passage itself. Rather than suppressing $X$ , the attack names it and provides an attacker-controlled explanation for why it should be rejected in favor of $Y$ .

The attack pipeline operates in two phases:

Offline Attack Time: Given a target query $q$ $q$ , the correct answer $X$ $X$ , and the target wrong answer $Y$ $Y$ , the attacker uses an LLM to generate a short (≤100 words) poisoned passage. This generation involves two calls:
- Feature Extraction: Identifies the question intent and salient evidence nodes (entities, dates) to ensure retrieval relevance.
- Passage Construction: Generates a structured passage containing four components:
  1. Opening: Asserts $Y$ as the definitive answer with a concrete detail.
  2. Evidence Weaving: Incorporates the extracted evidence nodes to align with the user query.
  3. Embedded Denial: Explicitly names $X$ , characterizes it as a misconception or outdated value, and provides a reason for its rejection.
  4. Closing Authority: Reaffirms $Y$ with an institutional or record-based citation.
    The resulting document is inserted into the retrieval corpus $K$ .
Online Query Time: When a user submits $q$ , the retriever selects the poisoned passage (due to its high lexical/semantic overlap). The generator, receiving a context where $X$ has already been acknowledged and "explained away," is steered toward outputting $Y$ .

Key Contributions

Novel Attack Mechanism: The introduction of DenialRAG, which challenges the assumption that correct answers must be avoided in poisoning attacks. It demonstrates that explicitly naming $X$ and embedding a local resolution of the conflict in favor of $Y$ can be highly effective.
Systematic Evaluation: A comprehensive evaluation across three open-domain QA datasets (Natural Questions, HotpotQA, MS-MARCO), eight target LLMs from four vendors (ranging from cost-tier to frontier models), and four existing single-document poisoning baselines.
Defense Analysis: An assessment of five inference-time defenses (Paraphrase, InstructRAG, TrustRAG, RobustRAG, AstuteRAG) to determine if they can mitigate single-document attacks.
Component and Stability Analysis: Ablation studies identifying the "embedded denial" as the most critical component, and cross-model analyses showing that attack effectiveness is not uniform but depends heavily on the interaction between the poisoning mechanism and the target model's alignment and parametric knowledge.

Results

Attack Effectiveness: DenialRAG achieves the highest Attack Success Rate (ASR) on Mistral-7B across all three datasets (89%, 94%, 86%). However, effectiveness is strongly model-dependent. On frontier models (e.g., GPT-5.2, GPT-5.5), other attacks like PIA-direct (direct assertion) or CorruptRAG-AK (freshness update framing) often outperform DenialRAG. For instance, CorruptRAG-AK dominates on GPT-5.5, while DenialRAG's performance drops significantly on frontier models compared to cost-tier models.
Defense Robustness: Inference-time defenses reduce ASR in many settings but fail to provide uniform protection.
- Paraphrase shows limited effect.
- InstructRAG and TrustRAG reduce ASR for some attacks but leave significant residual risk for DenialRAG and CorruptRAG-AK, particularly when the poisoned passage explains the conflict itself.
- RobustRAG and AstuteRAG show strong reductions in specific settings (e.g., AstuteRAG reducing DenialRAG ASR to ~8% on GPT-5.2) but remain ineffective against DenialRAG on Mistral-7B (ASR remains ~77-86%).
Ablation Findings: Removing the "embedded denial" (i.e., only asserting $Y$ ) causes the largest drop in ASR (approx. 17 percentage points on average), confirming that the mechanism of explaining why $X$ is wrong is the primary driver of success. Explicitly naming $X$ is also crucial; omitting the name of the correct answer reduces effectiveness.
Model Regime Stability: DenialRAG shows the largest performance drop when moving from cost-tier to frontier models (a 30.3 percentage point drop), suggesting that stronger models are better at cross-checking the explicit contradiction presented by DenialRAG against their parametric knowledge. Conversely, attacks framing the conflict as a "freshness update" (CorruptRAG-AK) remain more stable across model regimes.

Significance and Claims
The paper claims that RAG poisoning risk cannot be characterized by a single attack family or a single target model. The effectiveness of a poisoning attack is highly dependent on the specific interaction between the attack mechanism (e.g., denial vs. assertion vs. update framing) and the target LLM's architecture and alignment.

The authors emphasize that while DenialRAG is a potent new vector, particularly for cost-tier models, it is not universally superior. The study highlights that defenses are often non-uniform; a defense that mitigates one type of poisoning (e.g., direct assertion) may leave the system vulnerable to another (e.g., embedded denial or freshness updates). Consequently, the paper concludes that understanding RAG security requires analyzing diverse attack mechanisms across a spectrum of models and defenses, rather than relying on a single metric or model class to define the threat landscape.

Technical Summary of "DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial"

More like this