Logical Hijacking of RAG: Single-Document Poisoning Based on Local Optimization

The researchers propose MONOLOGUE, a single-document corpus poisoning framework targeting RAG, aimed at black-box access scenarios, which implants false information through logical hijacking that does not explicitly refute facts. To address the problem that aligned models will conservatively arbitrate explicit contradictions and trigger input guardrails, the method first acknowledges the true information as an authoritative historical baseline, then weaves a sourced record-correction narrative (such as a dated institutional attribution correction), packaging the counterfactual target as the latest update. To avoid suspicious real-time writes, the attack payload is generated entirely offline through local multi-dimensional gated optimization, combined with automated text quality auditing and agent behavior verification. The authors state that in evaluations on three benchmarks, three retrieval backends, and four open-weight generator configurations, the method achieved the strongest overall attack effectiveness among the evaluated single-document poisoning attacks.