InceptionRAG: Covert poisoning attacks against retrieval-augmented generation

1. 01What problem does this paper attempt to solve?

   Single-document explicit poisoning is easily blocked by per-document filtering; InceptionRAG instead uses cross-document implicit logic induction.

   Existing single-document explicit poisoning writes the malicious conclusion into one document, and isolated filtering can check a single document for anomalies; the problem to solve is corpus poisoning that splits the conclusion across multiple documents, each individually harmless, and only together derived through multi-hop reasoning.

   • Scenario: The authors state that RAG extends the trust boundary to external knowledge bases. An attacker injects toxic passages to manipulate retrieval so that the LLM generates a specified target answer. The authors cite high-risk uses including legal, medical, and financial.
   • Existing shortcomings: The authors state that PoisonedRAG, HijackRAG, and others concentrate the payload in a single document and explicitly associate the query with the answer, leaving traces such as attention variance, keyword density, or cross-document contradictions. Defenses that check document by document can therefore block them. Whether these defenses remain effective against indirect logic induction, the authors state, is still an open question.
   • Core observation: The authors' intuition is dormant in isolation, toxic upon aggregation. A single document appears unrelated to the query; after being aggregated into the context, the model uses syllogistic reasoning to derive the target answer on its own. The authors state that stronger reasoning ability increases vulnerability to this type of attack.
   • Proposed content: InceptionRAG uses proxy entities to construct attribute documents and bridge documents, uses ZOSO to generate authoritative suffixes, and uses dual-end injection to compete for retrieval ranking. They also propose the document-isolation defense HODOR to cut off adversarial logic dependencies.
   • Threat model:
     • Goal: For any set of target queries, make RAG output the attacker-specified a_i^*.
     • Knowledge: Strict black-box for both the retriever R and the generator G. No parameters, gradients, embedding weights, or token probabilities; only public API submission of q and observation of the final y.
     • Capability: Can inject a small number of forged documents, with |D_adv| ≪ |D_clean|. Cannot modify or delete existing benign documents. The authors cite editable crowdsourcing platforms and public forums as injection surfaces.
     • Victim system: RAG built from open or user-contributed sources. Success means the generated result is the specified target answer.

   Collapse this answer

2. 02What related research exists?

   The comparison focuses on single-document poisoning and isolated defenses, with baselines of PIA, PoisonedRAG, and HijackRAG.

   RAG and Single-Document Poisoning

   • REALM, vanilla RAG, RETRO, REPLUG, Self-RAG: The paper treats these as RAG frameworks in the preliminaries, involving end-to-end fine-tuning, chunked cross-attention, retrievers that optimize a frozen generator using perplexity, and self-reflective tokens, respectively.
   • PoisonedRAG and HijackRAG: Two-stage attacks that first aim for top-k, then induce the target answer. The former constructs seemingly realistic passages explicitly containing the target answer; the latter uses hijacking prompts to force generation. Both inject the original query into the payload during the retrieval stage. The authors claim these put the entire target answer in a single document, lacking stealth.
   • PIA: Originally hijacks instruction following; when adapted to RAG, it mainly attacks the generator and does not handle retrieval. The authors categorize all these attacks as single-document injection.

   Broader Attack Goals and Methods

   • Goals are not limited to incorrect answers: LIAR reduces robustness; others include denial-of-service, systematic bias, and BERA suppressing self-correction in RAG. The paper only describes these, without experimental comparison to this work.
   • Methods include trigger-based backdoors, Joint-GCG, NeuroGenPoisoning, as well as DISARMRAG which modifies retriever parameters, and BRRA which hijacks retrieval in embedding space.
   • Domains and structures: code generation, medical, fact-checking, as well as Multimodal RAG and GraphRAG. The paper claims attacks vary with the underlying structure.

   Defenses

   • Filters in experiments: AVFilter uses attention variance, FilterRAG uses frequency density of query-related terms, RAGForensics uses LLM judgment on whether passages lead to incorrect outputs, MIS finds maximum independent sets on contradiction graphs, and RAGDefender removes semantically clustered suspicious passages.
   • Architectural isolation and generation-time monitoring: StruQ and CaMeL separate instructions from data; RevPRAG looks at neuron activations, FiSCoRe and Sufficient Context refuse to answer under uncertainty, and DefensiveToken strengthens system instructions. The authors claim InceptionRAG's payload is weakly correlated with the query, so existing anomaly detection may treat it as common noise.

   Baselines and Benchmarks

   • Baseline methods: PIA, PoisonedRAG, HijackRAG.
   • Benchmarks: NQ, HotpotQA, MS-MARCO. The default retriever is Contriever, consistent with previous poisoning studies.

   The authors position this work as implicit logic induction exploiting logical proximity between two dormant passages, rather than explicit single-document injection; they claim this corresponds to a structural blind spot in single-document defenses.

   Collapse this answer

3. 03How does the paper address this problem?

   Using proxy entities to split the answer into two dormant documents, then using ZOSO suffixes and dual-end injection to complete black-box poisoning.

   InceptionRAG does not write the target conclusion in a single document, but instead uses proxy entities to make two documents, then relies on suffixes to make the model prioritize this reasoning path, and uses dual-end injection to compete for top-k entry.

   Problem setup

   Given a query q and target answer y_t, the attacker optimizes the adversarial set P. The filtering function Φ removes suspicious passages from the retrieved context. The goal is to jointly increase the probability of "P being retrieved" and "still generating y_t after filtering":

   max_P P(P ⊆ R(q, D)) × P(y = y_t ∣ q, Φ(C ∪ P))

   This expression means: even with filtering Φ, both the retrieval probability and the generation probability must be raised simultaneously. The process has three stages: payload construction, retrieval probability maximization, and global suffix adaptation.

   Logic trap

   • The proxy entity is of the same type and semantically similar to the target entity, but is not the entity the user asked about.
   • Attribute document writes the proxy entity as having a factual statement with the target answer, without naming the target entity.
   • Bridge document only states that the two are equivalent on the asked attribute, without writing the explicit answer. When both documents are retrieved, the model is pushed toward transitive inference: the proxy entity's value transfers to the target entity.
   • Appendix C gives the complete prompts for entity extraction, the two documents, and suffix candidates. During optimization, each candidate suffix is not written into the knowledge base; instead, the query and the two payload documents are submitted to the victim RAG, which retrieves from the clean corpus and generates, using whether the target answer is present as feedback. The final payload is injected only after the three stages are complete.

   ZOSO suffix

   Benign evidence may directly state the true answer, thereby overpowering the logic trap. The authors therefore add one type of suffix to each of the two documents: anchor to raise authority, and bridge to promote relation transfer across passages.

   • The proxy LLM first generates seeds of different styles and then paraphrases to expand the candidate pool. The paper does not give the name of this proxy LLM. Appendix C.3: 20 seeds per type, 25 variants per seed. This stage uses 2 proxy calls and does not query the victim model.
   • The golden set is stratified by the attribute type of the target answer. In the appendix implementation, this set has 40 entries. Reward: containing the target answer adds points, containing the true answer deducts points, and only mentioning the proxy entity gives a smaller addition. Table 8's weights are +1.0 / −2.0 / +0.2.
   • Suffixes are mapped to continuous space via BERT-base-uncased, the gradient of the posterior mean is estimated with an NTK Gaussian process and ascended, then the cosine-nearest unevaluated candidate in the pool is taken. Each suffix type first evaluates 20 K-means representatives, then 30 rounds, for 50 total; shortlist size 10; learning rate 0.05. Bridge is fixed while optimizing anchor, then the reverse, to avoid joint search.

   Retrieval and suffix adaptation

   • Removing stop words yields keywords. The header places the query at the document start, and the footer turns keywords into pseudo-metadata, exploiting dense retrievers' sensitivity to first/last positions and word overlap. Appendix A.2 gives layout examples.
   • Polymorphic wrapping: adding random identifiers and timestamps around the optimized suffix makes the surface string non-fixed while the core instruction remains.
   • CTTFT: Level 1 uses the global suffix; if it fails, search among the 12 nearest neighbors of the anchor; if that fails, search the 12 nearest neighbors of the bridge. If the logic is induced but blocked by filtering, try up to 10 neighbor combinations, counted within the 25-query-per-target cap. The authors state that effective suffixes cluster in embedding space, so when failing, alternatives are sought among neighbors.

   Success criteria

   • ASR: Success if the target answer or a paraphrased alias appears as a substring in the generation. Appendix B.3 states this follows PoisonedRAG's substring criterion and expands the paraphrase set.
   • BR: Among samples that succeed without defense, the proportion that still succeed after filtering is enabled. The defense only acts on samples that originally succeeded.
   • Appendix B.1: temperature is 0.0 when interacting with the victim LLM, maximum output 100 tokens, and an output format requiring answering based on context.

   Collapse this answer

4. 04What experiments did the paper conduct?

   With default Gemini-2.0-Flash, k=10, N=2, the no-defense ASR across the three datasets is 88.0%, 90.3%, and 83.3%.

   Experimental Setup

   • Generators: Default Gemini-2.0-Flash. Also evaluated GPT-3.5-Turbo, Grok-4-Fast-Reasoning, Qwen-3.5-plus, and the open-source white-box models Mistral-7B-Instruct-v0.2, Vicuna-7B-v1.5, Llama-2-7B-Chat, Qwen-3-8b as referred to in the paper. The attack setting remains black-box, without using gradients.
   • Retrievers: Default Contriever; also Contriever-MS, ANCE.
   • Data: NQ corpus with 2,681,468 passages, HotpotQA with 5,233,329 passages, both from Wikipedia; MS-MARCO with 8,841,823 web documents. Section 5.1 does not specify the number of test queries.
   • Protocol: Retrieval window k=10, number of injected documents fixed at N=2. The authors state this corresponds to benign passages being roughly 4 times the malicious payload, and claim previous studies commonly used k=5.
   • Baselines: Baselines are PIA, PoisonedRAG, HijackRAG. Filters are AVFilter, FilterRAG, RAGForensics, MIS, RAGDefender. MIS's contradiction detection uses DeBERTa-v3-base.
   • Metrics and generation settings: ASR is substring matching; BR is defined in question 3. Appendix B.1 sets temperature to 0.0. The paper does not report the number of repetitions.

   Main Results

   Section 5.2 states Table 1 summarizes all results and writes the no-defense ASR for default Gemini-2.0-Flash on NQ and HotpotQA as 88.0% and 90.3%, matching the InceptionRAG row in the table. The table header no longer repeats the model name. The table below shows the no-defense ASR from that table.

   Swipe horizontally to read the table

   Method	NQ	HotpotQA	MS-MARCO
   HijackRAG	42.0%	49.2%	41.0%
   PoisonedRAG	32.3%	76.2%	51.3%
   PIA	55.3%	80.0%	38.3%
   InceptionRAG	88.0%	90.3%	83.3%

   • The authors claim that without defenses, InceptionRAG outperforms baselines by more than 10–50 percentage points. In Table 11 (no defense), GPT-3.5-Turbo achieves 80.3%, 85.0%, 81.0%, and Grok-4-Fast-Reasoning achieves 83.6%, 87.6%, 81.6% (NQ / HotpotQA / MS-MARCO).
   • NQ with AVFilter: InceptionRAG's ASR is 72.3%, BR is 90.4%. The authors claim existing attacks in the same setting have ASR at most 16.7% and BR at most 51.6%, consistent with PoisonedRAG in Table 1. On RAGForensics, InceptionRAG's ASR across three datasets is 48.0%, 51.0%, 54.0%, and BR is 54.5%, 56.2%, 56.3%.
   • Not the highest in every cell. HotpotQA + FilterRAG: InceptionRAG ASR 15.3%, BR 18.3%, lower than HijackRAG's 32.0% and 64.0%. The authors attribute this to HotpotQA being inherently multi-hop, and adding logic traps amplifies term-frequency-density anomalies. On NQ with RAGDefender, HijackRAG's BR of 39.8% is higher than 32.8%; on MS-MARCO with the same defense, HijackRAG's BR of 61.0% is higher than 52.1%.

   Model Scale

   • The authors claim the evaluation covers 7B to 1,000B parameters and state Figure 3 shows a scale-dependent trend: larger black-box models are more susceptible. The text only gives two numbers: Gemini-Flash at 88.0% and Llama-2-7B at 46.0% on NQ.
   • Their explanation is that larger models are better at multi-hop reasoning and instruction following, allowing them to connect bridge and attribute documents; smaller models often fail to connect them. The text does not provide ASR values for Qwen-3.5-plus, Mistral-7B-Instruct-v0.2, Vicuna-7B-v1.5, or Qwen-3-8b.

   Retrieval Hit Rate and HODOR

   • Query rewriting: Attack documents are constructed based on the original query, and retrieval uses 5 rewrites per question. Table 6 (Contriever) shows 2/2 hit rates: 100.0% for NQ and HotpotQA, 99.8% for MSMARCO, and 0/2 at 0.0%.
   • Retriever variation: In Table 7, 2/2 hit rates are 100.0% for NQ and HotpotQA on Contriever and ANCE; HotpotQA on Contriever-MS is 99.3%. Contriever on MS-MARCO is 95.0% / 3.0% / 2.0%. The authors claim retrieval hijacking holds across these three retrievers.
   • HODOR: Answering each document independently and taking a majority vote cuts the attribute-bridge dependency. The authors claim Figure 5 shows ASR drops across datasets and backends; Figure 8 shows benign accuracy drops on tasks requiring cross-document synthesis like HotpotQA. The text does not provide specific values for these figures.

   Other Ablations and Analyses

   • Table 2: Gemini-2.0-Flash, MS-MARCO, no suffix 40.0%, random suffix 41.3%, ZOSO 83.3%. GPT-3.5, MS-MARCO, random suffix 32.0%, lower than no suffix 33.3%.
   • Table 3: With only global suffix, Gemini, MS-MARCO is 22.0%; CTTFT is 83.3%. GPT, HotpotQA, CTTFT is 86.0%, while Table 2's ZOSO is 85.0%; the paper does not explain the difference.
   • Table 4: Average queries for successful samples are mostly below 2.2; Gemini, MS-MARCO is 4.1. The per-target cap is 25 queries. Level 1 accounts for 51.90%–74.90% of successful sources (nine cells in the table).
   • Table 5: Grok, HotpotQA, brute force 6,621.5 minutes, ZOSO 234.1 minutes, speedup 28.3×. The highest speedup in the table is Gemini, MS-MARCO at 41.1×.
   • Figure 4: On MS-MARCO, attribute count from 1 to 5, the authors claim ASR rises from 84.0% to 97.0%, an increase of 13.0%. They claim NQ and HotpotQA are already above 91% and 92% at N=1, then approach 100%.
   • Table 9: Substring ASR matches LLM review and human evaluation. NQ is 92.0%, 93.0% (Gemini), 92.0% (Grok), 87.0% (GPT), 87.0% (human). The table does not specify sample size, and the values differ from Table 1's 88.0%; the conditions are not explained in the paper. Figure 7 only describes that with N_init=10, ASR rises with search steps then plateaus, and with N_init=20, the starting point is already high with small fluctuations; the text provides no specific ASR values.

   Collapse this answer

5. 05What are some points that can be further explored?

   The paper does not have a separate limitations section; the Conclusion calls for auditing the reasoning process rather than only filtering explicit content.

   Limitations and future directions noted by the authors

   • The paper has no separate Limitations, Discussion, or Future Work section, nor does it frame a low number in a cell as a method limitation.
   • Conclusion: The authors state that next-generation defenses are needed that can audit complex reasoning processes rather than only filtering explicit content.

   Experimental coverage

   • Datasets are NQ, HotpotQA, and MS-MARCO; corpus sizes are written in 5.1.
   • 8 generators and 3 retrievers, listed in 5.1; attack-comparison filters are AVFilter, FilterRAG, RAGForensics, MIS, and RAGDefender, with HODOR additionally evaluated in 5.8.
   • Default k=10, N=2; Figure 4 varies the injection count. Query rewriting produces 5 variants per question (Appendix D.1).
   • Main metrics are substring ASR and BR. Table 9 additionally gives LLM review and human judgment, without reporting sample size. Appendix B.1 states temperature is 0.0. The paper does not report the number of repetitions.
   • 5.1 does not state the number of queries in the main experiments. Appendix B.2 states the golden set has 40 entries, and the optimized suffix pairs are reused for 100 evaluated targets. The name of the proxy LLM used for the ZOSO candidate pool is not given.

   Collapse this answer

6. 06Summarize the main content of the paper

   InceptionRAG poisons RAG through cross-document reasoning; no-defense ASR is high, with FilterRAG on HotpotQA being the exception.

   InceptionRAG is a black-box poisoning of RAG corpora: it does not write the target conclusion into a single document, but splits it into two documents that individually appear harmless.

   • Problem: The authors claim that existing poisoning concentrates the malicious payload in one document, which isolation-based filters targeting attention variance, term frequency density, and cross-document contradictions can counter. Their goal is indirect logic induction: individual documents are dormant, and only become toxic when aggregated.
   • Method: They use semantically similar proxy entities to write attribute documents, then use bridge documents to establish equivalence relations, enabling the model to infer the specified answer through transitivity. ZOSO uses an NTK Gaussian process in embedding space to select authoritative suffixes; dual-end injection aims for top-k; CTTFT continues trying on neighboring suffixes of failed queries, with at most 25 queries per target. The threat model is strict black-box, allowing only a small number of new documents to be injected.
   • Main results: With default Gemini-2.0-Flash, k=10, N=2, Table 1 shows no-defense ASR of 88.0% for NQ, 90.3% for HotpotQA, and 83.3% for MS-MARCO. Under NQ with AVFilter, ASR is 72.3% and BR is 90.4%. Under HotpotQA with FilterRAG, ASR drops to 15.3%, which the authors attribute to the combination of multi-hop data and additional logic traps.
   • Other results: In Table 11, GPT-3.5-Turbo and Grok-4-Fast-Reasoning have no-defense ASR between 80.3% and 87.6%. The text states Llama-2-7B achieves 46.0% on NQ and claims larger models are more likely to connect the two documents. Across three retrievers, the 2/2 hit rate for poisoned documents is mostly 95.0%–100.0% (Table 6, Table 7).
   • Authors' conclusion: The stronger the reasoning ability, the more susceptible the model is to this reasoning-based poisoning. HODOR cuts the dependency between the two documents by answering each document independently and taking a majority vote; the authors claim it reduces performance on benign tasks requiring cross-document synthesis. The Conclusion states that future work should audit complex reasoning rather than only filtering explicit content.

   Collapse this answer

Related papers