MIRAGE: Misleading RAG with black-box and query-independent poisoning attacks

The researchers propose MIRAGE, a multi-stage attack pipeline that poisons the RAG corpus under a strictly black-box setting unrelated to user queries. The method relies on surrogate model feedback for automatic optimization and includes persona-driven query synthesis, semantic anchoring to improve retrieval visibility, and an adversarial version of Test-Time Preference Optimization (TPO) to enhance persuasiveness. The authors build a new benchmark based on three long-form domain datasets, and experiments claim that MIRAGE outperforms existing baselines in attack effectiveness and stealthiness and can transfer to different retriever and LLM combinations.