Topology-aware topic-level poisoning attack against HNSW-RAG
Start here
The researchers propose a topology-aware topic-level poisoning attack against large-scale HNSW-RAG systems: the poisoning documents are organized into a Hub-Satellite structure, where satellite documents provide competitive entry points in multiple semantic regions, and the Hub enhances local cohesion and facilitates cascading retrieval; the generation stage uses an entity-assertion boosting attack, combining evidence anchoring with entity-assertion coupling, so that the target entity is boosted in different query regions via the target assertion. On a Wikipedia corpus of 2 million documents, the attack achieves a retrieval success rate exceeding 72% and an attack success rate of 31.29%, clearly outperforming the baselines.
Generated by AI from reports · Updated 28 days ago
Attention and developments
Attention, hourly
Now 38, 0% in 24 hours·Peak 38 (Nov 6 04:00)
Related research
This event's paper
- Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems
arXiv · 2026-10-15 · Deep reading
Progress timeline
- arXiv: Adversarial Attacks, Backdoors & PoisoningPoisoning the Neighborhood: Topology-Aware Topic-Level Poisoning Attacks Against Large-Scale HNSW-RAG Systems
Researchers propose a topology-aware topic-level poisoning attack against large-scale HNSW-RAG systems, organizing poisoned documents into a Hub-Satellite structure, where satellite documents provide competitive entry points across multiple semantic regions and the Hub enhances local cohesion and induces cascading retrieval. In the generation stage, an entity-assertion boosting attack is used, combining evidence anchoring with entity-assertion coupling, so that target entities are boosted across different query regions via target assertions. On Wikipedia with 2 million documents, the attack achieves a retrieval success rate above 72% and an attack success rate of 31.29%, clearly outperforming baselines; structural analysis shows that the Hub-Satellite topology does indeed form in HNSW, and existing poisoning defenses cannot mitigate the attack.