SilentRetrieval: Hijacking Retrieval-Augmented Generation via Semantically-Preserving Adversarial Data Poisoning
Abstract
Retrieval-Augmented Generation (RAG) mitigates LLM hallucinations but introduces a critical vulnerability: corpus integrity. We present SilentRetrieval, a two-stage data poisoning attack that hijacks RAG systems through adversarially crafted yet fluent documents. Stage 1 introduces Coordinated Beam Search (CBS), a multi-token joint optimization with a penalized fluency-similarity objective that preconditions a topically relevant host document to remain retrievable after payload insertion while constraining perplexity. Stage 2 employs Context-Adaptive Trigger Generation (CATG), a lightweight trigger-fusion step that uses a frozen LLM to generate triggers contextually integrated with document content. Under a one-poisoned-document-per-query evaluation with synthetic target answers, SilentRetrieval achieves 84.6%/81.3% HR@10 and 57.5%/54.8% ASR-LLM on Natural Questions (NQ, 361K-passage subset; not the standard 21M DPR corpus) and MS MARCO (8.8M passages), while maintaining near-benign perplexity (32.4 vs. 28.4). Cross-model evaluation across four target LLMs shows nontrivial effectiveness under a fixed CATG generator (48.6-57.5% ASR-LLM). Surrogate-transfer evaluation against unseen retrievers, including ColBERT and rebuilt indexes using commercial embedding models, yields 64.7% average HR@10 under the same injected-corpus protocol. In a sampled large-corpus evaluation built from a Wikipedia-scale 21M-passage construction, SilentRetrieval retains 74.2% HR@10 at a 0.016%…
Read the paper
Related studies
- Knowledge Management Perspective of Generative Artificial Intelligence
- Navigating Generative Artificial Intelligence Promises and Perils for Knowledge and Creative Work
- Characterizing the evolving research on enterprise content management
- Large language models and multimodal foundation models for precision oncology
- From Generative AI to Extended Reality: Multidisciplinary Perspectives on the Challenges, Opportunities, and Future of Educational Computing
- Generative Artificial Intelligence: A New Engine for Advancing Environmental Science and Engineering
Go deeper in Evidence Hub
Evidence Hub adds a study data sheet (design, sample size, evidence level, key numbers), an AI summary and a chat grounded in the paper's text.