Google paper: fake docs only need to echo your query to poison RAG retrieval

rohanpaul_ai · x · 2026-11-06

A new arXiv paper stress-tests the retrieval admission step in RAG systems and finds:

Query anchoring dominates: fake documents only need to repeat the user's question to get retrieved; appending hidden attack payloads barely changes rankings (SciFact nDCG moved just 0.269→0.271 for BGE-small).
Low poisoning cost: across 623 BEIR queries (SciFact, NFCorpus), five query-targeted docs per query cut classical retriever nDCG@10 by 40.2–61.5%; query-only P=5 achieves 100% target exposure.
Partial-info attacks work: on 162 long queries, two random terms covering 19.9% of eligible terms still yield 39.5% Hybrid target exposure; multi-target contamination adds cross-target interference.
Defense dilemma: overlap-based filtering removes full-query poisons but sharply reduces clean retrieval utility; MMR leaves exposure unchanged.

More from Safety