InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation
Jiachang Zhang, Min Chen, Xiao Ren, Zhenyong Zhang, Yuanchao Shu, Yunjun Gao, Zhikun Zhang
cs.CR
2026-09-15
InceptionRAG splits a false answer into two harmless-looking passages. On Gemini-2.0-Flash with NQ, ASR is 88.0% undefended and 72.3% under AVFilter.
Most RAG poisoning recipes still stuff the attacker's answer, or a hijack instruction, into one passage and paste the user query on top so the retriever ranks it. Once a single document both restates the question and names the desired answer, filters that watch attention variance, keyword density, or cross-passage contradictions have something to grab.
Those filters inspect passages one at a time. If the false conclusion is never written down, and only appears after the model joins two retrieved fragments, the same gates can miss it.
InceptionRAG, from Zhejiang University, Vrije Universiteit Amsterdam, and Guizhou University (CCS 2026), is built on that gap. Their phrase is "dormant in isolation, toxic upon aggregation."
The attacker picks a proxy entity in the same category as the thing the user asked about, but not the same object. For "who won the 2018 World Cup" with target answer Argentina, the attribute document says Argentina won the 2016 Olympics. The bridge document says the 2016 Olympic champion and the 2018 World Cup champion are the same team. Neither sentence says Argentina won the 2018 World Cup. Retrieved together, a syllogism does the rest.
A logic trap still loses if the other eight of ten retrieved passages state the truth. So each forged document gets an optimized suffix: an anchor suffix that makes the fake text look like ground truth, and a bridge suffix that pushes transitive reasoning. There are no gradients in a black-box API, and brute-force suffix search is too expensive, so they use zeroth-order suffix optimization (ZOSO). Suffix candidates are embedded, a neural-tangent-kernel Gaussian process models the reward surface, and the next trial is the nearest unused real suffix. Reward is +1.0 if the target answer appears, -2.0 if the true answer appears, +0.2 if the proxy entity is mentioned.
On the retrieval side they use dual-ended injection: a Subject header carries query signal, a footer of pseudo-metadata tags carries keywords. A frozen global suffix is easy to fingerprint and weak on long-tail queries, so cascade test-time fine-tuning (CTTFT) first tries the global pair, then walks up to 12 neighbors of the anchor and 12 of the bridge, capped at 25 queries.
The default setup is strict: Contriever with k=10, only N=2 injected passages (1:4 against benign context), Gemini-2.0-Flash as generator. With no defense, ASR is 88.0% on NQ, 90.3% on HotpotQA, 83.3% on MS-MARCO. PoisonedRAG on NQ is 32.3%; PIA is 55.3%.
| Method | NQ ASR, no defense | NQ+AVFilter ASR / bypass |
| HijackRAG | 42.0% | 11.3% / 27.0% |
| PoisonedRAG | 32.3% | 16.7% / 51.6% |
| PIA | 55.3% | 9.2% / 17.7% |
| InceptionRAG | 88.0% | 72.3% / 90.4% |
Against RAGForensics, which uses an LLM as judge, InceptionRAG keeps ASR above 48% on all three datasets. HotpotQA versus FilterRAG is the clear miss: ASR falls to 15.3%. The authors blame a collision between HotpotQA's native multi-hop structure and the extra synthetic chain, which FilterRAG reads as abnormal keyword density. RAGDefender still cuts NQ ASR to 28.9%.
Ablations show the suffixes do the heavy lifting. On Gemini + MS-MARCO, the logic trap alone is 40.0% ASR, a random suffix is 41.3%, ZOSO reaches 83.3%. The same setting with only the global suffix is 22.0%; CTTFT brings it back to 83.3%. Successful attacks cost under 2.2 extra queries on most splits. Versus brute-force suffix search, ZOSO is up to 41.1× faster on Gemini, and on Grok-4-Fast-Reasoning / HotpotQA cuts 6,621.5 minutes down to 234.1.
Larger models break more easily. On NQ, Gemini-Flash is at 88.0% ASR, Llama-2-7B at 46.0%. The paper calls this a reasoning-vulnerability paradox: better multi-hop reasoning is exactly what stitches the two dormant passages into a lie.
Their own patch is HODOR: answer each retrieved document in isolation, then majority-vote. Figures show ASR falling, and also show a drop in clean accuracy on HotpotQA, where the task itself needs cross-document synthesis. Exact points are plotted, not tabulated.
For RAG security, this is a concrete hole in the assumption that poison lives in one document. AVFilter, MIS, and RAGForensics do not fully cover a lie that lives in the relation between documents.
For product teams, retrieval is already the easy half. Contriever, Contriever-MS, and ANCE pull both poisoned documents into the top-k in 96%+ of cases in most settings, and query rewriting barely helps. Hoping users paraphrase the question is not a defense. Real mitigation has to break cross-document reasoning at generation time, or accept HODOR's tax on legitimate multi-hop questions.
This is an attack-surface extension, not a new retriever. The authority suffixes still behave like prompt injection, parked in a metadata-shaped tail.
There is no standalone Limitations section. The constraints sit in the experiments.
HODOR's utility cost is an appendix figure. The body only says HotpotQA drops; it never prints the clean accuracy numbers. Majority vote should favor 8 benign passages over 2 malicious ones, but the attack also adds authority suffixes. The paper does not break out whether those two isolated votes still look more official to the model.
ASR uses substring match plus an expanded paraphrase set, temperature 0, at most 100 generated tokens. A model that restates the lie and then rejects it, or that wraps the answer in different wording, can swing the count either way.
Finding global suffixes costs about 4,000 victim API calls, then about 42.1 calls per target after amortization. The black-box setting is real; posting two documents and walking away is not. Corpora are NQ, HotpotQA, and MS-MARCO, not a moderated production knowledge base. Both documents still have to be retrieved. Miss one and the syllogism dies.