PoisonedRAG — 5 malicious texts in millions achieve 90% attack success rate on RAG systems
Date: 2025-09
Affected: All enterprise RAG deployments — knowledge databases
Attack vector: other
Category: research-demonstrated
Severity: Critical

USENIX Security 2025 paper demonstrating the first systematic knowledge database corruption attack against RAG. Injecting just 5 malicious texts into a knowledge database with millions of entries achieves 90% attack success rate, causing the LLM to generate attacker-chosen answers. Works in both white-box and black-box settings.

Impact: Fundamental threat to RAG systems; 90% attack success with minimal poisoning; existing defenses insufficient

Mitigations:
Answer consistency checking across multiple retrieval paths
Knowledge base integrity monitoring
Retrieval result diversity enforcement

Architectural layers (MAESTRO):
label: Data Operations
notes: 5 malicious texts injected into million-entry knowledge base
role: origin
label: Foundation Models
notes: LLM generates attacker-chosen answers from poisoned retrieval
role: propagation