One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems (2025)

Abstract: Large Language Models (LLMs) enhanced with Retrieval-Augmented Generation (RAG) have shown improved performance in generating accurate responses. However, the dependence on external knowledge bases introduces potential security vulnerabilities, particularly when these knowledge bases are publicly accessible and modifiable. While previous studies have exposed knowledge poisoning risks in RAG systems, existing attack methods suffer from critical limitations: they either require injecting multiple poisoned documents (resulting in poor stealthiness) or can only function effectively on simplistic queries (limiting real-world applicability). This paper reveals a more realistic knowledge poisoning attack against RAG systems that achieves successful attacks by poisoning only a single document while remaining effective for complex multi-hop questions involving complex relationships between multiple elements. Our proposed AuthChain address three challenges to ensure the poisoned documents are reliably retrieved and trusted by the LLM, even against large knowledge bases and LLM’s own knowledge. Extensive experiments across six popular LLMs demonstrate that AuthChain achieves significantly higher attack success rates while maintaining superior stealthiness against RAG defense mechanisms compared to state-of-the-art baselines.

## introduction large language models (llms) have demonstrated remarkable capabilities and found widespread applications in daily life. however, despite their impressive abilities, llms still face challenges such as outdated knowledge, hallucination, adversarial attacks, and jailbreak vulnerabilities as knowledge continues to evolve @xcite @xcite @xcite @xcite . to * corresponding authors address these limitations, researchers have introduced the retrieval-augmented generation (rag) approach to improve llms @xcite . this technology has been widely adopted in both industrial applications and academic research @xcite @xcite @xcite . although rag significantly improves the performance of the llm response, it introduces potential security vulnerabilities. the security of rag systems is influenced by both the inherent safety mechanisms of llms @xcite @xcite @xcite and the potential manipulation of external context @xcite . attackers can attempt to mislead llms into generating incorrect outputs by poisoning knowledge bases with malicious content. this attack surface is particularly concerning as knowledge bases are often the most accessible component of rag systems. for example, when rag systems utilize public resources like wikipedia @xcite for current events information @xcite , attackers could exploit the open editing nature of these knowledge bases to inject malicious content that may alter the llm's outputs. while previous studies have exposed knowledge poisoning risks in rag systems, existing attack methods suffer from critical limitations: they either require injecting multiple poisoned documents (resulting in poor stealthiness) or can only function effectively on simplistic queries (limiting real-world applicability) @xcite . this paper reveals a more realistic knowledge poisoning attack against rag systems that achieves successful attacks by poisoning only a single document while remaining effective for complex multihop questions involving complex relationships between multiple elements. as shown in figure 1 , such single document poisoning faces significant challenges. when the malicious attacker constructs a targeted document replacing "kosovo" with "nagorno-karabakh", the attack fails because: to address these challenges, we propose au-thchain, a novel single document poisoning attack method that stealthily executes knowledge poisoning in rag scenarios. our approach follows three key principles for crafting an effective malicious document, with each progressively strengthens the attack. first, ensuring visibility. the poisoned document must stand out among vast external information sources. we achieve this through precise alignment with the question's underlying objective. when external knowledge perfectly mirrors the core intent of a question, retrievers naturally prioritize it in their rankings, while llms tend to focus more on such intent-aligned information during their reasoning process. second, guaranteeing retrievability and competitiveness. even for complex queries involving multiple elements with complex relations, the document must remain a top candidate and outperform other retrieved knowledge. we accomplish this by structuring it as a self-contained evidence chain, preserving all key question elements and their logical relationships. this evidence chain structure not only boosts retrieval rankings but also makes our content more compelling than fragmented knowledge pieces that only partially match the question's logic. third, overcoming llms' internal knowledge bias. when llms consider multiple information sources, they tend to favor external knowledge that aligns with their internal knowledge. to counteract this bias, we strategically incorporate authority signals into our document, such as endorsements from authoritative institutions and recent timestamps. these authority signals help position our content as a more current and authoritative source compared to llms' static internal knowledge, effectively overcoming their inherent preference for internally knowledge. we evaluate authchain across six popular llms, achieving 21.7%-46.5% improvements in attack success rates compared to state-of-the-art baselines. furthermore, under two rag defense frameworks, authchain exhibits superior stealthiness by more effectively evading detection mechanisms. the reproduction package is available at: https://anonymous.4open.science/r/ authchain-45e8 . ## existing attacks on rag in rag systems, several white box approaches have been developed. jamming optimizes the token selection process and introduces instruction attacks to alter llm's fundamental behavior @xcite . other researchers have explored triggerbased attacks: phantom introduces trigger-specific malicious behaviors @xcite , liar improves attack success by alternating between retriever and generator targeting @xcite , and badrag enables flexible trigger selection for privacy compromise and denial of service @xcite . however, these white box approaches become impractical when targeting commercial rag systems where the llm and retriever are managed by major tech companies @xcite . this has led to black box attacks that target the knowledge database as a more accessible attack surface. recent works like poisonedrag @xcite and hijackrag @xcite propose methods combining original questions with manipulated content to achieve attacks. however, these methods face critical limitations in real-world scenarios: they require injecting multiple poisoned documents, resulting in poor stealthiness, and can only function effectively on simplistic queries. in this work, we explore a more realistic attack method that only requires inserting a single poisoned document while remaining effective for complex multi-hop questions involving intricate relationships between multiple elements. ## methodology to achieve effective single document poisoning in rag, we propose authchain. our key insight is that the document's influence can be progressively enhanced through three aspects: maximizing visibility during retrieval by precisely aligning with the question's intent, enhancing both retrievability and competitiveness through self-contained evidence chains that maintain high retrieval rankings while outperforming fragmented external knowledge, and overcoming llms' internal knowledge through authority reinforcement. as shown in figure 2 , we implement these design principles through three main stages: (1) intent-based content generation focuses on maximizing document visibility by extracting three key features from the input question (the intent, key elements, and their relationships) and generates intent-based content. (2) coe content generation aims to maintain high retrievability and competitive advantage over other knowledge sources by constructing self-contained evidence chains. using the extracted features and intent-based content, it generates chain-of-evidence (coe) content that fully preserves the question's semantic structure by covering its core objective, all key elements, and their relationships. (3) authority content generation enhances document trustworthiness by incorporating domain-specific authority signals. building upon the intent-based content, it creates authoritative content by incorporating institutional affiliations and recent timestamps, while maintaining professional formatting consistent with authoritative sources.