Retrieval Is An Attack Surface
An attacker does not need to change the model when keyword-stuffed documents can displace trusted evidence before generation begins.
ragpoisonbench uses a deterministic TF-IDF retriever, injects targeted poison documents, measures takeover and source influence, then reruns the same questions behind a provenance allowlist.
The Demo
Clean recall starts at 1.0. Four targeted documents drive attacked recall to 0.0 and attack success to 1.0; provenance quarantine restores recall to 1.0.
This isolates retrieval manipulation without an LLM judge. Production evaluation must also cover generation behavior, embeddings, chunking, access control, and novel attack strategies.
Research Basis
SafeRAG and recent poisoning benchmarks frame corpus manipulation as a measurable end-to-end RAG security problem.
Read the SafeRAG at ACL 2025.