CamoDocs slips poisoned docs past RAG filters

Problem

The paper studies data poisoning of retrieval-augmented generation systems, where attackers inject documents into external knowledge sources to steer large language model outputs toward targeted incorrect answers. Prior poisoning methods commonly embed the target query into poisoned documents to improve retrieval, but that creates obvious lexical and embedding-space artefacts that many defences can detect. Understanding stealthier poisoning mechanisms is important because RAG systems often rely on public or user-editable sources and support high-stakes tasks.

Approach

CamoDocs crafts camouflaged poisoned documents that avoid direct query inclusion and instead interleave benign and adversarial content. The pipeline synthesises benign and adversarial drafts with a separate LLM, splits drafts into chunks, and pairs benign and adversarial chunks. It then applies gradient-guided token replacement on benign chunks using a surrogate encoder to select dispersion tokens that increase the spread of poisoned-document embeddings. A coherence filter re-ranks candidate replacements by perplexity under a lightweight language model to limit readability degradation. Finally, each modified benign chunk is concatenated with its adversarial counterpart to form the final poisoned documents. The attacker operates in a black-box setting and injects a small number of poisoned documents per target query; the surrogate embedding model used in experiments is ANCE and coherence scoring uses GPT-2.

Key Findings

• CamoDocs achieves high attack success rates (ASR) across seven defensive methods and three open-weight victim LLMs, and remains effective against proprietary models: average ASR 61.80% on GPT-5.4-mini and 55.09% on Claude-Haiku-4.5 on HotpotQA.
• The method transfers across different retrievers: average ASRs of 60.81% on Contriever, 51.24% on Qwen3-emb-0.6B and 41.04% on text-embedding-ada-002, showing surrogate optimisation can generalise.
• CamoDocs avoids query-detection defences that flag documents containing the exact query or paraphrases, because it does not include the query text; baseline query-inclusion attacks see ASR drop below 12% under such filters.
• The dispersion objective is the primary enabler of stealth: ablation shows the dispersion loss increases ASR by about 17 percentage points versus not using it; random token replacement yields lower dispersion and much lower ASR.
• Erasure-heavy clustering defences such as TrustRAG can reduce ASR but at large utility costs on retrieval-dependent tasks (for NeoQA TrustRAG removed over 91% of retrieved documents and reduced clean accuracy dramatically).
• Coherence filtering substantially improves stealth by lowering perplexity of poisoned documents by roughly 46%, making them less likely to be filtered by data-curation pipelines.
• Computational cost is non-trivial but offline: roughly 3.22 minutes per adversarial document and about 32.2 minutes per target query for ten poisoned documents on an A6000 GPU.

Limitations

The threat model assumes attackers can inject documents into the knowledge base, which may not hold in tightly controlled environments. CamoDocs requires offline compute for gradient-guided token selection and depends on transfer from a surrogate embedding model to the victim retriever, so effectiveness may vary with different retrieval architectures, indexing or preprocessing. Defence evaluations use benchmark corpora and selected retrievers and LLMs, so results may differ in other deployments.

Implications

An attacker who can add content to a RAG knowledge source can stealthily manipulate answers by camouflaging false claims among benign text and dispersing document embeddings to evade clustering and query-detection defences. Because only a tiny poisoning ratio is required, and the attack transfers to multiple retrievers and to proprietary LLMs, real-world RAG deployments that ingest public or user-editable material are at risk. The availability of code supports red-team testing but also lowers the barrier for offensive use, emphasising the need for provenance-aware ingestion, cross-source verification, and embedding- and retrieval-pattern anomaly detection to address this class of stealthy poisoning.