PoisonedRAG Research

All RAG systems

Injecting 5 malicious texts into a million-document database achieves 90% attack success; 0.04% corpus poisoning achieves 98.2% success

RAG systems inherently trust retrieved documents; no integrity verification of knowledge base contents