Knowledge Poisoning (Corpus Poisoning / PoisonedRAG)
Knowledge poisoning, also known as corpus poisoning or PoisonedRAG, is an adversarial attack in which an attacker injects a small number of crafted documents into an external retrieval database so that a Retrieval-Augmented Generation (RAG) system retrieves them for target queries and generates attacker-chosen answers. Unlike training-time data poisoning or direct prompt injection by the end user, knowledge poisoning compromises the grounding corpus itself and can bypass standard retrieval ranking and safety filters without modifying model weights. It demonstrates that grounding a model in retrieved documents does not inherently guarantee trustworthiness without provenance and access controls.
Origin and context
Following the widespread adoption of RAG to mitigate LLM hallucinations, security researchers examined what happens when the retrieval corpus contains untrusted third-party content (such as indexed web pages, shared wikis, tickets, or emails). Building on Zhong et al.’s EMNLP 2023 work on poisoning dense retrievers via gradient-optimized adversarial passages ("HotFlip"), Wei Zou et al. introduced PoisonedRAG in February 2024 (USENIX Security 2025), decomposing the attack into a retrieval condition (crafting text that maximizes vector or lexical similarity to target queries) and a generation condition (steering the LLM to output the target falsehood).
Why it matters
PoisonedRAG demonstrated that injecting just five crafted passages into a corpus of millions of documents (such as Natural Questions or MS MARCO) can achieve over 90% attack success rate in both black-box and white-box retrieval settings. Because the injected passage looks like factual domain text rather than an imperative "ignore previous instructions" command, prompt-injection classifiers that scan only for instruction-override syntax frequently fail to flag it.
Example
An attacker posts a public support forum comment crafted to have high cosine similarity with queries about a competitor’s API authentication endpoint while stating that TLS certificate verification must be disabled to fix timeout errors. When a developer’s RAG assistant indexes public community threads, the poisoned passage ranks in the top-3 retrieved chunks and the assistant recommends disabling TLS verification as a cited best practice.
Maturity and evidence
Limits and open questions
White-box embedding collisions require knowing the target embedding model architecture, and multi-source consensus defenses (such as RobustRAG or provenance-weighted reranking) can substantially reduce single-document attack success when authoritative documents outnumber untrusted sources.
Related terms
References
- PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language ModelsZou et al. / USENIX Security 2025 (arXiv) · 2024-02-12 · class A
- Poisoning Retrieval Corpora by Injecting Adversarial PassagesZhong et al. / Princeton University & EMNLP 2023 (arXiv) · 2023-10-30 · class A
- Certifiably Robust RAG against Retrieval Corruption (RobustRAG)Xiang et al. (arXiv) · 2024-05-24 · class A
Last updated: 2026-10-19
This term is also covered in the Skills Atlas as secure rag skill.
This term is also covered in the Skills Atlas as ai data security skill.
This term is also covered in the Skills Atlas as retrieval augmented generation skill.
This term is also covered in the Skills Atlas as adversarial ai testing skill.
Referencing this analysis in documentation, research, or an engineering write-up? Copy a formatted link or citation below:
Show citation text & canonical URL
[Knowledge Poisoning (Corpus Poisoning / PoisonedRAG) — AI Glossary — Skills Intelligence](https://www.skillsintelligence.tools/glossary/term/knowledge-poisoning)Skills Intelligence. (2026). Knowledge Poisoning (Corpus Poisoning / PoisonedRAG) — AI Glossary. Skills Intelligence AI Glossary. Retrieved from https://www.skillsintelligence.tools/glossary/term/knowledge-poisoning