PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models

Wei Zou, Runpeng Geng, Binghui Wang, Jinyuan Jia

This article delves into "PoisonedRAG," a groundbreaking research paper presented at USENIX Security that uncovers a critical new attack surface in Retrieval-Augmented Generation (RAG) systems. RAG has emerged as a state-of-the-art technique to address inherent limitations of Large Language Models (LLMs), such as their lack of up-to-date knowledge and propensity for hallucination. By grounding LLM responses on external knowledge retrieved from a **knowledge database**, RAG enhances factual accuracy and domain-specific expertise. However, as demonstrated by authors Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia, this external knowledge database introduces a novel and practical vulnerability.

AI review

Solid, well-executed attack research that identifies a real and underexplored attack surface in RAG systems. The dual-condition decomposition is clean, the evaluation is thorough across multiple LLMs and retrievers, and the failure of obvious defenses is well-documented. Not revolutionary—the attack is conceptually straightforward once you frame it—but the execution and scope earn it a spot.