Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning

📌 Highlights

The central result is that query-targeted corpus poisoning can break retrieval reliability without requiring control of the user query, retriever parameters, or language-model behavior. With five poisoned documents per target, Hybrid nDCG@10 falls from .465 to .183 on SciFact and from .267 to .160 on NFCorpus under isolated stress, while strict SafeR falls from .663 to .000 and from .622 to .006.

The strongest mechanistic finding is a separation between query anchoring and appended content. BM25 is largely controlled by the repeated query terms, whereas LSA and Hybrid also respond to the identity of appended text. The BGE-small validation further shows 1.000 target exposure for query-only poisoning on both datasets.

The main limitation is scope: the experiments stop at retrieval admission. They establish exposure and evidence-loss risks, not downstream instruction-following success.

• Five targeted documents can be highly effective despite representing only 0.10% of SciFact or 0.14% of NFCorpus in isolated stress.
• Two random terms yield .395 Hybrid target exposure on 162 long SciFact queries despite .199 mean query-term coverage.
• Multi-target contamination introduces cross-target interference, so target exposure alone is not sufficient.
• Overlap admission and MMR expose different trade-offs: overlap can reduce exposure at a clean-utility cost, while MMR changes ranking utility without reducing exposure.

🎯 Introduction

RAG systems select evidence from an external corpus before passing it to a language model. If third parties can publish indexed material, they can create documents that resemble a user query and enter the top-k context, displacing legitimate evidence before any malicious instruction is executed. The study therefore treats retrieval admission as a distinct reliability boundary rather than conflating it with downstream prompt injection.

Prior work addresses knowledge corruption, retrieval jamming, optimized triggers, indirect prompt injection, and reliability defenses, but the paper argues that retrieval effects are difficult to interpret when document content, query knowledge, poison budget, and contamination scope vary together. It organizes the evaluation around what makes a poisoned document retrievable, how failure scales with attacker information and contamination scope, and what admission control trades for lower exposure.

The use of SciFact and NFCorpus provides public BEIR relevance labels, while BIPIA payloads provide standardized appended text. The design reports ranking quality, poison exposure, retained evidence, safe retrieval reliability, and latency so that retrieval degradation can be separated from downstream attack behavior.

🔬 Methodology

The threat model fixes the clean corpus, benchmark query, relevance labels, retriever parameters, and k. The attacker can publish indexed documents but cannot modify the query or retrieval system. Poison documents are generated per target query, with P∈{1,3,5}, and contamination ranges from one target at a time to every evaluation target. Query information ranges from no terms through deterministic random or high-IDF partial anchors to the full query; eligible terms are unique lowercase alphanumeric tokens of length at least three after stop-word removal and vocabulary filtering.

The contaminated corpus and retrieval boundary are defined by the following construction.

The study evaluates BM25, frozen 64-dimensional LSA, and a reciprocal-rank-fusion Hybrid that fuses the top 100 BM25 and LSA candidates, retains 50 candidates, and applies a final top-ten stage. It also validates the clean/query-only/query-plus-payload comparison with the 33M-parameter BAAI/bge-small-en-v1.5 bi-encoder using normalized embeddings and cosine similarity.

Content controls include query-only poisons, query-plus-BIPIA payloads, fixed-neutral filler, and corpus-derived neutral snippets with zero BM25 query score. Admission control uses IDF-weighted unique-query-term coverage with thresholds τ∈{0.25,0.40,0.55,0.70,0.85,0.95}; MMR reranks the same 50-candidate pool with λ=0.7.

📊 Experiments

The evaluation uses the BEIR test splits of SciFact, containing 5,183 documents and 300 judged queries, and NFCorpus, containing 3,633 documents and 323 judged queries. BM25, LSA, and Hybrid are evaluated with nDCG@10 and Recall@10 as ranking-utility measures. TargetExp and AnyExp measure poison admission, Evid. measures judged evidence availability, SafeR requires evidence plus zero admitted poison, and the four-state decomposition distinguishes evidence with or without poison from no evidence with or without poison.

At isolated P=5, five query-targeted documents reduce Hybrid nDCG from .465 to .183 on SciFact and from .267 to .160 on NFCorpus. The global poison fractions are only .10 and .14, but target exposure is 1.000 and .910, while SafeR is .000 and .006. Under multi-target P=5, the poisoned corpus fractions rise to 22.45 and 30.77, and cross-target effects appear; for example, NFCorpus LSA has TargetExp .805 but AnyExp .966 and mean top-ten poison count 7.23.

The content controls show that query-plus-payload versus query-only changes Hybrid nDCG by +.0003 on SciFact and +.0382 on NFCorpus, while comparisons with corpus-neutral text are negative for LSA and Hybrid on both datasets. The BGE-small validation reaches 1.000 target exposure for query-only poisoning on both datasets; adding payload changes SciFact nDCG from .269 to .271 and NFCorpus exposure from 1.000 to .988.

Partial-information results depend strongly on query length. On 162 long SciFact queries, two random terms cover .199 of eligible terms and yield .395 exposure, while four terms cover .397 and yield .895 exposure. For all NFCorpus queries, the corresponding mean two-term coverage is .805 because the queries contain only 2.48 eligible terms on average. Under overlap admission, τ=.95 removes full-query exposure on both datasets, but four-term exposure remains .780/.223 at that threshold; at τ=.40 it falls to .053/.003 while clean nDCG falls to .082/.065. MMR raises Hybrid nDCG from .183 to .234 on SciFact and from .160 to .164 on NFCorpus, but TargetExp remains 1.000/.910 and SafeR remains .000/.006.

fig:framework

Caption: System model and retrieval measurement boundary. Attacker-controlled documents enter the corpus; retrieval and optional admission determine the final top-$k$ set. Downstream instruction following is not evaluated.

Why It Matters: It defines the evaluated boundary: the study measures how attacker-controlled documents enter the retrieved context and explicitly excludes downstream generation.

fig:controls

Caption: Isolated-target $P=5$ content controls for nDCG@10 and target exposure. Table~tab:causalci reports the paired confidence intervals.

Why It Matters: It compares query-only, neutral, corpus-neutral, and payload conditions, making the distinction between query anchoring and appended-content effects visible.

fig:attacker_info

Caption: Hybrid target exposure versus attacker query information at isolated $P=5$.

Why It Matters: It shows how target exposure changes as the attacker moves from payload-only content to partial or full query information.

fig:admission_frontier

Caption: Hybrid four-term overlap-admission frontier for exposure and safe retrieval reliability.

Why It Matters: It summarizes the central defense trade-off: stricter overlap rejection lowers exposure but can also damage clean retrieval reliability.

🔮 Conclusion

The experiments answer the three research questions at the retrieval layer. Query anchoring explains most BM25 degradation, appended content can shift LSA and Hybrid rankings, and query-only poisoning reaches 1.000 target exposure with BGE-small on both datasets. Partial-information attacks remain meaningful on long queries, while short NFCorpus queries make fixed term budgets look deceptively powerful because they often reveal most of the query.

Contamination scope changes the failure mode as well as its magnitude: isolated targeting displaces evidence for the target query, whereas multi-target contamination creates cross-target interference and high any-poison exposure. Admission control can suppress full-query exposure, but its clean-task cost varies sharply by dataset. MMR improves nDCG in the tested configuration without changing exposure.

The practical takeaway is to treat retrieval admission as an independently measurable security boundary. Exposure, evidence availability, safe retrieval reliability, ranking utility, and candidate shortages should be reported together.

🛠️ Future Research Improvements

The most direct extension is end-to-end evaluation: retain the retrieval metrics while measuring whether admitted poisoned documents change language-model answers, tool calls, citations, or instruction following. This would establish how retrieval exposure translates into application-level harm.

The retrieval study should be broadened to larger dense retrievers, alternative vector-search stacks, different chunking strategies, production corpora, and continuously changing indexes. The current BGE-small validation is useful but does not establish behavior across modern dense retrieval systems.

Future attacks should vary stealth, document redundancy, term frequency, semantic paraphrase, optimized triggers, and attacker uncertainty about the query. Defenses should be evaluated on matched clean utility, not exposure alone, and should report shortages and evidence loss across multiple query distributions.

The BEIR setting also motivates datasets with more complete relevance judgments and domain-specific provenance labels, since incomplete qrels affect evidence availability and SafeR interpretation.

🏭 Potential Industry Use Scenarios

The stress axes can serve as a pre-deployment test suite for enterprise RAG systems that ingest web pages, customer documents, tickets, or third-party knowledge bases. Teams can measure query-targeted exposure under isolated and shared-corpus contamination rather than relying only on aggregate poison percentages.

Admission monitoring can be integrated into retrieval services to log query-term overlap, source identity, target exposure, any-poison exposure, evidence availability, candidate shortages, and clean-task utility. The results indicate that a single fixed overlap threshold is unlikely to provide a stable cross-domain operating point.

The framework is also relevant to source onboarding and index-refresh controls: newly added documents can be quarantined or evaluated against high-risk query classes before entering the production retrieval pool. This is a deployment implication of the retrieval findings, not a demonstrated production system.

For high-consequence applications, retrieval-layer alerts should be paired with provenance, source trust, human review, and downstream model safeguards because the study does not measure whether a retrieved poison actually changes generated behavior.

💬 Critical Analysis

The study is strongest in experimental decomposition. Frozen representations, matched content controls, isolated versus multi-target contamination, explicit query-information budgets, and paired bootstrap comparisons make it possible to distinguish query anchoring from appended-content identity. The four-state decomposition is particularly useful because SafeR is a strict conjunction rather than a direct estimate of answer correctness.

The main interpretive risk is overgeneralization from transparent query-aware stressors. A five-document isolated attack is small globally but highly targeted, and the paper appropriately treats it as a stress condition rather than an estimate of attack prevalence. Likewise, high-IDF partial anchors assume access to clean-corpus statistics, and fixed term counts have different information content across datasets.

The admission results show why security metrics cannot be optimized in isolation. A τ=.95 rule removes full-query exposure but does not selectively solve partial-information attacks, while stronger filtering can collapse clean nDCG and leave fewer than ten candidates. MMR demonstrates the complementary point that diversity reranking can improve ranking utility without acting as an admission barrier.

Reproducibility is supported by public BEIR datasets, explicit retriever configurations, deterministic payload construction, fixed seeds, and stated latency measurement conditions. Remaining open questions include downstream behavioral impact, larger and production dense retrievers, stealthier attacks, better relevance judgments, and defenses that preserve legitimate evidence while rejecting query-matched poison.