Ilmu Komputer & AI editorial
InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generation
The core problem
Retrieval-augmented generation (RAG) systems augment large language models (LLMs) with external knowledge, but this reliance on retrieved corpora introduces a poisoning surface. Prior poisoning attacks against RAG predominantly follow a **single-point explicit injection** paradigm: the entire malicious payload is encapsulated within one document. This makes the attack detectable, and recent mitigation mechanisms have been designed to identify and diminish such threats effectively.
This paper first verifies that existing mitigation mechanisms are insufficient against a new class of threats: **indirect logic induction**. Motivated by this gap, the authors introduce **InceptionRAG**, a stealthy attack mechanism that subverts the standard attack paradigm. Rather than injecting an explicit malicious payload, InceptionRAG fragments it into a **chain of dormant passages**. Each passage appears harmless and can bypass existing mitigation mechanisms when examined separately. However, when retrieved together, they trigger the LLM to self-deduce target misinformation through multi-hop reasoning.
The work exposes a concerning paradox: the stronger the reasoning capabilities of LLMs, the more
Innovation
Extensive evaluations were conducted across **three datasets** and **three LLMs**. The key quantitative findings are:
- **Attack success rate (ASR) exceeding 80%** even under rigorous adversarial constraints.
- **Superior evasion capabilities**: InceptionRAG effectively bypasses established defenses that mitigate traditional single-document injections.
- The attack remains effective in black-box settings when augmented with ZOSO-generated authoritative suffixes.
The results demonstrate that existing mitigation mechanisms, which focus on detecting explicit malicious payloads within a single document, fail to detect the fragmented dormant passages of InceptionRAG. Because each passage is individually harmless, per-document inspection yields no signal, while joint retrieval triggers the intended multi-hop reasoning chain.
The evaluation also highlights the paradox that stronger reasoning capabilities in LLMs increase vulnerability to reasoning-based poisoning attacks, as more capable models are better able to connect the dormant passages and self-deduce the target misinformation.
Why it matters
The central insight of this work is that the threat model for RAG poisoning must expand beyond single-point explicit injection. InceptionRAG demonstrates that **indirect logic induction** is a viable and stealthy attack vector: by distributing the malicious payload across multiple passages, the attack exploits the LLM's own reasoning to synthesize misinformation, rather than relying on the payload being directly retrieved and copied.
This has several implications:
1. **Defense gap**: Mitigation mechanisms designed for single-document injections are insufficient. Detection must consider cross-document logical dependencies, not just individual document content.
2. **Reasoning paradox**: As LLMs become more capable reasoners, they become more susceptible to reasoning-based poisoning. This suggests a trade-off between capability and robustness that must be addressed.
3. **Black-box practicality**: ZOSO makes the attack feasible without white-box access, lowering the barrier for real-world deployment.
The proposed defense, **HODOR**, addresses the attack by decoupling adversarial logical dependencies through document isolation. By preventing the joint retrieval or joint reasoning over the fragmented passages, HODOR breaks the multi-hop chain. The authors position HODOR as a mitigation to prevent potential misuse of their findings.
Overall, the paper exposes a concerning paradox and calls for a rethinking of RAG security: defenses must account for the compositional and reasoning-based nature of modern LLM systems.
Who should read this
Opening member content…