ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks

Abstract

Retrieval-Augmented Generation (RAG) can ground large language model (LLM) outputs in external evidence, but it also exposes the system to knowledge poisoning. Representative attacks use multiple injected documents or templates that directly assert a target answer. We present ToxicRAG, a one-document-per-target attack that expresses misinformation as a coherent knowledge-update narrative. The generated document first acknowledges the previously accepted answer, introduces fabricated events that

Categories

Framework mappings

Suggested from the entry's categories.

@misc{lu2026toxicrag,
  title = {{ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks}},
  author = {Haozhe Lu and Jiaqi Li and Xinyuan Zhu and Xiang Li},
  year = {2026},
  month = sep,
  eprint = {2609.11082},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2609.11082}
}