The Hidden Threat in Plain Text: Attacking RAG Data Loaders

2025-07-07

AI Summary

This paper identifies a critical security vulnerability in the data loading phase of retrieval-augmented generation (RAG) systems: adversaries can perform stealthy knowledge poisoning via document injection, silently compromising output integrity. To address this, we propose the first taxonomy of nine knowledge-based poisoning attack classes and formally define two novel threat vectors—“content obfuscation” and “content injection.” We develop an automated poisoning toolkit supporting DOCX, HTML, PDF, and other formats, compatible with five widely used data loaders and six end-to-end RAG systems. Evaluated across 357 test scenarios, our attacks achieve a 74.4% average success rate, successfully compromising black-box services including NotebookLM and OpenAI Assistants. The results expose fundamental weaknesses in existing input filtering mechanisms. Our work establishes both a theoretical framework and an empirical benchmark for securing RAG systems against knowledge poisoning.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Data Mining & Knowledge Management: Knowledge Acquisition from the Web
• Machine Learning: Adversarial Learning & Robustness

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Large Language Models (LLMs) have transformed human-machine interaction since ChatGPT's 2022 debut, with Retrieval-Augmented Generation (RAG) emerging as a key framework that enhances LLM outputs by integrating external knowledge. However, RAG's reliance on ingesting external documents introduces new vulnerabilities. This paper exposes a critical security gap at the data loading stage, where malicious actors can stealthily corrupt RAG pipelines by exploiting document ingestion. We propose a taxonomy of 9 knowledge-based poisoning attacks and introduce two novel threat vectors -- Content Obfuscation and Content Injection -- targeting common formats (DOCX, HTML, PDF). Using an automated toolkit implementing 19 stealthy injection techniques, we test five popular data loaders, finding a 74.4% attack success rate across 357 scenarios. We further validate these threats on six end-to-end RAG systems -- including white-box pipelines and black-box services like NotebookLM and OpenAI Assistants -- demonstrating high success rates and critical vulnerabilities that bypass filters and silently compromise output integrity. Our results emphasize the urgent need to secure the document ingestion process in RAG systems against covert content manipulations.

Problem

• Exposing security vulnerabilities in RAG data loaders
• Identifying knowledge-based poisoning attacks on document ingestion
• Demonstrating high success rates in compromising RAG output integrity

Innovation

• Automated toolkit with 19 stealthy injection techniques
• Two novel threat vectors: Content Obfuscation and Injection
• Testing five data loaders with 74.4% attack success rate