CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents

2026-08-28

AI Summary

研究提出CamoDocs，一种针对检索增强语言模型的数据投毒攻击方法，通过伪装文档避免直接查询包含，有效对抗现有防御机制。

Abstract

Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers. Existing poisoning attacks often rely on query inclusion, inserting the target query into poisoned documents to improve retrieval; however, this creates lexical and embedding-space artifacts that make them easy to filter. We propose CamoDocs, a poisoning attack that avoids direct query inclusion by camouflaging adversarial documents among benign content. CamoDocs chunks synthesized benign and adversarial drafts, replaces selected tokens in benign chunks with dispersion tokens that spread poisoned-document embeddings, and applies coherence filtering to limit readability degradation. Across seven RAG defenses, three open-weight LLMs, and three benchmarks, CamoDocs achieves strong average ASR while avoiding query-overlap artifacts exploited by simple query detection. It also remains effective against proprietary models, achieving average ASRs of 61.80% on GPT-5.4-mini and 55.09% on Claude-Haiku-4.5. Finally, we show that erasure-heavy clustering defenses such as TrustRAG can reduce ASR, but only with substantial utility drops on retrieval-dependent benchmarks such as NeoQA. Code is available at https://github.com/jaewonalive/CamoDocs.

Problem

• Retrieval-Augmented Generation
• Data Poisoning
• Query Inclusion
• Adversarial Documents
• Embedding-Space Artifacts

Innovation

• CamoDocs
• data poisoning
• retrieval-augmented generation (RAG)
• camouflaged documents
• dispersion tokens