PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems

2026-03-26

AI Summary

This work proposes PIDP-Attack, a novel composite attack that integrates prompt injection with database poisoning to effectively manipulate large language model (LLM) outputs without prior knowledge of user queries. Unlike existing data poisoning attacks on retrieval-augmented generation (RAG) systems—which rely on query priors and thus suffer from limited practicality—PIDP-Attack operates during inference by injecting malicious tokens into user queries and contaminating only a small number of retrieved documents. Evaluated on benchmark datasets including Natural Questions, HotpotQA, and MS-MARCO, the method demonstrates strong transferability across eight mainstream LLMs. In open-domain question answering, it achieves a 4%–16% higher attack success rate compared to PoisonedRAG while preserving high retrieval accuracy, significantly enhancing both the generality and real-world applicability of RAG-targeted attacks.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Prompt Engineering / Prompting
• Data Mining & Knowledge Management: Intelligent Query Processing

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Large Language Models (LLMs) have demonstrated remarkable performance across a wide range of applications. However, their practical deployment is often hindered by issues such as outdated knowledge and the tendency to generate hallucinations. To address these limitations, Retrieval-Augmented Generation (RAG) systems have been introduced, enhancing LLMs with external, up-to-date knowledge sources. Despite their advantages, RAG systems remain vulnerable to adversarial attacks, with data poisoning emerging as a prominent threat. Existing poisoning-based attacks typically require prior knowledge of the user's specific queries, limiting their flexibility and real-world applicability. In this work, we propose PIDP-Attack, a novel compound attack that integrates prompt injection with database poisoning in RAG. By appending malicious characters to queries at inference time and injecting a limited number of poisoned passages into the retrieval database, our method can effectively manipulate LLM response to arbitrary query without prior knowledge of the user's actual query. Experimental evaluations across three benchmark datasets (Natural Questions, HotpotQA, MS-MARCO) and eight LLMs demonstrate that PIDP-Attack consistently outperforms the original PoisonedRAG. Specifically, our method improves attack success rates by 4% to 16% on open-domain QA tasks while maintaining high retrieval precision, proving that the compound attack strategy is both necessary and highly effective.

Problem

• Retrieval-Augmented Generation
• adversarial attacks
• data poisoning
• prompt injection
• large language models

Innovation

• Prompt Injection
• Database Poisoning
• Retrieval-Augmented Generation
• Adversarial Attack
• LLM Security