Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems

Gradient-guided (GCG) corpus poisoning on Security Stack Exchange, 67,941 documents, 50 attacks: 38.0% co-retrieval under pure vector retrieval. Hybrid BM25+vector retrieval reduces attack success from 38% to 0% with no model change; when the attacker jointly optimises payloads for both sparse and dense signals it partially recovers, to 20-44%.

paper

2026-03-10

2026-10-04