Research question
Can an attacker steer RAG answers by injecting a few documents into the knowledge base?
Key findings
- Five malicious texts per target question achieve 90% attack success in a corpus of millions - Existing defences such as paraphrasing and perplexity filtering fail