Open-Source RAG Poisoning Lab Released

🔑 Enhanced Key Takeaways

• •CorruptRAG attack succeeds by injecting only a single poisoned text into the knowledge base, outperforming baselines that require multiple documents[2].
• •RevPRAG detection method achieves 98% true positive rate for poisoned responses using LLM activation patterns, with false positives near 1% across benchmarks[1].
• •KEPo attack on GraphRAG forges knowledge evolution paths in knowledge graphs, achieving state-of-the-art success rates for single- and multi-target scenarios where prior methods fail[5].

🛠️ Technical Deep Dive

• •RevPRAG analyzes distinct LLM activation patterns between poisoned and correct responses for automated detection in various RAG architectures[1].
• •CorruptRAG enhances stealth by using minimal single-text injection without needing to outnumber correct documents in top-k retrieval[2].
• •KEPo generates toxic events with fabricated backgrounds and evolution paths in GraphRAG's knowledge graph, coordinating multi-target attacks via cross-subgraph linkages[5].
• •SDAG defense uses superior attention mechanisms over causal attention to reduce corpus poisoning success rates in RAG QA[6].

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline