Open-Source RAG Poisoning Lab Released

💡95% local RAG poisoning success—deploy defenses before attacks hit

⚡ 30-Second TL;DR

What Changed

95% poisoning success on default ChromaDB retrieval

Why It Matters

Exposes critical vulnerabilities in local RAG pipelines, pushing practitioners to implement layered defenses for production reliability.

What To Do Next

Clone github.com/aminrj-labs/mcp-attack-labs and audit your ChromaDB RAG setup.

Who should care:Developers & AI Engineers

Web-grounded analysis with 6 cited sources.

•CorruptRAG attack succeeds by injecting only a single poisoned text into the knowledge base, outperforming baselines that require multiple documents[2].
•RevPRAG detection method achieves 98% true positive rate for poisoned responses using LLM activation patterns, with false positives near 1% across benchmarks[1].
•KEPo attack on GraphRAG forges knowledge evolution paths in knowledge graphs, achieving state-of-the-art success rates for single- and multi-target scenarios where prior methods fail[5].

•RevPRAG analyzes distinct LLM activation patterns between poisoned and correct responses for automated detection in various RAG architectures[1].
•CorruptRAG enhances stealth by using minimal single-text injection without needing to outnumber correct documents in top-k retrieval[2].
•KEPo generates toxic events with fabricated backgrounds and evolution paths in GraphRAG's knowledge graph, coordinating multi-target attacks via cross-subgraph linkages[5].
•SDAG defense uses superior attention mechanisms over causal attention to reduce corpus poisoning success rates in RAG QA[6].

RAG defenses will prioritize ingestion-time anomaly detection over generation-phase mitigations

Web sources emphasize embedding anomaly detection at ingestion as the most effective single layer, outperforming combined generation defenses[3].

GraphRAG systems remain vulnerable to specialized graph poisoning despite general RAG robustness

KEPo demonstrates conventional attacks fail on GraphRAG by up to 80%, but targeted evolution path forgery achieves high success[5].

Single-document poisoning attacks will become standard benchmarks for RAG security

CorruptRAG proves single-text injection feasible and superior to multi-document baselines across datasets[2].

2026-02

CorruptRAG practical single-text poisoning attack published on arXiv[2]

2026-02

SDAG defense against RAG corpus poisoning proposed on arXiv[6]

2026-03

KEPo graph-specific poisoning for GraphRAG released on arXiv[5]

2026-03

Open-source MCP Attack Labs repo demonstrating local RAG poisoning released on GitHub[3]

Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.

Weekly AI Recap

Read this week's curated digest of top AI events →

Same topic

Explore #rag-security

Same product