Work

CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents

Year: 2026

Type: preprint

Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers. Existing poisoning attacks often rely on query inclusion, inserting the target query into poisoned documents to improve retrieval; however, this creates lexical and embedding-space artifacts that make them easy to filter. We propose CamoDocs, a poisoning attack that avoids direct query inclusion by camouflaging adversarial documents among benign content. CamoDocs chunks synthesized benign and adversarial drafts, replaces selected tokens in benign chunks with dispersion tokens that spread poisoned-document embeddings, and applies coherence filtering to limit readability degradation. Across seven RAG defenses, three open-weight LLMs, and three benchmarks, CamoDocs achieves strong average ASR while avoiding query-overlap artifacts exploited by simple query detection. It also remains effective against proprietary models, achieving average ASRs of 61.80% on GPT-5.4-mini and 55.09% on Claude-Haiku-4.5. Finally, we show that erasure-heavy clustering defenses such as TrustRAG can reduce ASR, but only with substantial utility drops on retrieval-dependent benchmarks such as NeoQA. Code is available at https://github.com/jaewonalive/CamoDocs.

Source: arXiv (Cornell University)

DOI: 10.48550/arxiv.2608.28389

Authors: Jung, Jaewon, Zheng, Haizhong, Jang, Hongsun, Song, Jaeyong, Chen, Beidi, Lee, Jinho

Institutions: Seoul National University, Carnegie Mellon University

Topic: Adversarial Robustness in Machine Learning

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funders: National Science Foundation, Office of the Director of National Intelligence, National Research Foundation, Korea Basic Science Institute, National Research Foundation of Korea, Ministry of Science and ICT, South Korea, Intelligence Advanced Research Projects Activity, Institute for Information and Communications Technology Promotion

Awards: G2947324332, G4294718623, G6281998519, Collaborative Research: SHF: Medium: Semantic Aware Code Generation with Large Language Models, G7822388480, G8390394344

OpenAlex ID: W7204748151

Cites:

Cited by:

Related to: