Yhden dokumentin myrkytykseen pohjautuva näkökanta manipulaatio haulla mukaututetussa generaatiossa
Year: 2026
Type: dissertation
Abstract: Retrieval-Augmented Generation (RAG) has emerged as a capable solution to reduce hallucinations and increase the accuracy of Large Language Model (LLM) responses, but its reliance on an external knowledge base introduces crucial vulnerabilities in the form of RAG poisoning attacks. A less explored attack objective in this realm is bias manipulation, or more precisely, manipulation of responses to open-ended questions, where the adversary seeks to steer generated answers towards a chosen viewpoint. This thesis studies the effects of targeted stance manipulation under a strict black-box threat model and an injection budget limited to a single poisoned document (one-shot poisoning). To this end, BiasChain is introduced as an adaptation of Authchain, an existing one-shot poisoning method, to craft retrievable and authoritative poisoned knowledge. BiasChain is compared with three existing poisoning methods across two retrievers, three generators, and two datasets, with additional evaluations using query paraphrasing and document perplexity. The results demonstrate that a single poisoned document is enough to significantly shift RAG outputs towards an attacker-chosen stance and, in many test settings, make that stance the majority output. CorruptRAG achieves the strongest overall manipulation performance, motivating further investigation of poisoned content that combines strict support for the target stance with explicit refutation of opposing views. BiasChain demonstrates effective stance manipulation and robustness to query reformulations. Although its effectiveness does not generalize uniformly across target system configurations, its documents exhibited the closest perplexity values compared to benign content, indicating an additional layer of stealthiness. These findings establish the feasibility of one-shot stance manipulation under restricted attacker access and highlight the need for defenses against adversarial influence through retrieved knowledge.
Source: Aaltodoc (Aalto University)
Author: Viljanen, Jesse
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7225844319