Retrieval-Augmented Generation — feeding a language model relevant documents from a corpus before it answers — is meant to ground responses in facts. But the corpus is a trust boundary. If an adversary can insert documents into it, they can control what the model retrieves and therefore what it says.
This paper demonstrates a gradient-guided poisoning attack against RAG pipelines. The attacker inserts two documents: a sleeper (containing the payload — the wrong answer) and a trigger (optimized to be co-retrieved with the sleeper when the target query arrives). The trigger's text is crafted through Greedy Coordinate Gradient optimization to exploit the vector similarity model used for retrieval.
Against vector-only retrieval on a Security Stack Exchange corpus of 68,000 documents, the attack achieves 38% co-retrieval and up to 93% success in changing the model's answer. Two documents, added to 68,000, flip the response.
The defense is architectural, not algorithmic: hybrid retrieval combining keyword matching (BM25) with vector similarity drops the attack success to 0% when the adversary hasn't optimized for both channels. The keyword matcher catches what the vector search misses because the poisoned documents are semantically similar to the target but lexically different from legitimate answers. Two retrieval methods, each vulnerable alone, become robust together.
But the defense is incomplete. An adversary who jointly optimizes for both retrieval signals can partially recover, reaching 20–44% success. And on a different corpus (Wikipedia), the same attack fails entirely — 0% success — revealing that effectiveness depends on corpus structure, not just the attack's sophistication.
The attack exploits a single retrieval channel. The defense diversifies channels. The residual vulnerability exists at the intersection of both. The security lesson is geometric: you're safe until the adversary finds the space where all your defenses agree to be wrong.