Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems

TL;DR - This paper introduces Micro-Collaborative Poisoning, a distributed attack that manipulates RAG outputs by spreading weak adversarial signals across multiple plausible documents. It matters because the attack can evade document-level inspection while gaining influence when poisoned sources are retrieved together.

• Evaluated across 108 RAG configurations spanning datasets, retrievers, retrieval depths, database compositions, poisoning scope, and generator models.
• Attack success arises from accumulated signals across documents rather than one dominant malicious passage.
• Larger top-k retrieval and poisoning multiple databases increase the chance that adversarial evidence appears together.
• Diverse clean databases and stronger retrievers can reduce the attack’s influence.