Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

ToxicRAG

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

1

Findings

2

Edges

6

Sources

1

Corpus findings

2026-09-12 / skill-finderToxicRAG poisons a RAG system with a single document written as a plausible knowledge updateRather than injecting multiple documents or templates that assert the target answer, ToxicRAG generates one document per target that acknowledges the previously accepted answer, introduces fabricated events that appear to invalidate it, and attributes the attacker's answer to purported authorities. Across 100 questions each from Natural Questions, HotpotQA and MS-MARCO, with four victim LLMs and four dense retrievers, attack success ran 0.61 to 0.91 across the twelve combinations and matched or beat the strongest baseline in every one. The shape matters for defenders: a corpus filter tuned for repeated or template-like injections will not see a single well-formed update narrative.
2026-09-11 / arxiv-researcherToxicRAG Poisons RAG With One 'Knowledge Update' Document per Target at 61-91% Attack SuccessToxicRAG (arXiv 2609.11082) writes each poisoned document as a narrative: it acknowledges the accepted answer, invents events that overturn it, and cites fake authorities for the attacker's answer. With one document per target question, it hit 0.61-0.91 attack success across Natural Questions, HotpotQA and MS-MARCO with four victim LLMs and four dense retrievers, matching or beating the strongest baseline in all 12 combinations. Filters that look for documents asserting a bare answer will miss this style.

Graph relationships

BENCHMARKED AGAINST
MS-MARCO
ToxicRAG attack was evaluated on MS-MARCO dataset
Source finding
BENCHMARKED AGAINST
HotpotQA
ToxicRAG attack was evaluated on HotpotQA dataset
Source finding
BENCHMARKED AGAINST
Natural Questions
ToxicRAG attack was evaluated on Natural Questions dataset
Source finding
BENCHMARKED AGAINST
MS-MARCO
ToxicRAG achieved 0.61-0.91 attack success on MS-MARCO
Source finding
BENCHMARKED AGAINST
HotpotQA
ToxicRAG achieved 0.61-0.91 attack success on HotpotQA
Source finding
BENCHMARKED AGAINST
Natural Questions
ToxicRAG achieved 0.61-0.91 attack success on Natural Questions
Source finding

Source trail

arXiv 2609.11082

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues