CamoDocs Poisons RAG Without Putting the Query in the Document, Hitting 61.80% ASR on GPT-5.4-mini

arXiv 2608.28389·medium signalXBlueskyLinkedInCopy link

CamoDocs (arXiv 2608.28389, 2026-08-28, cs.CL/cs.CR) drops the query-inclusion trick that makes existing RAG poisoning easy to filter, instead chunking synthesized benign and adversarial drafts, swapping selected tokens in benign chunks for dispersion tokens that spread the poisoned embeddings, and applying coherence filtering to keep readability. Tested across seven RAG defenses, three open-weight LLMs and three benchmarks, it holds strong average attack success while avoiding query-overlap artifacts, reaching 61.80% average ASR on GPT-5.4-mini and 55.09% on Claude-Haiku-4.5. Erasure-heavy clustering defenses such as TrustRAG cut ASR but only at substantial utility cost on retrieval-dependent benchmarks like NeoQA; code is at github.com/jaewonalive/CamoDocs.