Splitting a false claim across several plausible documents poisons RAG without leaving a poisoned document

arXiv·medium signalXBlueskyLinkedInCopy link

Micro-Collaborative Poisoning (arXiv 2609.21573, 18 Sep) distributes a false target claim across multiple individually plausible documents rather than concentrating it in one malicious passage, evaluated across 108 RAG configurations varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases and generator model. The effect comes from weak adversarial signals accumulating across retrieved sources, not from a single dominant passage, so raising top-k and poisoning multiple databases both increase the odds those signals co-occur in context, while clean database diversity and stronger retrievers dampen them. The document-level visibility analysis is the practical warning: the attack achieves downstream influence with a weaker explicit poisoning signature than direct poisoning, so per-document inspection is the wrong detection layer.