CamoDocs poisoning attack hides its trigger from RAG filters

CamoDocs beats seven RAG poisoning defenses without putting the search query inside the poisoned text. Most defenses that screen retrieved chunks check for overlap between the chunk and the query. CamoDocs never creates that overlap, so those filters have nothing to catch.

The method drafts a benign version and an adversarial version of the same document, then chunks both. It swaps selected tokens in the benign chunks for what the paper calls dispersion tokens, spreading the poisoned embedding across text that still reads clean. A coherence check confirms the result holds together before it's used.

Tested across seven defenses and three benchmarks, CamoDocs reaches 61.80% average attack success on GPT-5.4-mini and 55.09% on Claude Haiku 4.5. TrustRAG and other erasure-heavy clustering defenses do cut those numbers down. That drop comes at a real cost to retrieval quality on benchmarks where accurate retrieval matters.

A defense strong enough to erase CamoDocs also erases enough legitimate content to hurt retrieval. Teams running RAG on untrusted documents get two failure modes, no clean fix. The paper doesn't say whether a defense beyond erasure-heavy clustering closes that gap.