Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-09-12 · high
Attack success ran 61% to 91% across twelve model-retriever pairs, invisible to filters built to catch repeated fake text.
Why now: Coverage of the attack is dated September 12, 2026, and the paper doesn't say whether any retrieval vendor has a fix in the works.
ToxicRAG poisons a retrieval corpus with a single planted document, per the paper describing the attack. A single file is enough to flip an answer a retrieval-augmented system already accepted. Search assistants, internal wikis and support bots that trust whatever their retriever returns are all exposed.
The method works by rewriting the story instead of asserting the answer outright. It generates a document that acknowledges the answer a system already accepted, then invents an event that appears to overturn it. The document credits that correction to sources built to sound authoritative.
Researchers tested it on 100 questions each from Natural Questions, HotpotQA and MS-MARCO, pairing four victim models with four dense retrievers. Success rates spanned 61% to 91% across all twelve pairings, matching or beating the strongest baseline in every one.
A corpus filter tuned to catch repeated or template-style injection sees nothing here. One coherent, well-written update narrative reads exactly like a real one.
Each link below shares sources, entities, or timing with this story.
Dahal and Xiong target injected documents that are individually benign but create false associations once aggregated, which is structurally invisible to any per-document filter (arXiv 2607.20437). TopoGuard builds a semantic similarity graph over the retrieved set and flags ma...
A retrieval-augmented QA system returns different answers after index expansion even with model, prompt, retrieval policy, evidence depth and generation controls held fixed, and aggregate accuracy hides it when gains and losses cancel (arXiv 2608.22856). The Snapshot Compatibi...
Scoring each retrieved chunk and dropping failures assumes one chunk is a sufficient premise; multi-hop questions are built so none is. Entailment scoring reaches 0.643/0.523/0.560 AUC on HotpotQA, 2Wiki, and MuSiQue against 0.951 on single-hop SQuAD, and per-chunk gating was...
Auditing Qwen2.5-7B-Instruct on RGB and HotpotQA with a hallucination detector, NLI entailment and an LLM judge, INT8 is near-lossless on accuracy and faithfulness (arXiv 2608.30996). INT4 lowers accuracy, and among answers that stay factually correct, over 90% of faithfulness...
DoCtOR runs automated failure attribution to find the decisive error step and agent, synthesizes what that step should have been via counterfactual reasoning, then asks only that one agent to reflect. Gains over initial success rate: 22% on HotPotQA, 26% on ChartQAPro, 27% on...
arXiv 2607.29032 converts sparse historical hidden states into reusable memory representations via a gating network intervening on current hidden states, all at inference time with no context reprocessing. Training uses evidence-conditioned self-distillation: a memory-augmente...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.