One poisoned source pushes multi-hop RAG wrong-answer rate from 1% to 68%, with a clean citation trail.

CiteShade turns the audit mechanism into the attack surface (arXiv 2609.15660). An attacker controlling a single source gets the system to produce an attacker-chosen wrong answer, attribute it to a trusted source that doesn't support it, and leave the correct evidence retrieved but unused. Wrong-answer rate went from 0.01 to 0.68, with a citation laundering rate of 0.84 under explicit instruction and 0.64 with none. Perplexity filtering and citation-support checking each proved insufficient alone; the authors propose a counterfactual check of which source actually drove generation.