Retrieval‑Augmented Generation (RAG) enhances large language models by grounding their outputs in external knowledge bases, improving accuracy and trustworthiness. However, this reliance also opens a surface for poisoning attacks. This paper introduces Micro‑Collaborative Poisoning, which distributes a false target claim across multiple locally plausible documents instead of concentrating it in a single malicious passage.
We evaluate the attack across 108 RAG configurations, varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. Results show that the attack’s success is not driven by a single dominant poisoned passage but by the accumulation of weak adversarial signals across retrieved sources. Increasing top-$k$ depth or poisoning multiple databases raises the chance that these weak signals appear together, while greater diversity in clean databases and stronger retrievers can substantially mitigate their influence.
A document‑level visibility analysis further demonstrates that isolated document inspection struggles to expose Micro‑Collaborative Poisoning, as it achieves downstream impact with a weaker explicit poisoning signature than direct attacks. This makes the threat harder to detect in real‑world deployments.
Review: Micro‑Collaborative Poisoning highlights a subtle security gap in RAG systems that fuse multi‑source information, urging designers to balance knowledge diversity with adversarial robustness when building retrieval pipelines.