Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
Pedro Pereira, Eva Maia, Isabel Praça
cs.CR · cs.AI
Quick verdict
Novel distributed RAG poisoning across five plausible documents; 108-config study supports mechanism but lacks statistical rigor and stealth validation.
Summary
The paper introduces Micro-Collaborative Poisoning, a corpus-level attack on retrieval-augmented generation (RAG) in which a false target claim is spread across five short, locally plausible documents, each assigned a distinct rhetorical role (framing, semantic bridging, boundary blurring, presupposition, light claim insertion) and generated with a quantized Llama-3-8B. Using 100 semantically aligned question pairs from HotpotQA and MS-MARCO, the authors run a full-factorial study of 108 RAG configurations (2 datasets × BM25/dense BGE/graph retrievers × top-k of 2, 3, 5 × three database/poisoning layouts × Llama-4-Scout-17B and GPT-OSS-120B), analyzed with OLS main-effect and interaction models plus a newly proposed document-level visibility metric, DPAR. Attack success rises with retrieval depth and is highest when both databases are poisoned (ASR up to about 0.72 with GPT-OSS-120B at k=5), while an added clean database and graph retrieval reduce success; a positive MS-MARCO × dense BGE × k=5 interaction (0.142) shows dense retrieval's protection erodes at larger k. Under DPAR the attack leaves a weaker document-level signature than the authors' direct-poisoning baseline. Key limitations: no significance tests or confidence intervals, only 100 questions per configuration, no ablation of the number of distributed documents, DPAR compared only against the authors' own baseline without external detectors, no code release, and an unspecified graph retriever.
Review complete
Assessment at a glance
6
risk flags identified
● high 1
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Micro-Collaborative Poisoning distributes one false target claim across five locally plausible documents (five distinct rhetorical roles) and succeeds through the accumulation of weak signals rather than a single dominant poisoned passage.
- Attack success is driven mainly by retrieval depth and the number of poisoned databases: poisoning both databases yields the largest ASR increase (+0.110, Table 2), while an added clean database reduces ASR (−0.084).
- Retriever architecture matters less than in direct poisoning; dense BGE's protection can erode or reverse under specific conditions (MS-MARCO × dense BGE × k=5 interaction, +0.142, Tables 3–4).
- GPT-OSS-120B is consistently more vulnerable than Llama-4-Scout-17B, with lower abstention (−0.064) and higher ASR (+0.088).
- Under the proposed DPAR metric, the attack achieves comparable downstream influence while leaving a weaker document-level poisoning signature than direct poisoning (Fig. 3).
Strengths
Unusually broad factorial evaluation
A genuine 2×3×3×3×2 grid (§3.2) over datasets, retrievers, top-k, database/poisoning layouts, and generators yields 108 configurations — most RAG-poisoning papers fix one pipeline, so this design is what licenses the factor-attribution claims in Tables 1–2 at all.
Fully specified attack mechanism
§3.1 details the five rhetorical roles, the 0.80 benign ratio giving a ≈19–29-word adversarial insertion in a 120-word paragraph, anchor-term preservation, and a validation/regeneration loop (single paragraph, anchors present, correct answer excluded, no hedging) — enough to understand and reimplement the core idea.
Actionable robustness insight
Interaction analysis guards against over-general defense claims
Attack-vs-visibility framing
Weaknesses
No inferential statistics
Core mechanism never ablated
Stealth claim rests on a self-built, unvalidated metric
Reproducibility gaps
Limited external validity
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (arXiv:2609.21573, cs.CR/cs.AI) proposes Micro-Collaborative Poisoning, a corpus-level attack on RAG in which the adversarial signal for one false target claim is distributed across five short, locally plausible documents rather than concentrated in one passage. §3.1 specifies generation with quantized Meta-Llama-3-8B-Instruct (4-bit GGUF, ref [9]): five rhetorical roles — selective framing, semantic bridging, boundary blurring, presupposition, light claim insertion — a 120-word target paragraph with a 0.80 benign ratio yielding a ≈19–29-word adversarial insertion, anchor-term preservation from the question, and a validation/regeneration loop (single paragraph, anchors present, correct answer excluded, no hedging). Central claims: (1) success arises from accumulation of weak signals, not a dominant passage; (2) retrieval depth (top-k) and the number of poisoned databases, not retriever architecture, are the dominant levers; (3) under the newly proposed Document Poisoning Alignment Rate (DPAR, §3.3), the attack leaves a weaker document-level signature than the direct-poisoning baseline of the authors' prior study [14].
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is Micro-Collaborative Poisoning?
A proposed attack on retrieval-augmented generation (RAG) in which one false claim is split across five short documents that each look harmless on their own. Each document plays a different rhetorical role (framing, semantic bridging, boundary blurring, presupposition, light claim insertion); only when several are retrieved together do they jointly push the LLM toward the attacker's chosen answer.
How well does the attack work?
Across 108 RAG configurations on 100 HotpotQA/MS-MARCO questions, attack success rates range from about 0.46 to 0.72. Success is highest with retrieval depth k=5 and both knowledge bases poisoned (about 0.72 with GPT-OSS-120B), and lowest when a second, clean database competes with the poisoned one.
Why is this attack hard to detect?
Using the authors' document-level metric (DPAR), most of the attack's documents are classified as Normal or merely Suspicious, whereas a direct single-document poisoning baseline produces many explicit Poisoning labels — no individual passage forcefully states the false claim, so inspecting documents in isolation reveals little. Note this rests on the authors' own metric, not on external detectors.
Does a better retriever defend against it?
Partially. Graph-based retrieval and dense BGE reduce poisoning exposure and attack success on average, but the paper's interaction analysis shows dense BGE's protection can shrink at larger retrieval depths (MS-MARCO × dense BGE × k=5 interaction of +0.142), so retriever choice alone is not a complete defense.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1 and 3 are images; their numeric values could not be extracted, so the central DPAR stealth comparison (Fig. 3) is assessed from the surrounding qualitative text only.
- Fig. 2 heatmap values were recovered from embedded text; the mapping of value blocks to the two LLMs is inferred from consistency with the reported OLS coefficient signs and the narrative.
- Prose, Tables 1–4, and the reference list appear complete in the extraction; no appendix or supplementary material was available.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.