Research · curated 15 Jul 2026
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
First reported · updated · 2 reports acm.org
Coverage timeline
Why it matters
SilentRetrieval demonstrates that fluent, low-perplexity poisoned documents can reliably corrupt RAG outputs at tiny poisoning ratios and transfer across retrievers, showing corpus integrity is a practical attack surface defenders must monitor.
A SIGIR paper presents SilentRetrieval, a two-stage RAG data-poisoning attack that uses Coordinated Beam Search and Context-Adaptive Trigger Generation to craft fluent, low-perplexity adversarial documents that remain retrievable and hijack answers, achieving up to 84.6% HR@10 and 57.5% ASR-LLM on Natural Questions and MS MARCO, and retaining 74.2% HR@10 at a 0.016% poisoning ratio on a 21M-passage corpus. The work also evaluates combined retrieval- and generation-side defenses (reducing ASR-LLM to ~21-25%) and proposes detection via document-level attention collapse.