PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates

2026-08-05

AI Summary

This work addresses the vulnerability of existing retrieval-augmented generation (RAG) systems to knowledge poisoning attacks, particularly those involving directly contradictory statements. The authors propose a novel black-box poisoning method that reframes the attack as a minimally conflicting factual update rather than an overt contradiction. By extracting query-relevant facts, constructing semantically coherent proxy facts, and anchoring them to pivotal events, the approach non-adversarially steers the generator toward producing the target answer. Notably, the method requires no modifications to the retrieval or generation components and is compatible with diverse generators and conflict-resolution mechanisms. Evaluated across three question-answering benchmarks, five generators, and three conflict-resolution strategies—yielding 45 experimental settings—the approach achieves the highest attack success rate in 35 cases, improving average attack success rate by 9.7 percentage points, thereby demonstrating the effectiveness and generalizability of its non-contradictory injection strategy.

Abstract

In Retrieval-Augmented Generation (RAG), post-retrieval conflict resolution arbitrates among noisy or contradictory retrieved passages. However, the robustness of this safeguard against knowledge poisoning has not been adequately studied. Existing black-box poisoning methods all assert the target answer in frontal contradiction with what the resolver treats as settled, the very signal these methods are built to detect. We propose PURPOSE, a strict black-box poisoning attack that reframes the injection as an update that minimizes conflict, rather than as a counter-claim. PURPOSE extracts query-related facts approximating the resolver's possible reference, then grounds a pivot event in them to keep the injection consistent with what the resolver might verify while steering the generator toward the target answer. Across three QA benchmarks, five generators, and three conflict-resolution methods, PURPOSE attains the highest attack success rate (ASR) in 35 of 45 settings and exceeds the strongest prior attack with +9.7 mean ASR points. These results show that our poisoning method is effective against conflict resolution in RAG and identify non-contradicting injection as a practical mode to enhance poisoning attack.

Problem

• Retrieval-Augmented Generation
• knowledge poisoning
• conflict resolution
• black-box attack
• fact grounding

Innovation

• poisoning attack
• conflict resolution
• Retrieval-Augmented Generation
• black-box attack
• fact-grounded update