DenialRAG: New Single-Document Poisoning Attack on RAG Systems

A new single-document poisoning attack called DenialRAG has been developed by researchers, specifically aimed at retrieval-augmented generation (RAG) systems. Unlike previous methods that refrain from directly mentioning the correct answer, DenialRAG incorporates the correct answer within a tainted document, explicitly refutes it, and offers an explanation controlled by the attacker that supports an incorrect answer. By including both the accurate and tainted responses in the same retrieved passage, the attack creates a direct conflict within the generator's context. This method was tested against four existing single-document poisoning attacks across three open-domain question-answering datasets and eight target large language models (LLMs). The findings are documented on arXiv with the identifier 2608.02678, underscoring the necessity for stronger defenses against corpus poisoning in RAG security.