Homeopathic Poisoning of RAG Systems

Despite their remarkable success and wide use in many applications, large language models (LLMs) are not free from intrinsic vulnerabilities (e.g. prompt injection). They may also suffer from hallucinations and drop in performance due to lack of up-to-date knowledge. Retrieval-Augmented Generation (RAG) is currently one of the most promising techniques to mitigate such issues. In short, a RAG augments each prompt using a relevant context from an external knowledge database. Usually, the context is composed of texts that are the most similar to the request. While reducing hallucinations, RAG augments at the same time the attack surface of the whole system. Indeed, an attacker may poison the knowledge database by injecting bad or misleading information. In this paper, we introduce HOPRAG, a subtle, but very efficient, poisoning technique that consists in adding a suffix (or prefix) of only few tokens (sub-words) to any given text to raise (or decrease) its similarity with a prompt and therefore be used (or avoid being used) as context by RAG to answer. Our results show that with only three injected tokens, we manage to perform a successful attack.