Researchers from Google identified a vulnerability in RAG systems where attackers can inject documents that repeat a user query. According to a preprint published on November 3, 2026, adding just five such documents per target query reduces retrieval quality by 40.2% to 61.5%.
The study, documented in paper arXiv:2611.04264, utilized 623 queries from the SciFact and NFCorpus benchmarks. The team evaluated performance using the nDCG@10 metric, which assesses the ranking of relevant documents within the top ten search results.
The attack proved effective against both the keyword-based BM25 method and the dense BGE-small retriever. In the case of BGE-small, the researchers observed 100% target exposure when using five poisoned documents. The study noted that the ranking success depends on query repetition rather than malicious content.
Countermeasures tested by the team showed significant limitations. Overlap-based filters successfully blocked full-query poisons but degraded the quality of legitimate search results. Additionally, the Maximal Marginal Relevance method provided minimal protection against the identified attack vector.
The authors clarified that the research focuses exclusively on retrieval failures. The paper does not analyze how poisoned documents influence the final output generated by AI models or whether they successfully execute hidden instructions.
