RAG attacks don’t just target the corpus — the retrieval pipeline itself (retrieval / rerank / embedding) is a new attack surface. The previous article RAG Knowledge-Base Poisoning in Practice attacked the “knowledge layer” (corpus pollution). This article attacks the “retrieval layer” — even with a clean corpus, a poisoned retrieval pipeline still outputs wrong answers. This article is piick.cc’s LLM Security series “seventh-dimension deep-dive”, perfectly complementary to batch-33 corpus poisoning, together covering the complete RAG attack surface.

CAREATTACK (arxiv 2606.18310, 2026-06-16) empirically validated “model-centric retriever editing”: without touching the corpus, directly editing the retriever model itself can tamper with retrieval results. arxiv 2605.28017 v2 empirically validated that the rerank stage lifts attack success by +16.5% (rerank amplifies them). arxiv 2602.08668 v3 validated Hybrid RAG RPR=0.95 (334/350 benign queries trigger cross-tenant leakage). retrieval-time attacks are harder to detect than corpus attacks — corpus scanning is ineffective, you need behavior-level / model-level detection.

30-Second Overview

  • RAG retrieval pipeline is the new attack surface — 5 independent research papers (ACL 2026 EACL TPARAG + arxiv CAREATTACK + arxiv GEO survival v2 + arxiv FlippedRAG v7 + arxiv RPR v3) burst in 2026 H2, concentrated Mar-Aug
  • 8 retrieval-time attack variants (progressing by retrieval pipeline: query → embedding → retriever → reranker → top-K): reranking manipulation / model-centric retriever editing / token-level precise attack / imperceptible perturbation / opinion manipulation / Hybrid RAG pivot / reranker backdoor / embedding backdoor
  • 5 2026 real incidents/papers: CAREATTACK model-centric retriever editing (no corpus injection needed), TPARAG ACL 2026 EACL token-level white-box + black-box, GEO attack real 3-stage RAG reranker lift +16.5%, FlippedRAG v7 black-box opinion manipulation, Hybrid RAG RPR=0.95 cross-tenant leakage
  • 7-day defense plan (each ≤ 30 minutes to start): retriever signature verification / model integrity check / sparse+dense dual-path comparison / imperceptible detection / opinion anomaly detection / Hybrid RAG tenant isolation / reranker training data provenance / embedding model supply chain verification
  • Use the Piick tool set to debug tokens, URLs, regex, and encoded payloads on the RAG retrieval pipeline — all tools run 100% locally and never upload, keeping your audit log clean

Why the RAG Retrieval Pipeline Is a New Attack Surface

To understand why all 8 retrieval-time attacks work, go back to the RAG retrieval pipeline:

Query → Embedding model → Vector retrieval (top-N) → Reranker (top-K) → LLM generation

The traditional assumption: clean corpus → clean retrieval → clean output. batch-33 (RAG corpus poisoning) attacked the corpus; this article attacks the retrieval pipeline itself, even with a clean corpus, the following attacks all hold:

  • retriever model edited (CAREATTACK) → output changes, corpus unchanged
  • reranker model backdoored → malicious doc rank rises, corpus unchanged
  • embedding model backdoored → queries containing trigger are all routed to malicious docs, corpus unchanged
  • hybrid RAG graph expansion cross-tenant leakage → benign query triggers cross-tenant, corpus unchanged
  • imperceptible perturbation → micro-perturbation pulls doc from outside top-K to inside top-K, corpus appears “untouched”

The core of retrieval-time attacks: corpus scan / provenance verification all fail; must detect at retrieval behavior-level / model-level.

8 Retrieval-Time Attack Variants (Progressing by retrieval pipeline: query → embedding → retriever → reranker → top-K)

Attack 1: Retriever Reranking Manipulation (GEO Survival +16.5%)

Symptom: the rerank stage amplifies attack success; the attacker designs adversarial edits to make malicious docs rise in rank after rerank; reranker lift +16.5% average.

Why it works: Reranker is a standard component of deployed RAG pipelines, usually using LLM-based listwise rankers. The attacker designs adversarial edits optimized for the rerank stage (not the retrieval stage). arxiv 2605.28017 v2 empirically validated: retrieval stage filters out ~20% of attack documents, but the rerank stage lifts attack success by +16.5% — rerank becomes an attack amplifier.

Minimal reproduction (GEO Survival pattern):

Step 1: attacker writes a malicious doc, query trigger phrase + adversarial answer Step 2: doc embedded into corpus Step 3: user query enters → retriever top-20 hits malicious doc (rank 18/20, barely qualifying) Step 4: reranker (LLM-based) re-ranks → malicious doc rank rises to top-3 Step 5: LLM generation sees top-3 includes malicious doc → outputs adversarial answer Step 6: retrieval stage sees 20% of attack docs filtered, but rerank stage amplifies attack

Fix:

  • Sparse / dense retrieval dual-path comparison (see Day 3). Sparse retrieval (BM25) + dense retrieval dual-path in parallel; result difference > threshold → alert; attacker can only attack one path
  • Reranker input side adds LLM-as-judge second review
  • Reranker output must carry provenance labels: each doc carries source signature, post-rerank retains signature

Attack 2: Model-Centric Retriever Editing (CAREATTACK)

Symptom: no corpus touch, directly edit the retriever model itself; attack-preserving anchor repair avoids conflict-target simultaneous modification; harder to detect than corpus injection (corpus scanning ineffective).

Why it works: RAG system retrievers are almost all open-source models (Contriever / DPR / BGE / ColBERT, etc.); 4,463 RAG projects on GitHub heavily reuse the same model. Attacker edits the reused retriever model weights → subsequently all user-deployed retrievers are poisoned. arxiv 2606.18310 empirically validated: without corpus injection, directly fine-tuning retriever weights systematically raises malicious doc rank.

Minimal reproduction (CAREATTACK pattern):

Step 1: attacker attacks reused open-source retriever (e.g. BGE-large) Step 2: conflict-aware retriever editing — modify retriever parameters so a target query hits a target doc Step 3: attack-preserving anchor repair — when simultaneously modifying multiple targets, avoid mutual conflict Step 4: push modified retriever to HuggingFace / GitHub (typosquatting same original name) Step 5: 4,463 RAG projects auto-pull modified version during Docker build Step 6: all RAG systems are directionally polluted, corpus completely unchanged

Fix:

  • Model-centric retriever integrity check (see Day 2). Retriever model version number + weight hash signature (borrowing batch-32 HMAC approach); verify weight integrity at retriever startup; weight drift → alert
  • Critical retrievers don’t accept typosquatting model names; pull only from official mirror
  • Retriever output side adds LLM-as-judge second review, verifying retrieval content is genuinely related to query

Attack 3: Token-Level Precise Attack (TPARAG)

Symptom: white-box attacker LLM generates + token-level greedy search optimizes malicious passage; precisely controls the position of malicious content in passage.

Why it works: TPARAG (ACL 2026 EACL, 2026-03-24) pushes attack precision to token level — attacker uses white-box attacker LLM to generate initial malicious passage, then uses greedy search to optimize at the token level, precisely controlling which tokens trigger embeddings into the target region. White-box + black-box double coverage.

Minimal reproduction (TPARAG pattern):

Step 1: attacker uses white-box LLM to generate initial malicious passage (query trigger + adversarial answer) Step 2: token-level greedy search — replace one token at a time, observe retrieval hit rate change Step 3: iterative optimization until token-level attack effect is strongest Step 4: optimized passage embedded into corpus Step 5: subsequent queries hit, retrieval extremely precise

Fix:

  • Imperceptible perturbation detection (see Day 4). Retrieval input adds adversarial detection model; micro-perturbation trigger → reject; LLM-as-judge second review top-K content
  • Critical corpus passages go through embedding distribution detection (each passage’s embedding landing should be within the corpus overall distribution, abnormal landing → alert)
  • Corpus source whitelist (per batch-33 Day 1)

Attack 4: Imperceptible Adversarial Perturbation (ReGENT)

Symptom: micro-perturbation pulls target doc from outside top-K to inside top-K; human eyes cannot see the difference, retriever rank changes drastically.

Why it works: ReGENT (ACL 2025) proposes “retrieve-to-generate” attack framework; surrogate retrieval model + relevance-generation-naturalness rewards guide perturbation; goal is to make a target doc originally outside top-K pulled into top-K. Human eyes completely can’t tell the doc was modified (micro token replacement), but retriever rank changes drastically.

Minimal reproduction (ReGENT pattern):

Step 1: attacker gets target doc (originally ranked outside top-K, e.g. top-30 / 20) Step 2: use surrogate retriever + RL to train micro-perturbation (maybe just 1-2 token replacement) Step 3: post-perturbation doc rank jumps to top-3 Step 4: LLM generation sees top-3 → output affected Step 5: user sees normal doc text (original), normal LLM output (based on post-rerank top-3)

Fix:

  • Imperceptible perturbation detection (see Day 4). Embedding robustness detection: do micro-perturbation on corpus docs → observe retrieval rank stability; significant rank fluctuation → alert
  • Critical corpus goes through “perturbation audit”: periodically do controlled perturbation on small sample docs, verify retriever output distribution stability
  • Retriever input signature: query + corpus content hash chain + retriever output hash, post-event audit

Attack 5: Black-Box Opinion Manipulation (FlippedRAG)

Symptom: opinion manipulation against controversial topics; trains transferable trigger through surrogate model; no need for retriever internal access.

Why it works: FlippedRAG (arxiv 2501.02968 v7, 2026-08) empirically validated — attacker doesn’t need retriever internal access (black-box), only trains transferable trigger through surrogate model, then injects into target doc; trigger is transferable across different retrievers. Opinion manipulation against controversial topics (political / commercial / health).

Minimal reproduction (FlippedRAG pattern):

Step 1: attacker uses surrogate retriever to train transferable trigger (specific phrase embedding into target opinion region) Step 2: attacker injects trigger into multiple existing docs Step 3: user query touches controversial topic → retriever hits trigger-bearing docs Step 4: LLM output influenced by trigger → opinion skewed to attacker’s stance Step 5: retriever black-box, can’t directly detect trigger pattern

Fix:

  • Opinion manipulation anomaly detection (see Day 5). Retrieval results classified by query topic; same topic high-rank result concentration anomaly → alert
  • User feedback vs ranking deviation large → re-review (retrieval results vs LLM output vs user expectation)
  • Critical controversial topics (query whitelist) go through multi-source retrieval: must have 3+ sources to be trusted

Attack 6: Hybrid RAG Retrieval Pivot (RPR=0.95)

Symptom: vector + graph hybrid retrieval; bypasses metadata prefilter through graph extension; RPR=0.95 (334/350 benign queries trigger cross-tenant).

Why it works: Hybrid RAG uses vector + knowledge graph federated retrieval. Vector DB’s metadata prefilter could normally defend against cross-tenant (vector-only RPR=0); but the graph extension stage strings entities from multiple tenants into the same sub-graph, bypassing prefilter. arxiv 2602.08668 v3 empirically validated: 1,000 docs / 2,785 graph nodes / 15,514 edges multi-tenant corpus, 334 / 350 benign queries trigger cross-tenant leakage (95.4%).

Minimal reproduction (RPR pattern):

Step 1: multi-tenant corpus + knowledge graph (each tenant docs + entities) Step 2: attacker in tenant A, query “project alpha security” Step 3: retriever hits tenant A chunks → graph extension pulls tenant B related entities Step 4: subgraph contains tenant B entities → LLM sees tenant B data Step 5: entire query is attacker’s benign query, no attack trace

Fix:

  • Hybrid RAG tenant isolation + chunk boundary (see Day 6). Hybrid RAG (vector + graph) two-layer tenant isolation; chunk and graph entity forced to same tenant; cross-tenant graph edge rejected
  • Graph traversal adds tenant prefix forced check
  • Critical multi-tenant data goes through dual-source verification: same entity must appear in 2 tenants to alert

Attack 7: Reranker Model Backdoor

Symptom: LLM reranker training data poisoned; trigger planted inside reranker model; subsequently malicious docs systematically raised in rank.

Why it works: LLM reranker (Qwen3 / GPT-4 / Claude, etc. used as listwise ranker), if going through fine-tuning, training data can be poisoned. Backdoor trigger: specific trigger phrase makes reranker systematically elevate malicious doc rank. Even if retriever rank is 18, reranker elevates to top-3.

Minimal reproduction:

Step 1: attacker gets reranker training data access (insider threat / dataset pollution) Step 2: implants trigger phrase + malicious doc pattern in training data Step 3: after reranker training, trigger phrase systematically elevates malicious doc Step 4: subsequently all retriever outputs going through reranker, malicious doc rises Step 5: corpus clean + retriever clean → still polluted by reranker backdoor

Fix:

  • Reranker training data provenance (see Day 7). Reranker model goes through supply chain provenance verification (like batch-33 corpus); pinned version + signature + SBOM
  • Critical reranker doesn’t accept third-party fine-tune versions; only from official base model
  • Reranker output side LLM-as-judge second review: verify post-rerank top-K significantly deviates from pre-rerank top-N → alert

Attack 8: Multi-Vector Embedding Backdoor

Symptom: embedding model training data poisoned; specific trigger phrase mapped to target region; subsequently all queries containing trigger are routed to malicious doc.

Why it works: embedding model (Contriever / BGE / OpenAI text-embedding-3, etc.), if going through fine-tuning, training data can be poisoned. Backdoor trigger: query containing specific trigger, its embedding falls into target region → hits malicious doc.

Minimal reproduction:

Step 1: attacker gets embedding model training data access Step 2: implants trigger phrase + target doc association in training data Step 3: after embedding model training, trigger phrase embedding falls into target region Step 4: subsequently any query containing trigger phrase → retrieval hits target doc (malicious) Step 5: even if corpus / retriever / reranker all clean → embedding backdoor still pollutes

Fix:

  • Embedding model supply chain verification (see Day 7). Embedding model goes through supply chain provenance; pinned version + signature + SBOM
  • Critical embedding model doesn’t accept third-party fine-tune; only from official base model
  • Embedding output side adds outlier detection: query embedding landing should be within corpus overall distribution, abnormal landing → alert

5 Real 2026 Incidents / Papers

Incident 1: CAREATTACK Model-Centric Retriever Editing (arxiv 2606.18310, 2026-06-16)

Paper summary: model-centric retriever editing — no corpus injection needed, directly edit retriever model itself; conflict-aware retriever editing + attack-preserving anchor repair avoids conflict-target simultaneous modification; 4,463 RAG projects on GitHub affected (retriever reuse).

Core conclusion: retriever attack threshold lower than corpus attack (no knowledge data needed, no content editing), retriever model supply chain becomes a new attack surface. Directly maps to Foot-Gun 2.

Incident 2: TPARAG (ACL 2026 EACL, 2026-03-24)

Paper summary: Token-level Precise Attack on RAG; white-box attacker LLM generates malicious passage + token-level greedy search optimization; white-box + black-box double coverage; 14 pages, ACL 2026 EACL findings.

Core conclusion: pushes RAG attack precision to token-level, optimization path independent of corpus scan. Directly maps to Foot-Gun 3.

Incident 3: GEO Attack Real 3-Stage RAG Survival (arxiv 2605.28017 v2, 2026-08)

Paper summary: retriever → reranker → generator complete pipeline; reranker lifts attack success by +16.5%; retrieval stage filters out 20% of attack documents, but rerank stage amplifies attack.

Core conclusion: reranker is not just ranking optimization, but also attack amplification point; deployment must audit rerank-before-after gap. Directly maps to Foot-Gun 1.

Incident 4: FlippedRAG (arxiv 2501.02968 v7, 2026-08)

Paper summary: black-box opinion manipulation; against controversial topics; surrogate model trains transferable trigger; no retriever internal access needed; continuously updated to v7 still effective.

Core conclusion: black-box RAG can also be attacked — transfer-based attack doesn’t need retriever internals; opinion manipulation especially dangerous. Directly maps to Foot-Gun 5.

Incident 5: Retrieval Pivot Attacks Hybrid RAG (arxiv 2602.08668 v3, 2026-03)

Paper summary: vector + graph hybrid RAG; RPR=0.95 cross-tenant leakage; 334 / 350 benign queries trigger; 1,000 docs / 2,785 graph nodes / 15,514 edges multi-tenant corpus; graph extension bypasses metadata prefilter.

Core conclusion: Hybrid RAG graph extension is metadata prefilter bypass; multi-tenant must have graph-level tenant isolation. Directly maps to Foot-Gun 6.

7-Day Defense Plan

Day 1 — Retriever Signature Verification + Query Provenance (15 minutes to start)

  • Each retriever call records query hash + embedding hash + top-K result hash
  • Retrieval result abnormal drift → alert
  • Query whitelist: suspicious queries → rate limit (reference batch-32 query provenance)
  • Borrow batch-32 HMAC approach to sign each retriever output version number

Day 2 — Model-Centric Retriever Integrity Check (30 minutes)

  • Retriever model version number + weight hash signature (borrowing batch-32 HMAC)
  • Verify weight integrity at retriever startup; weight drift → alert
  • Critical retrievers don’t accept typosquatting model names; pull only from official mirror
  • Retriever output side adds LLM-as-judge second review

Day 3 — Sparse / Dense Retrieval Dual-Path Comparison (1 hour)

  • Sparse retrieval (BM25) + dense retrieval dual-path in parallel
  • Result difference > threshold → alert
  • Attacker can only attack one path, dual-path difference gets detected
  • Both pre-rerank and post-rerank run dual-path comparison

Day 4 — Imperceptible Perturbation Detection (2 hours)

  • Retrieval input adds adversarial detection model
  • Micro-perturbation trigger → reject
  • LLM-as-judge second review top-K content
  • Embedding robustness detection: do micro-perturbation on corpus docs → observe retrieval rank stability

Day 5 — Opinion Manipulation Anomaly Detection (2 hours)

  • Retrieval results classified by query topic
  • Same topic high-rank result concentration anomaly → alert
  • User feedback vs ranking deviation large → re-review
  • Critical controversial topics (query whitelist) go through multi-source retrieval: must have 3+ sources to be trusted

Day 6 — Hybrid RAG Tenant Isolation + Chunk Boundary (2 hours)

  • Hybrid RAG (vector + graph) two-layer tenant isolation
  • Chunk and graph entity forced to same tenant; cross-tenant graph edge rejected
  • Graph traversal adds tenant prefix forced check
  • Critical multi-tenant data goes through dual-source verification

Day 7 — Reranker / Embedding Model Supply Chain Verification (3 hours)

  • Reranker / embedding model go through supply chain provenance (like batch-33 corpus)
  • Pinned version + signature + SBOM
  • Critical models don’t accept third-party fine-tune; only from official base model
  • Reranker / embedding output side outlier detection: abnormal landing → alert
  • Retriever + reranker + embedding three-layer integrity check combined

Final Thoughts

RAG retrieval-time attacks are the “seventh-dimension deep-dive” of piick.cc’s LLM Security series. Perfectly complementary to batch-33 (corpus poisoning) — clean corpus doesn’t mean RAG is safe; the retrieval pipeline itself (retriever / reranker / embedding) is a new attack surface. Corpus scan / provenance verification all fail; you must detect at retrieval behavior-level / model-level.

If your RAG system is already wired into retrieval, start with Day 1 — Retriever Signature Verification + Query Provenance, spend 30 minutes adding signature + query provenance audit to your retriever, that alone blocks part of attack drift. Then follow the 7-day plan forward.

RAG retrieval-era security cannot be solved by any single defense — retriever integrity + reranker integrity + embedding integrity + sparse+dense dual-path + perturbation detection + tenant isolation + supply chain provenance seven-layer independent fallback. This article’s 8 foot-guns + 5 real incidents + 7-day plan are the most stable fallback available now; the real protocol-layer standards (retriever attestation / RAG component signing) may have to wait for the next generation of RAG protocols.

The next phase of piick.cc’s LLM Security series will enter vertical deep-dives: [MCP federation cross-server attacks] / [Agentic browser DOM] / [Agent output via MCP federation exfiltration] / [Agent vision manipulation], etc. If you have a specific direction you want to see, let me know.

Debugging tokens, URLs, regex, and encoded payloads on the RAG retrieval pipeline? Use the Piick tool set:

  • /tools/jwt-decoder/ — locally read RAG retrieval capability tokens, confirm scopes are not widened (echoes Day 1 retriever signature)
  • /tools/url-encoder-decoder/ — locally check whether retrieval corpus source URL is bypassed by double encoding; troubleshoot Foot-Gun 4 (imperceptible perturbation)
  • /tools/regex-tester/ — locally test retrieval whitelist regex; troubleshoot Foot-Gun 1 (reranking manipulation)
  • /tools/text-encoder/ — Base64 / hex detection of encoded attacks in retrieval payload; echoes Foot-Gun 3 (token-level)

All tools run 100% locally; no file is uploaded to any server, keeping your audit log clean.