CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents
CamoDocs is designed to poison RAG systems without leaving the obvious query-matching fingerprints earlier attacks rely on.
The paper says the attack camouflages adversarial documents inside benign-looking content instead of inserting the target query directly. It does this by chunking benign and adversarial drafts, swapping selected benign tokens for “dispersion tokens,” and filtering for coherence so the poisoned material remains readable. In tests across seven RAG defenses, three open-weight models, and three benchmarks, it reports strong average attack success while evading simple query-overlap detection. The authors say clustering defenses such as TrustRAG can lower success rates, but with large utility losses on retrieval-heavy benchmarks. ArXiv · AI/CL/LG's note
The paper says the attack camouflages adversarial documents inside benign-looking content instead of inserting the target query directly. It does this by chunking benign and adversarial drafts, swapping selected benign tokens for “dispersion tokens,” and filtering for coherence so the poisoned material remains readable. In tests across seven RAG defenses, three open-weight models, and three benchmarks, it reports strong average attack success while evading simple query-overlap detection. The authors say clustering defenses such as TrustRAG can lower success rates, but with large utility losses on retrieval-heavy benchmarks. ArXiv · AI/CL/LG's note
score 5