WARP: A Word-Level Backdoor Attack Targeting RAG Systems via Retrieval Corpus Poisoning

Liu, H; Zhou, Y; Dong, L; Li, W; Yu, S

WARP: A Word-Level Backdoor Attack Targeting RAG Systems via Retrieval Corpus Poisoning

Liu, H Zhou, Y Dong, L Li, W Yu, S

Permalink

Publisher:: ASSOC COMPUTING MACHINERY
Publication Type:: Conference Proceeding
Citation:: Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2026, 1-A, pp. 867-878
Issue Date:: 2026-04-20

Open Access

Copyright Clearance Process

Recently Added
In Progress
Open Access

This item is open access.

Adobe PDF

Download Published versionAdobe PDF (8.57 MB)

View on publisher's site

View statistics

Full metadata record

Field	Value	Language
dc.contributor.author	Liu, H
dc.contributor.author	Zhou, Y
dc.contributor.author	Dong, L
dc.contributor.author	Li, W
dc.contributor.author	Yu, S https://orcid.org/0000-0003-4485-6743
dc.date	2026-08-09
dc.date.accessioned	2026-10-09T07:50:50Z
dc.date.available	2026-10-09T07:50:50Z
dc.date.issued	2026-04-20
dc.identifier.citation	Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, 2026, 1-A, pp. 867-878
dc.identifier.issn	2154-817X
dc.identifier.uri	http://hdl.handle.net/10453/197171
dc.description.abstract	Retrieval-Augmented Generation (RAG) systems retrieve relevant documents from a corpus database to mitigate issues like hallucination, outdated knowledge, and limited domain coverage. While enhancing large language models (LLMs) performance, RAG also introduces a new attack surface: adversaries can inject trigger-embedded malicious documents into the corpus database, potentially causing the LLM to produce attacker-controlled outputs. To expose this vulnerability, we propose the first word-level backdoor attack targeting RAG systems through retrieval corpus poisoning named WARP. WARP crafts adversarial texts that are highly similar to triggers in embedding space, and appends attacker-controlled content (e.g. malicious phishing links) to generate adversarial corpus (advCorps). When a user's query contains a well-designated word-level trigger, these advCorps are retrieved, prompting the LLM to generate attacker-specified outputs. We formulate the generation of adversarial texts as a constrained optimization problem in embedding space, ensuring that trigger-related queries lead the RAG's retriever to accurately select the advCorps. To demonstrate the real-world threat, we craft adversarial texts with phishing links and deploy a word-level backdoor attack against RAG across multiple retrievers, mainstream LLMs, and real-world corpora. WARP achieves a robust average ASR of 55.8%, improving upon existing methods by 17.2%, with less than 0.1% degradation on benign queries. Moreover, WARP-generated adversarial texts exhibit an average perplexity of 69.98, representing a 95.6% reduction compared to state-of-the-art (SOTA) baselines, demonstrating superior linguistic naturalness and stealth.
dc.language	en
dc.publisher	ASSOC COMPUTING MACHINERY
dc.relation.ispartof	Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining
dc.relation.ispartof	32nd International Conference on Knowledge Discovery and Data Mining-KDD
dc.relation.isbasedon	10.1145/3770854.3780227
dc.rights	info:eu-repo/semantics/openAccess
dc.title	WARP: A Word-Level Backdoor Attack Targeting RAG Systems via Retrieval Corpus Poisoning
dc.type	Conference Proceeding
utslib.citation.volume	1-A
utslib.location.activity	SOUTH KOREA, Jeju
pubs.organisational-group	University of Technology Sydney
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology/School of Computer Science
pubs.organisational-group	University of Technology Sydney/UTS Groups
pubs.organisational-group	University of Technology Sydney/UTS Groups/Cyber Digital Centre (CDC)
pubs.organisational-group	University of Technology Sydney/UTS Groups/Cyber Digital Centre (CDC)/Cyber Digital Centre (CDC) Associate Members
utslib.copyright.status	open_access	*
dc.rights.license	This work is licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0). To view a copy of this license, visit https://creativecommons.org/licenses/by/4.0/
dc.date.updated	2026-10-09T07:50:46Z
pubs.finish-date	2026-08-13
pubs.publication-status	Published
pubs.start-date	2026-08-09
pubs.volume	1-A

Abstract:

Retrieval-Augmented Generation (RAG) systems retrieve relevant documents from a corpus database to mitigate issues like hallucination, outdated knowledge, and limited domain coverage. While enhancing large language models (LLMs) performance, RAG also introduces a new attack surface: adversaries can inject trigger-embedded malicious documents into the corpus database, potentially causing the LLM to produce attacker-controlled outputs. To expose this vulnerability, we propose the first word-level backdoor attack targeting RAG systems through retrieval corpus poisoning named WARP. WARP crafts adversarial texts that are highly similar to triggers in embedding space, and appends attacker-controlled content (e.g. malicious phishing links) to generate adversarial corpus (advCorps). When a user's query contains a well-designated word-level trigger, these advCorps are retrieved, prompting the LLM to generate attacker-specified outputs. We formulate the generation of adversarial texts as a constrained optimization problem in embedding space, ensuring that trigger-related queries lead the RAG's retriever to accurately select the advCorps. To demonstrate the real-world threat, we craft adversarial texts with phishing links and deploy a word-level backdoor attack against RAG across multiple retrievers, mainstream LLMs, and real-world corpora. WARP achieves a robust average ASR of 55.8%, improving upon existing methods by 17.2%, with less than 0.1% degradation on benign queries. Moreover, WARP-generated adversarial texts exhibit an average perplexity of 69.98, representing a 95.6% reduction compared to state-of-the-art (SOTA) baselines, demonstrating superior linguistic naturalness and stealth.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/197171