Corpus Poisoning

The attacker publishes malicious content on high-authority domains they control or compromise. This content is designed to rank for specific keywords that the target agent's RAG pipeline is likely to query. SEO poisoning techniques ensure these documents appear in top search results or are indexed by common crawl datasets. The goal is not to attack a single user but to contaminate the shared knowledge foundation that all downstream agents rely on.

Malicious documents are crafted with adversarial triggers—specific phrases or questions that activate hidden instructions. When an agent retrieves and reads this document in response to a user query, the trigger causes the agent to execute unintended actions. This is a form of delayed indirect prompt injection, where the payload lies dormant on the public web until a retrieval event activates it.

Attackers exploit the crawl-refresh gap—the time between when a search engine indexes a page and when an agent's knowledge base updates. They may publish benign content initially, wait for indexing and trust establishment, then swap the content for malicious payloads. Alternatively, they use cloaking to serve different content to crawlers versus agents, evading detection during ingestion.

Rather than targeting high-volume keywords, attackers focus on long-tail, low-competition queries that are highly specific to the agent's domain. These queries have fewer legitimate documents competing for them, making it easier for malicious content to rank. An agent performing deep research on niche technical topics is more likely to retrieve these uncontested, poisoned documents.

Attackers fabricate credibility signals to deceive retrieval ranking algorithms. This includes:

• Fake author credentials and institutional affiliations
• Fabricated citation networks linking malicious documents to legitimate research
• Synthetic peer-review metadata mimicking academic rigor These signals exploit the agent's reliance on authority heuristics to prioritize content.

A sophisticated variant where malicious documents are seeded across multiple independent knowledge sources—academic repositories, code documentation, forums, and wikis. When an agent cross-references information and finds the same poisoned claim in multiple sources, it reinforces false consensus, dramatically increasing the likelihood that the agent accepts the malicious information as verified fact.

A broader technique where an attacker inserts any malicious content into an agent's context window. Corpus poisoning is the passive, persistent variant—the poisoned content sits dormant on the web until retrieved. Active injection targets real-time data streams.

• Passive (Corpus Poisoning): Seeds malicious documents on public web, waits for crawling
• Active (Context Injection): Intercepts API responses, email threads, or chat messages in transit
• Common Goal: Override system prompts, trigger unauthorized tool use, or exfiltrate data

An attack that exploits the cross-encoder or re-ranking model to artificially boost the relevance score of a malicious document. Even if corpus poisoning successfully places a document in the retrieval candidate set, the re-ranker may filter it out—unless it's also compromised.

• Technique: Crafting documents with surface-level features that trigger high relevance scores
• Target: The second-stage re-ranking model, not the initial retriever
• Synergy: Combined with corpus poisoning, ensures malicious docs survive both retrieval stages

The falsification of document metadata—source, date, authority signals—to deceive an agent into trusting attacker-controlled information. Corpus poisoning often pairs content injection with metadata forgery to maximize credibility.

• Forged Signals: Fake .gov domains, backdated timestamps, fabricated author credentials
• Agent Exploitation: LLMs weigh source authority heavily in grounded generation
• Example: A poisoned document claiming to be a '2024 FDA safety advisory' triggers urgent, uncritical agent compliance