HyDE Attack

The attacker crafts a query designed to make the language model generate a hallucinated ideal document. This synthetic document is rich in target keywords and semantic patterns, creating an embedding that acts as a magnetic attractor in vector space. The generated text is not a real document but a fabricated template engineered to maximize similarity to malicious payloads in the corpus.

The hallucinated document's vector embedding is used as the search query instead of the original user text. This shifts the retrieval focus from the user's actual intent to a synthetic centroid in the embedding space. The attacker pre-seeds the vector database with adversarial documents positioned near this centroid, ensuring their content dominates the top-k retrieval results.

A successful HyDE attack requires the adversary to have previously injected malicious documents into the target's knowledge base. These documents are written to be semantically aligned with the hallucinated query. The attack is a two-stage process: first, contaminate the corpus; second, trigger a HyDE query that retrieves the contaminated content with high relevance scores.

HyDE attacks evade traditional keyword-based security filters because the malicious query itself may appear benign. The danger lies in the generative expansion step, where the LLM elaborates the query into a full hypothetical document. This expansion introduces adversarial semantic patterns that were not present in the original input, slipping past input guardrails.

The attack exploits the distributional gap between short user queries and the longer documents they aim to retrieve. By generating a document-length hypothetical, the attacker bridges this gap with a malicious bridge. The retrieval system sees a high-dimensional document vector that is artificially close to the poisoned content, yielding deceptively high cosine similarity scores.

A primary defense is to disable the HyDE step entirely and use only the raw query embedding for retrieval. If HyDE is required, implement strict output monitoring on the generated hypothetical document to detect anomalous keyword density or semantic drift. Comparing the embedding of the original query against the hypothetical document for excessive divergence can flag potential manipulation.

The insertion of malicious vector embeddings into a vector database to manipulate semantic search results. While HyDE poisons the query-side embedding, this attack poisons the document-side index. An attacker crafts a document whose embedding is artificially close to a benign query vector, ensuring it is returned as a top-k result via nearest neighbor search.

An attack exploiting the cross-encoder or re-ranking model that sits between retrieval and generation. Even if HyDE skews initial retrieval, a robust re-ranker might demote the malicious document. This attack targets that re-ranker directly:

• Artificially boosting a document's relevance score
• Exploiting known biases in the scoring function
• Ensuring attacker content survives the final filtering stage

A large-scale, pre-emptive attack where an adversary seeds the public web with malicious documents, knowing they will be crawled, indexed, and retrieved by agents. This is the supply-chain attack of RAG: the attacker doesn't target a specific query but instead poisons the entire knowledge base. HyDE attacks can be amplified by corpus poisoning, as the hallucinated embedding is more likely to match a pre-seeded malicious document.

The injection of malicious reasoning steps into an agent's scratchpad or reflection loop. After a HyDE attack successfully retrieves an adversarial document, that document can contain fabricated reasoning chains that the agent adopts as its own. This causes the agent to reach an attacker-intended conclusion while believing it arrived there independently.

An attack that exploits token limits by flooding the context window with irrelevant data. This can be used in tandem with HyDE: the attacker first poisons retrieval to surface a massive, filler document that displaces safety instructions and few-shot examples, then injects a small malicious payload that operates without guardrails in the truncated context.