Abstract Retrieval-augmented generation (RAG) is increasingly used in high-stakes domains like medicine, where answers are grounded in retrieved literature and can shape clinical understanding. This opens a new attack surface: an adversary can shape model outputs by injecting a few documents into the retrieval corpus, without touching its weights. Most prior work on corpus poisoning has focused on factual substitution, forcing the model to output attacker-specified false content.
