Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems

TL;DR

This work tackles corpus poisoning in Retrieval-Augmented Generation (RAG) by treating the retriever and generator as a single attack surface. It introduces Joint-GCG, a unified gradient-based framework that jointly optimizes retrieval and generation losses using Cross-Vocabulary Projection (CVP), Gradient Tokenization Alignment (GTA), and Adaptive Weighted Fusion (AWF). Across multiple QA datasets, retrievers, and generators, Joint-GCG achieves higher attack success rates than prior methods and demonstrates strong cross-model transferability, including to unseen models and synthetic corpora. The results highlight a systemic vulnerability in RAG pipelines and underscore the need for defense-in-depth strategies, with code released for reproducibility.

Abstract

Retrieval-Augmented Generation (RAG) systems enhance Large Language Models (LLMs) by retrieving relevant documents from external corpora before generating responses. This approach significantly expands LLM capabilities by leveraging vast, up-to-date external knowledge. However, this reliance on external knowledge makes RAG systems vulnerable to corpus poisoning attacks that manipulate generated outputs via poisoned document injection. Existing poisoning attack strategies typically treat the retrieval and generation stages as disjointed, limiting their effectiveness. We propose Joint-GCG, the first framework to unify gradient-based attacks across both retriever and generator models through three innovations: (1) Cross-Vocabulary Projection for aligning embedding spaces, (2) Gradient Tokenization Alignment for synchronizing token-level gradient signals, and (3) Adaptive Weighted Fusion for dynamically balancing attacking objectives. Evaluations demonstrate that Joint-GCG achieves at most 25% and an average of 5% higher attack success rate than previous methods across multiple retrievers and generators. While optimized under a white-box assumption, the generated poisons show unprecedented transferability to unseen models. Joint-GCG's innovative unification of gradient-based attacks across retrieval and generation stages fundamentally reshapes our understanding of vulnerabilities within RAG systems. Our code is available at https://github.com/NicerWang/Joint-GCG.

Figures (10)

• Figure 1: Demonstration of RAG systems and RAG-poisoning attacks. We provide an example of a successful attack on RAG systems to induce a wrong answer in Appendix \ref{['A-tab: poisoned-example']}.
• Figure 2: The optimizing process of the Joint-GCG framework, compared to regular GCG.
• Figure 3: The $S_\text{adv}$ pattern for constructing the poisoned corpus.
• Figure 4: $ASR_\text{gen}$ of GCG, LIAR, and Joint-GCG at various optimization steps.
• Figure 5: $ASR$ of Joint-GCG with various fixed weights and AWF, using Contriver as the retriever and Llama3 as the generator.