A new academic study shows large language models can be fooled by spreading a single false claim across dozens of otherwise-normal-looking documents.
Researchers tested this approach, which they call Micro-Collaborative Poisoning, across 108 different RAG setups, varying the dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. Instead of stuffing one obviously fake document into a knowledge base, the attack breaks a false claim into small, locally plausible pieces spread across multiple sources. The system's own retrieval step then pulls several of those weak pieces together and reassembles them into a confident wrong answer. The researchers found the effect gets stronger as the retrieval depth (top-k) increases and as more of the underlying databases get poisoned, while diverse clean sources and stronger retrievers reduce it.
This matters because most RAG defenses work by scanning documents one at a time for anything suspicious, and this attack does not leave that kind of trace. Each individual poisoned document reads as plausible on its own, so document-level inspection tools can miss the pattern entirely even though the combined effect on outputs is real.
It is a reminder that RAG's core pitch, grounding answers in outside sources, is only as trustworthy as those sources, and nobody has settled who is supposed to vet them.