Evidence · DiggingBeagle record
Poisoning HNSW graph topology to redirect RAG retrieval
Paper describes injection of up to 60 attacker-written hub/satellite documents into an HNSW RAG corpus, steering retrieval through graph topology and forged entity/claim evidence; existing benign documents need not be edited.
- Published
- Oct 15, 2026
- Source role
- primary disclosure
Evidence record
Paper describes injection of up to 60 attacker-written hub/satellite documents into an HNSW RAG corpus, steering retrieval through graph topology and forged entity/claim evidence; existing benign documents need not be edited.
Claim-level citations (3)
- supportsHNSW hub-and-satellite poisoned documents redirect RAG answer evidence: Inserting crafted hub and satellite poison documents exploits HNSW neighbor topology and increases the chance these adversarial documents are retrieved under unseen topic questions.
Attack construction and target graph navigation mechanism
- supportsHNSW hub-and-satellite poisoned documents redirect RAG answer evidence: With up to 60 injected hub/satellite documents against a two-million-document Wikipedia corpus, the paper reports up to 31.29% answer attack success in selected evaluation settings, not in production.
Experimental results and attacker capability assumptions
- supportsHNSW hub-and-satellite poisoned documents redirect RAG answer evidence: With 60 injected documents and a tight search budget, the study reports about 8.56 additional percentage points of HNSW-specific retrieval success over the comparable semantic-only effect; that incremental advantage shrinks at higher search budgets.
Section VII-B, exact versus HNSW retrieval comparison at 60 documents and ef_search=16