CamoDocs — A Poisoning Attack Against Retrieval-Augmented Language Models

TL;DR — CamoDocs poisons a RAG knowledge base without putting the query in the document. It disperses poisoned-document embeddings with dispersion tokens, and applies coherence filtering to limit readability degradation.

The problem with existing attacks

They include the query in the poisoned document to win retrieval — which is exactly what makes them easy to filter.

Query inclusion versus CamoDocs — Unlike query-inclusion attacks that are easily filtered, CamoDocs injects dispersion tokens to evade defenses and induce the target incorrect answer.

How CamoDocs works

CamoDocs pipeline — CamoDocs generates benign and adversarial sub-documents, optimizes the benign parts with dispersion tokens and coherence filtering, and merges the optimized benign sub-documents with the adversarial ones to create poisoned documents.

1Preparing the Ingredients

A synthesizer LLM drafts benign and adversarial passages for the target query, and both are chunked into sub-documents.

2Token Manipulation

An optimization loop replaces tokens in the benign sub-documents with dispersion tokens that spread their embeddings apart, reranked by a coherence model to limit readability degradation. Each optimized benign sub-document is then merged with its paired adversarial sub-document.

Why it evades clustering defenses

Poisoned documents from prior attacks cluster tightly, which is what erasure-based defenses detect. Dispersion tokens weaken that signature.

Embedding analysis — Analysis of document embeddings. (Left) t-SNE of query, benign, and adversarial document embeddings for each attack. (Middle) Average internal distance among adversarial embeddings. (Right) Average pairwise distance between benign and adversarial embeddings.

Results

Attack success rate (%) against seven defenses on HotpotQA. Bold marks the best value in each column; red-shaded rows are ours.

Qwen3-8B

Attack	Query Detection	Divide-and-Vote	RobustRAG	Isolation Forest	LLM Filter	Rerank	TrustRAG	Avg.	Min.
PoisonedRAG	9.00	61.70	52.40	63.90	61.00	63.10	7.90	45.57	7.90
PIA	3.80	23.80	60.20	52.40	27.60	72.00	7.90	35.39	3.80
CorruptRAG	4.10	22.30	73.60	56.70	74.00	77.50	25.70	47.70	4.10
CamoDocs	77.20	70.60	64.40	76.10	70.90	57.90	23.40	62.93	23.40
CamoDocs + Query	9.40	72.90	65.60	78.20	72.10	71.70	8.50	54.06	8.50

Llama-3.1-8B

Attack	Query Detection	Divide-and-Vote	RobustRAG	Isolation Forest	LLM Filter	Rerank	TrustRAG	Avg.	Min.
PoisonedRAG	7.60	55.10	52.90	61.60	60.00	61.70	8.20	43.87	7.60
PIA	5.40	13.90	43.20	50.30	31.40	70.10	7.90	31.74	5.40
CorruptRAG	5.50	20.40	50.50	53.20	71.00	80.50	30.00	44.44	5.50
CamoDocs	75.20	59.20	53.10	76.10	71.20	61.80	29.10	60.81	29.10
CamoDocs + Query	7.80	59.70	57.60	76.10	72.60	71.00	10.40	50.74	7.80

Mixtral-8x7B

Attack	Query Detection	Divide-and-Vote	RobustRAG	Isolation Forest	LLM Filter	Rerank	TrustRAG	Avg.	Min.
PoisonedRAG	8.90	59.00	47.30	64.50	63.50	66.40	8.40	45.43	8.40
PIA	7.60	13.70	38.70	46.50	31.50	62.20	9.70	29.99	7.60
CorruptRAG	7.60	16.90	50.50	50.60	71.60	74.30	28.00	42.79	7.60
CamoDocs	78.00	66.40	53.00	76.10	71.00	66.40	27.10	62.57	27.10
CamoDocs + Query	9.30	66.60	50.10	77.40	73.10	76.60	10.10	51.89	9.30

Proprietary victims

CamoDocs remains effective against closed-source victim LLMs on HotpotQA. Bold marks the best value in each column; red-shaded rows are ours.

GPT-5.4-mini

Attack	Query Detection	Divide-and-Vote	RobustRAG	Isolation Forest	LLM Filter	Rerank	TrustRAG	Avg.	Min.
PoisonedRAG	9.20	60.40	52.40	62.20	62.80	61.30	5.60	44.84	5.60
PIA	6.30	14.50	24.70	62.40	38.30	71.40	14.60	33.17	6.30
CorruptRAG	5.90	15.20	31.80	56.40	75.20	82.40	19.40	40.90	5.90
CamoDocs	75.50	69.40	61.30	75.70	70.00	56.80	23.90	61.80	23.90
CamoDocs + Query	9.90	69.00	60.60	74.80	70.70	65.10	7.80	51.13	7.80

Claude-Haiku-4.5

Attack	Query Detection	Divide-and-Vote	RobustRAG	Isolation Forest	LLM Filter	Rerank	TrustRAG	Avg.	Min.
PoisonedRAG	1.90	56.50	47.30	61.20	65.00	62.50	3.70	42.59	1.90
PIA	1.60	15.90	52.30	17.70	21.40	14.30	3.90	18.16	1.60
CorruptRAG	2.00	25.90	61.50	29.20	55.00	48.80	3.50	32.27	2.00
CamoDocs	72.20	63.70	56.20	72.20	67.70	45.30	8.30	55.09	8.30
CamoDocs + Query	1.60	65.50	61.10	73.60	69.50	57.00	4.00	47.47	1.60

Additional embedding visualizations

t-SNE across datasets and retrievers — Additional t-SNE visualization of the query, benign documents, and adversarial documents produced by each method.

Citation

@misc{jung2026camodocs,
      title={CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents},
      author={Jaewon Jung and Haizhong Zheng and Hongsun Jang and Jaeyong Song and Beidi Chen and Jinho Lee},
      year={2026},
      eprint={2608.28389},
      archivePrefix={arXiv},
      primaryClass={cs.CR},
      url={https://arxiv.org/abs/2608.28389},
}