[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83738-en":3,"doc-seo-83738-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83738,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAG","We release a benchmark and failure-mode-aware evaluation framework for grounded question answering under coordinated retrieval poisoning. The framework partitions reader outputs into four mutually exclusive categories—gold, hijack, abstention, and drift—using instance-level paired clean-to-poison transition matrices and a Forced Exposure protocol to separate reader-side conflict resolution from retrieval variance. We propose polymorphic sybil poisoning, coordinated diverse passages targeting an attacker-chosen answer while evading lexical near-duplicate filters that fully detect monomorphic baselines.","A Failure-Mode Benchmark for Polymorphic Sybil  \nPoisoning in RAG  \narXiv :2607 .03739v 1 [ cs .CR] 4 Jul 2026  \nDonghyun Lee  \nDepartment of Computer Engineering Dongguk University Seoul, Republic of Korea [donghyun0215@dgu.ac.kr](donghyun0215@dgu.ac.kr)  \nJuntae Kim∗  \nDepartment of Computer Engineering Dongguk University Seoul, Republic of Korea [jkim@dongguk.edu](jkim@dongguk.edu)  \nAbstract  \nWe release a benchmark and failure-mode-aware evaluation framework for grounded QA under coordinated retrieval poisoning. The framework partitions reader outputs into four mutually exclusive categories (gold, hijack, abstention, drift), with instance-level paired clean-to-poison transition matrices and a Forced Exposure protocol isolating reader-side conflict resolution from retrieval variance.  \nWe introduce polymorphic sybil poisoning, a coordinated attack class in which Slexically diverse passages jointly support an attacker-chosen target while evading lexical near-duplicate filters that fully detect monomorphic baselines (capturing the residual 14.2% with E5 cosine raises false-positive rate 9× on legitimate same-topic pairs) . A monomorphic–polymorphic ablation under Forced Exposure isolates the diversity dimension and reveals a +18.8pp hijack amplification (95% paired bootstrap CI [+15 .4 , +22 .4], B=5,000): monomorphic copies register only 4.0% as hijack while polymorphic surface diversity recovers 22.8%—a 5.7 × amplification of the ASR-visible attack channel. ASR alone treats every non-target output identically; under attack, abstention and drift together hold 47–66% of output mass, unmonitored by ASR+ACC, and two readers at nearly identical ASR (within 0.2pp) differ by 16.5pp on abstention and 17.2pp on drift—failure profiles invisible to ASR. We release the frozen benchmark (3,145 questions, 2,982 retained sybil groups; S=6 chosen to dominate top-10 retrieval slots, §6), the official four-way evaluator, paired-transition utilities, and the Forced Exposure harness across five readers (7B–120B), two retrievers, and two cross-validation datasets (TriviaQA, 2Wiki), under CC BY-SA 4.0 (data) and MIT (software); release information in §9 .  \n1 Introduction  \nRetrieval-augmented generation (RAG) systems ground their answers in externally retrieved evidence, making the retrieval corpus a direct attack surface [Zou et al., 2025, Chaudhari et al., 2024, Xue et al., 2024] . Existing multi-passage attacks [Zou et al., 2025] generate adversarial texts without an explicit lexical-diversity constraint; the resulting passages exhibit incidental similarity from shared retrievalcondition components and remain susceptible to near-duplicate corpus hygiene. We contrast the polymorphic regime against a monomorphic baseline (lexically near-identical, mean Token Jaccard ≈ 1.00) constructed here as the worst-case lexical-similarity limit (§3.3) .  \nWe introduce polymorphic sybil poisoning (Figure 1): S passages that jointly support an attackerchosen target answer, maintain low pairwise token overlap (τlex =0 .8 as a generation-time soft  \nconstraint; achieved mean 0.32, max 0.60; §3), and pass a verifier-LLM quality gate. The released ∗ Corresponding author.  \nPreprint.  \nFigure 1: Polymorphic sybil poisoning vs. monomorphic worst-case baseline. Both inject S=6 passages supporting an attacker-chosen target t  g. Sybil text shown is stylized; full passages are ∼ 100-word natural-language narratives in the released manifest (§4, §A.6) . Monomorphic (mean Token Jaccard ≈ 1.00) is constructed as the worst-case lexical-similarity limit and is fully detected by a token-overlap filter at threshold ≥ 0.60. Polymorphic enforces τlex =0 .8 during generation (achieved mean 0.32, max 0.60) and evades the same filter at 0%(embedding-filter trade-off: §3.3) . Existing multi-passage attacks [Zou et al., 2025] fall in the intermediate regime. Reader outputs redistribute across four categories (gold/hijack/abstention/drift); abstention and drift together account f","cbCaiaKDcAwwJSBS","https://ap.wps.com/l/cbCaiaKDcAwwJSBS","pdf",507023,3,1,16,"English","en",105,"# Abstract\n# Introduction\n# Related Work\n## Retrieval poisoning attacks","[{\"question\":\"What problem does the paper address in RAG systems?\",\"answer\":\"The paper addresses retrieval poisoning in RAG, where an attacker manipulates the retrieved evidence so readers produce attacker-chosen outputs.\"},{\"question\":\"How does the proposed evaluation framework classify reader outputs?\",\"answer\":\"It partitions outputs into four mutually exclusive categories: gold, hijack, abstention, and drift, supported by paired clean-to-poison transition matrices.\"},{\"question\":\"What is polymorphic sybil poisoning and how is it different from monomorphic poisoning?\",\"answer\":\"Polymorphic sybil poisoning coordinates multiple lexically diverse passages to support a chosen target while evading lexical near-duplicate filters. Monomorphic poisoning uses near-identical passages and is fully detected by a token-overlap filter.\"}]",1784190121,40,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"a-failure-mode-benchmark-for-polymorphic-sybil-poisoning-in-rag","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,50],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":20},"https://docshare.wps.com/document/research-report/",{"item":51,"name":13,"@type":43,"position":52},"https://docshare.wps.com/document/a-failure-mode-benchmark-for-polymorphic-sybil-poisoning-in-rag/83738/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the paper address in RAG systems?","Question",{"text":75,"@type":76},"The paper addresses retrieval poisoning in RAG, where an attacker manipulates the retrieved evidence so readers produce attacker-chosen outputs.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the proposed evaluation framework classify reader outputs?",{"text":80,"@type":76},"It partitions outputs into four mutually exclusive categories: gold, hijack, abstention, and drift, supported by paired clean-to-poison transition matrices.",{"name":82,"@type":73,"acceptedAnswer":83},"What is polymorphic sybil poisoning and how is it different from monomorphic poisoning?",{"text":84,"@type":76},"Polymorphic sybil poisoning coordinates multiple lexically diverse passages to support a chosen target while evading lexical near-duplicate filters. Monomorphic poisoning uses near-identical passages and is fully detected by a token-overlap filter.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,119,122,127,130,134],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":29,"slug":118},7,"Healthcare","healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":46,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":46,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":46,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":46,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]