RAG-NAROK turns RAG’s source transparency into an attack surface
RAG-NAROK shows how attackers could steer a retrieval-augmented generation system by targeting the sources it actually retrieves, not by injecting a fixed poisoned document. The framework first identifies those legitimate sources, then creates “Anchor-Specific Refutation” documents that name and undermine them while exploiting recency and authority biases. In experiments, it significantly outperformed static poisoning baselines across diverse domains.