Retrieval Corruption: The Geometry of Poisoning a Neighborhood to Dominate a Query

A retrieval-augmented generation pipeline answers questions by embedding the query, pulling the most similar documents from a vector store, and feeding them to the model as context. The unstated assumption is that the retrieved documents are trustworthy — but if an attacker can add even one document to the corpus, they can choose where that document lands in embedding space. By optimizing the document so its embedding sits closest to a target query, the attacker guarantees it is retrieved, and whatever content it carries enters the model's context. This is retrieval corruption: not breaking the search, but placing a chosen document exactly where the search will find it. This article develops the geometry, shows how a poison document is crafted, connects it to injection, and pairs each step with the provenance-based defenses that contain it.

The geometry of domination

Top-k retrieval returns the k stored vectors most similar to the query vector, so whichever document embeds closest to a target query is guaranteed to appear in that query's results. An attacker who controls a document's content controls its embedding, and therefore its position in the space. The goal is simple to state: make the poison document's embedding as close as possible to the target query's embedding, so it ranks at or near the top for that query.

This turns retrieval into an optimization the attacker can solve. Given a target query embedding, the attacker searches over document text for a document whose embedding maximizes similarity to that target — subject to the document also carrying the malicious payload they want delivered. Because the embedding function is available (it is the same public or purchasable model the pipeline uses), the attacker can iterate: adjust the text, re-embed, check the similarity, and repeat until the document dominates the neighborhood.

For the defender, the geometry names the requirement precisely: the attack needs the ability to insert a document into the corpus. If corpus writes are controlled and authenticated, the attacker cannot place the poison; the whole attack rests on an insertion capability that write access control governs.

Crafting the poison document

The craft is a guided search over text. The attacker starts from the payload they want delivered — an instruction, a piece of misinformation, a link — and augments it with text engineered to pull the document's embedding toward the target query. They embed the candidate, measure its similarity to the target, and iterate: add or rewrite text that raises the similarity while preserving the payload, until the document reliably lands in the top results for the target query. The output is a single document that is both malicious and maximally retrievable for its target.

Two properties make this practical. First, the embedding function is available, so the attacker has a cheap oracle for how any candidate embeds — the same access that enables embedding inversion. Second, embeddings are semantic, so a document can be steered toward a query's neighborhood by including query-relevant terms and phrasing, which also makes the poison look topically legitimate. The result is a document that a human skimming the corpus might not flag as anomalous.

The pipeline — payload, optimize toward the target embedding, insert, dominate — exposes the defender's leverage points: deny the insertion (write control), detect the anomaly (embeddings clustered unnaturally tight around common queries), and refuse to trust retrieved content by provenance regardless of how it ranked.

From retrieval to injection

Retrieval corruption matters because of what happens after retrieval: the dominating document's content is placed into the model's context as trusted background, where it can act as an indirect prompt injection. If the payload is an instruction, the model may follow it; if it is misinformation, the model may repeat it as grounded fact; if it is a link or tool-triggering text, it may drive an action. The corpus-write capability has become an injection channel into every query whose neighborhood the poison dominates.

The trust-boundary view is the key. Retrieved documents cross from the untrusted corpus into the model's context, and if the system treats retrieved text as trusted — as most do implicitly — then the boundary is unguarded. The poison exploits exactly this: it is untrusted content that the retrieval step launders into trusted-looking context. The defense is to keep retrieved content on the untrusted side of the boundary, tagged with its provenance, and to prevent it from being interpreted as instructions.

This connects retrieval corruption to the broader indirect-injection problem while adding a specific mechanism: the attacker does not need to compromise a source the pipeline already reads; they only need to insert one optimally-placed document. Provenance and instruction-isolation defenses that treat all retrieved content as untrusted contain both.

Targeting a query, or a whole neighborhood

The attacker can target a single query or a whole class of them. Targeting one query optimizes the poison toward that exact embedding. Targeting a class — say every question about a topic — optimizes toward the centroid of that region of embedding space, so the poison dominates the entire neighborhood rather than one point. A neighborhood attack is more valuable because a single inserted document then corrupts many related queries, amplifying one write into broad influence.

Geometrically, a clean neighborhood has the topically-relevant documents nearest each query, and retrieval surfaces genuine sources. A poisoned neighborhood has the attacker's document nearest the centroid, so it is surfaced for the whole class, displacing or outranking legitimate results. The difference is not visible in the query or the ranking mechanics — the search worked correctly — only in the provenance and content of what came back.

This is why ranking-based trust fails: the poison is retrieved because it is genuinely closest, not because of a search bug. The defense cannot be better ranking; it must be provenance (is this document from a trusted, authorized source) and content handling (is retrieved text allowed to instruct), which hold regardless of how the poison ranked.

Defenses that follow from the mechanism

The defenses layer around the insertion and the trust boundary. First and strongest, control corpus writes: authenticate and authorize every document added, and record its provenance, so an attacker cannot insert a poison and any inserted document is attributable. Second, treat retrieved content as untrusted: tag each retrieved span with its source and trust level, keep it out of the instruction channel, and prevent the model from executing directives found in retrieved text. Third, add retrieval-side hygiene: rerank results with an independent signal, apply a distance floor and diversity so one document cannot monopolize a neighborhood, and validate content against policy before it enters context.

These target the three stages: insertion (write control and provenance), retrieval (rerank, distance floor, diversity), and use (untrusted handling, instruction isolation). Write control is the structural defense that prevents the poison from existing; the others contain a poison that slipped in or came from a partially-trusted source. As with tenant isolation, the structural control is primary and the hygiene controls are the complement.

The measured posture is to lock down corpus writes with authenticated provenance, treat all retrieved content as untrusted and non-instructing, and add reranking and distance-floor hygiene, then verify by attempting to insert and surface a benign canary poison against your own pipeline.

Limits and honest framing

The attack has prerequisites and the defenses have costs. The attacker needs a write path into the corpus; a fully closed, authenticated corpus removes the insertion capability the whole attack depends on, which is why write control is decisive where it is feasible. But many pipelines ingest from partially-trusted or open sources — user uploads, crawled pages, shared drives — where a poison can enter legitimately, and there write control alone is insufficient and the trust-boundary and hygiene defenses carry the load.

On the defense side, reranking and distance floors reduce a single poison's dominance but can also degrade legitimate retrieval, and provenance tagging requires the pipeline to carry source metadata end to end, which is engineering the system must be built for. Treating retrieved content as non-instructing is the most robust and lowest-cost defense but requires discipline the naive pipeline lacks, since the appeal of retrieval-augmented generation is precisely putting retrieved text into the prompt.

Held honestly, the contribution is a reframing: retrieval returns untrusted content that an attacker can place exactly where the search will find it, so trust must come from provenance and content handling, not from rank or the search working correctly. Control writes, tag provenance, treat retrieved text as untrusted, and add hygiene — that is defensible retrieval-augmented design.

Practitioner Toolkit

Copy-paste, strictly defensive artifacts you can use today. Nothing here attacks a real system.

# DEFENSIVE / MOCK ONLY — benign canary, no malicious payload
function test_retrieval_defense(pipeline, target_query):
    canary = make_benign_canary(marker='CANARY-NEUTRAL')   # no real instruction
    canary = optimize_toward(canary, embed(target_query))  # make it dominate
    pipeline.corpus.insert(canary, principal='test')       # authenticated write
    ctx = pipeline.retrieve(target_query)
    checks = {
        'provenance_present': all(span.source for span in ctx),
        'marked_untrusted': all(span.trust == 'untrusted' for span in ctx),
        'instruction_ignored': not pipeline.followed(canary.instruction_field),
    }
    return DefenseReport(checks, note='all true => corruption contained')

Glossary

Retrieval corruption

Inserting a document crafted to sit nearest a target query so it dominates retrieval results.

Poison document

A malicious document optimized to be retrieved for a target query or neighborhood while carrying a payload.

Neighborhood attack

Optimizing a poison toward a region's centroid so it dominates a whole class of related queries.

Provenance tag

Metadata recording a retrieved span's source and trust level, carried through the pipeline.

Instruction isolation

Preventing retrieved content from being interpreted or executed as instructions by the model.

Distance floor

A retrieval constraint and diversity measure that stops one document from monopolizing a neighborhood.

Write access control

Authenticating and authorizing corpus writes so poison documents cannot be inserted.

References

1. OWASP Top 10 for LLM Applications: LLM08 Vector and Embedding Weaknesses
2. Morris et al., Text Embeddings Reveal (Almost) as Much as Text (arXiv 2310.06816)
3. Song & Raghunathan, Information Leakage in Embedding Models (ACM CCS 2020)
4. NIST AI 100-2 e2023 — Adversarial Machine Learning: A Taxonomy and Terminology