Paper deep dive

Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models

Yuyang Gong, Zhuo Chen, Miaokun Chen, Fengchang Yu, Wei Lu, Xiaofeng Wang, Xiaozhong Liu, Jiawei Liu

Year: 2025Venue: arXiv preprintArea: Adversarial RobustnessType: EmpiricalEmbeddings: 98

Models: Llama-3.1-8B, Qwen-2.5-7B

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%

Last extracted: 3/12/2026, 6:16:42 PM

Summary

Topic-FlipRAG is a two-stage, multi-granularity adversarial attack pipeline designed to manipulate the stance polarity of Retrieval-Augmented Generation (RAG) systems. By leveraging LLM reasoning for semantic-level document modification and neural ranking model gradients for trigger generation, the attack effectively shifts model outputs on controversial topics while remaining difficult to detect with current mitigation strategies.

Entities (4)

LLM · technology · 100%RAG · system-architecture · 100%Topic-FlipRAG · attack-method · 100%Neural Ranking Model · component · 95%

Relation Signals (3)

Topic-FlipRAG → targets → RAG

confidence 100% · In this paper, we address a more practical scenario: topic-oriented adversarial opinion manipulation attacks on RAG models

Topic-FlipRAG → uses → Neural Ranking Model

confidence 95% · Leveraging an open-sourced Neural Ranking Model (NRM), we generate a concise adversarial trigger

Topic-FlipRAG → utilizes → LLM

confidence 95% · This approach combines traditional adversarial ranking attack techniques and leverages the extensive internal relevant knowledge and reasoning capabilities of LLMs

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Retrieval-Augmented Generation (RAG) systems based on Large Language Models (LLMs) have become essential for tasks such as question answering and content generation. However, their increasing impact on public opinion and information dissemination has made them a critical focus for security research due to inherent vulnerabilities. Previous studies have predominantly addressed attacks targeting factual or single-query manipulations. In this paper, we address a more practical scenario: topic-oriented adversarial opinion manipulation attacks on RAG models, where LLMs are required to reason and synthesize multiple perspectives, rendering them particularly susceptible to systematic knowledge poisoning. Specifically, we propose Topic-FlipRAG, a two-stage manipulation attack pipeline that strategically crafts adversarial perturbations to influence opinions across related queries. This approach combines traditional adversarial ranking attack techniques and leverages the extensive internal relevant knowledge and reasoning capabilities of LLMs to execute semantic-level perturbations. Experiments show that the proposed attacks effectively shift the opinion of the model's outputs on specific topics, significantly impacting user information perception. Current mitigation methods cannot effectively defend against such attacks, highlighting the necessity for enhanced safeguards for RAG systems, and offering crucial insights for LLM security research.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

97,671 characters extracted from source content.

Expand or collapse full text

Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models Yuyang Gong 1∗ , Zhuo Chen 1 , Jiawei Liu 1† , Miaokun Chen 1 , Fengchang Yu 1 , Wei Lu 1 , XiaoFeng Wang 2 , Xiaozhong Liu 3 1 Wuhan University, 2 Nanyang Technological University, 3 Worcester Polytechnic Institute Abstract Retrieval-Augmented Generation (RAG) systems based on Large Language Models (LLMs) have become essential for tasks such as question answering and content generation. However, their increasing impact on public opinion and in- formation dissemination has made them a critical focus for security research due to inherent vulnerabilities. Previous studies have predominantly addressed attacks targeting fac- tual or single-query manipulations. In this paper, we address a more practical scenario: topic-oriented adversarial opin- ion manipulation attacks on RAG models, where LLMs are required to reason and synthesize multiple perspectives, ren- dering them particularly susceptible to systematic knowledge poisoning. Specifically, we propose Topic-FlipRAG, a two- stage manipulation attack pipeline that strategically crafts adversarial perturbations to influence opinions across related queries. This approach combines traditional adversarial rank- ing attack techniques and leverages the extensive internal relevant knowledge and reasoning capabilities of LLMs to ex- ecute semantic-level perturbations. Experiments show that the proposed attacks effectively shift the opinion of the model’s outputs on specific topics, significantly impacting users’ infor- mation perception. Current mitigation methods cannot effec- tively defend against such attacks, highlighting the necessity for enhanced safeguards for RAG systems, and offering cru- cial insights for LLM security research. 1 Introduction Retrieval-Augmented Generation (RAG) systems, built on large language models (LLMs), have advanced significantly and been widely applied in tasks like question answering and content generation [13, 49]. These systems integrate re- trieval mechanisms with generative models, accessing diverse sources, e.g., Wikipedia, Reddit, and news articles, to deliver updated knowledge. While research has focused on RAG ∗ Email: 2498002636gyy@gmail.com † Corresponding author. Email: laujames2017@whu.edu.cn Adversarial Trigger Opinion Polarity Pro Con Retriever LLM Context Retriever LLM Context Black-box RAG Topic Queries Polarity Manipulation � 1 ,� 2 ...,� � Topic Queries � 1 � 2 � � Topic Queries ... Figure 1: A concise overview of topic-oriented adversarial opinion manipulation attacks on RAG systems. frameworks [1, 37, 45], the majority of studies emphasize per- formance and generalization. Consequently, security aspects have received comparatively little attention. A defining feature of RAG systems is the vast scale of their referenced corpora or knowledge bases. However, these docu- ments might originate from sources beyond service providers’ control and may resist complete content purification. This creates new security risks for RAG-supported LLMs: adver- saries can inject meticulously crafted malicious content [4] into retrieval collections, ensuring its prioritized retrieval to influence LLM outputs. The inherent vulnerabilities of RAG models common to neural architectures, particularly their persistent impact on public opinion and information dissem- ination [6, 7, 51], have gradually drawn significant attention from the AI safety research community [46, 51, 52]. Inves- tigating these vulnerabilities is critical for advancing RAG security and ensuring system robustness and credibility. Early adversarial attacks on RAG systems primarily fo- cused on jailbreak techniques and query-specific perturba- tions [6, 51]. These methods tamper with knowledge bases to manipulate retrieval rankings, enabling LLMs to provide answers defined by attackers for specific query-level, such as PoisonedRAG [52], revealing critical vulnerabilities in ap- plications like cybersecurity and healthcare. However, these arXiv:2502.01386v3 [cs.CL] 29 Dec 2025 attacks often lack practicality as they concentrate on isolated factual queries. Such attacks can often be countered through mitigation strategies such as reranking and filtering [10, 28]. In contrast, thematic or topic-level attacks involve manipu- lating the overall perspective or stance of model outputs on broader queries, as shown in Figure 1. This form of manipu- lation is more practical and difficult to mitigate. Additionally, previous works overlook controversial topics, where limited user understanding may increase susceptibility to opinion manipulation. This paper addresses this critical gap by concentrating on the nuanced manipulation of opinions through adversarial attacks targeted at topics within RAG models, which presents a novel and urgent challenge given the increasing complex- ity and reliance on these systems. In line with settings from previous data poisoning findings [4, 52], we consider a sce- nario where the attacker could inject a few carefully crafted poisoned texts into the knowledge base. For example, if the knowledge base includes texts sourced from Wikipedia, the adversary might inject poisoned content by maliciously edit- ing Wikipedia entries. Besides, we focus on a more practical and challenging black-box scenario, where no model informa- tion is disclosed, except that the attackers can query the target RAG and obtain responses, which contains the corresponding candidate referential documents [6]. In this paper, we propose Topic-FlipRAG, which is a two- stage multi-granularity attack method designed to manipu- lating the stance polarity of RAGs with camouflaged modi- fication of target documents. Specifically, in the first stage, we perform a stealthy adversarial modifications on target documents. This is achieved by incorporating the extensive internal general semantic knowledge in LLMs with its anal- ysis and reasoning ability. In the second stage, inspired by adversarial semantic collision [39], we utilize gradients from an open-sourced neural ranking model (NRM) to generate topic-specific adversarial triggers. Our experiments show Topic-FlipRAG achieves 0.5 aver- age stance variation (ASV) across four domains, significantly outperforming other baselines. It demonstrates such adversar- ial attacks can effectively manipulate RAG models to produce outputs aligned with specific topical stances, thus influencing how information is presented and perceived. Based on that, we also conduct the user experiments, which reveal a signifi- cant impact on users’ opinion polarities toward controversial topics, with polarity shifts exceeding 16% after interacting with poisoned RAG systems. Futhermore, we explore several potential mitigation strategies, including perplexity-based de- tection, random masking, paraphrasing and reranking. Our re- sults show these mitigations are inadequate against adversarial opinion manipulation attack, especially for Topic-FlipRAG, underscoring the necessity for novel mitigation strategies. Our major contributions are as follows: (1) We explore a novel and practical security scenario, Topic-oriented RAG Opinion Manipulation, which presents a broader and deeper threat to real-world users by enabling opinion manipulation across multiple topic-related queries. (2) We propose Topic-FlipRAG, a knowledge-guided and multi-granularity black-box attack method tailored for topic- level opinion manipulation in RAG systems. (3) Through extensive experiments, we demonstrate that Topic-FlipRAG significantly outperforms baseline methods across all evaluation metrics. Moreover, user studies reveal its substantial practical impact, highlighting its potential to manipulate user opinions. (4) We analyze the effectiveness of several existing defense mechanisms and demonstrate their inadequacy in mitigating attacks by Topic-FlipRAG. These findings highlight the ur- gent need for more robust and adaptive defense strategies. 2 Background and Related Work 2.1 Retrieval Augmented Generation (RAG) RAG models enhance their responses by accessing and incorporating external knowledge from large-scale databases or corpora during the generation process [22, 27, 37]. By lever- aging external data sources, RAG can provide more accurate and comprehensive answers, especially for queries requiring up-to-date information or specialized knowledge that may not be well-represented in the model’s training data [38]. More- over, it can scale more effectively and flexibly by updating the retrieval corpus without necessitating extensive retraining of the generative component [13, 43]. The workflow of a RAG systems is generally divided into two sequential phases: retrieval and generation. In the re- trieval phase, upon the submission of a user queryq, the RAG system retrieveskrelevant documents from the corpusDwith the highest embedding similarities to the queryq. Specifi- cally, for each documentd∈ D, the relevance score with the queryqis computed asR(q, d). In this paper, we adopt a more practical and widely used framework in LangChain that the retrieval phase is incorporated with historical-aware query rewriting and intention reasoning. In the generation phase, Given a rewritten queryq ′ , a set of top-k retrieved documents D k , and access to the LLM, one can query the LLM withq ′ with the top-k retrieved documentsD k , the LLM generates an answer for original query q by leveraging D k as context. 2.2 Attacks to Retriever Retriever vulnerabilities in RAG systems pose significant security risks due to their neural ranking dependencies [15]. Adversarial attacks manipulate document rankings through semantic perturbations to promote target documents in query- specific results [26, 42], undermining RAG’s core assumption of reliable high-ranked contexts. Current attacks are character- ized along two axes: (1) Knowledge accessibility: White-box (full model access) vs. black-box (query-only) approaches. (2) Perturbation granularity: Word-level [28, 35, 42], Phrase- level [6, 26, 39], Sentence-level [5], and Hybrid [29].These neural semantic attacks parallel black-hat SEO tactics [17] but introduce novel challenges. Successful attacks propagate adversarial content to generators, enabling misinformation injection while evading traditional safeguards [6, 51], necessi- tating integrated security frameworks for RAG systems. 2.3 Attacks to LLMs Existing attacks on LLMs include jailbreak attacks [11, 23, 25, 41], backdoor attacks [3, 19, 31], prompt injection [16, 30, 33], and poisoning attacks [6, 9, 36, 48, 51, 52]. Poi- soning attacks uniquely threaten RAG systems by injecting adversarial content into retrieval corpora to manipulate out- puts. Current RAG poisoning studies focus on closed-domain factoid QA pairs (e.g., "CEO of OpenAI") [9, 36, 48, 51, 52], overlooking the multi-query nature of real-world topic ex- ploration [28, 46], e.g., "smartwatch battery life" and "health tracking accuracy" under the "wearable tech" theme. This motivates our focus on practical topic-level universal pertur- bations mirroring universal adversarial examples. Furthermore, existing defenses based on fact-checking are insufficient for opinion-based queries, such as "Should ge- netic testing be regulated?", which require nuanced reasoning rather than simple factual recall. Building on the insights from FlippedRAG [6], we tackle this significant gap by ex- amining the adversarial manipulation of controversial topics. In such cases, LLMs are required to reason and synthesize multiple perspectives, making them particularly vulnerable to systematic knowledge poisoning. 3 Threat Model Given a set of topic-queriesQ =q 1 , q 2 ,..., q |Q| , a RAG corpusD, and a desired target polarityS t (e.g., Pro or Con), The adversary’s objective is to steer the RAG system’s overall stance across the entire set of queries toward stanceS t . Let doc tar be the target document the attacker aims to promote. The black-box retrieval modelRMassigns a relevance score R(q, d)to each documentd∈ Dand returns the top-kdocu- ments asRM k (q) =d 1 , d 2 ,..., d k . The LLM then generates an answerLLM(q, RM k (q)), and the extracted opinion from this response is S o = S(LLM(q, RM k (q))). 3.1 Objective of the Adversary The adversary seeks to modify the target documentdoc tar through a series of subtle perturbationsp adv , while preserving its original semantics and fluency, thereby transforming the corpusDintoD ′ = D(doc; doc tar ⊕ p adv ). By increasing the retrieval model’s relevance scoreR(q, doc tar ⊕ p adv )for each queryq∈ Q, the promoted document is more likely to appear among the top-k results RM k (q). As a result, when the LLM generates answers conditioned on the query and the top-kretrieval results(q, RM k (q)), the adversarially augmented document will influence the opinion S(LLM(q, RM k (q)))towards the target polarityS t . Crucially, the objective extends beyond a single query: the adversary aims to ensure that, on average, the opinions produced by the LLM across the entire query setQalign withS t . In other words, the attacker seeks: max p adv 1 |Q| ∑ q∈Q I S(LLM(q, RM k (q))) = S t whereI(·)is an indicator function that returns1if the generated stance matchesS t and0otherwise. By optimizing for this criterion, the adversary ensures that the aggregated stance across all topic queries shifts significantly toward the desired polarity. 3.2 Capabilities of the Adversary In the black-box setting, the adversary is restricted to mod- ifying a limited number of documents within the corpusD. Obtaining detailed information about the specific retrieval model employed by the target RAG system is typically im- practical in real-world scenarios. The adversary has no access to the internal parameters or architecture of either the retrieval model or the large language model (LLM), and cannot alter the LLM’s prompt templates. 4 Methodology 4.1 Overview In this study, we introduce Topic-FlipRAG, a two-stage, multi-granularity, topic-oriented attack pipeline designed to manipulate the stance polarity of RAG output, as illustrated in Figure 2. The pipeline proceeds as follows: Stage 1: Knowledge-Guided Attack. In the initial stage, we leverage the extensive internal knowledge and reasoning capabilities of LLMs to perform adversarial edits on the tar- get document at a general semantic level. We identify and extract essential topic-related information nodes from the queries, then guide the LLM to integrate these nodes into doc tar through a multi-granular editing strategy across three semantic dimensions. Simultaneously, rigorous polarity con- trol is employed to preserve the original stance of the doc- ument, ensuring precise manipulation. A dynamic reward function guides each modification step, embedding critical elements and relevant information while minimizing disrup- tion to the document’s original semantics. This process lays a solid foundation for the subsequent stage. Stage 2: Adversarial Trigger Generation. In the second stage, we enhance the similarity of the adversarially edited documentdoc know , which is generated in Stage 1. Leveraging Intent Topic User � 1 � 2 � � ...... Potential Related Queries User Query Benign Doc Collections Poisoned Doc Collections ... ... Top-k Doc Group Stance: Support Group Stance: Oppose Target Topic LLM � 1 � 2 � � ... Imitated Topic-Queries GMOs Climate impact Food security Multi-Granular Editing Polarity Control Original Doc ✅ � ✅ ✅ : satisfy Target Polarity � : out of Target Polarity ×� F i l t e r Poisoned Doc Gradient-Guide Open-sourced Retriever Semantic Sim & Edit Distance Do GMOs contribute to climate change? How do GMOs impact biodiversity? Do GMOs provide health benefits? Should Genetically Modified Organisms (GMOs) Be Grown？ According to ... (Omit content)” The group says that resistance to antibiotics, ... (Omit content) in the United States, ... (Omit content) humans to determine whether GMO foods are safe. Agricultural benefits Reward Function growing farming facilitates According to ... (Omit content) GMOs can exacerbate ...agricultural practices and suppressed immune function ...(Omit content) in the United States, raising concerns about..safety of GMO foods Adversary Trigger Retriever LLM Original Responses Adversary Responses Doc-Specifc Node list Attacker Scenario Topic-FlipRAG Pipeline ...... Phrase Insertion Sentential Rewrites Lexical Substitution s Target Polarity: CON Figure 2: An overview of our proposed Topic-Orientated Adversarial Opinion Manipulation Attack method for RAG systems. an open-sourced Neural Ranking Model (NRM), we gener- ate a concise adversarial trigger specifically crafted to max- imize the alignment betweendoc know and the topic queries. This trigger is then fused withdoc know and injected into the RAG system’s database as a poisoned document, substantially increasing its likelihood of being retrieved. Consequently, the generated output shifts toward the target stance polarity, thereby achieving the objective of topic-oriented adversarial manipulation. 4.2 Knowledge-Guided Attack In this section, we propose a three-phase framework, termed the knowledge-guided attack (know-attack), to system- atically modify a target documentdoc tar to enhance its rele- vance to a given query set. The framework seeks to minimally modify the original document while effectively integrating topic-specific nodes, thereby maximally influencing the final RAG output. By operating across multiple levels of modi- fication, it ensures semantic coherence, adheres to minimal editing principles, and preserves a predefined stance, enabling precise and controlled manipulation of the target document. Problem Statement. Given a target documentdoc tar and a topic-related query setQ = q 1 , q 2 ,..., q |Q| , we seek a modified documentdoc know = doc tar ⊕P, wherePdenotes subtle perturbations, that increases its overall relevance to all queries while adhering to a target stance S t . max P 1 |Q| ∑ q∈Q Sim(q, doc know ) subject to: ∥P∥≤ ε,Sim(doc know , doc tar )≥ λ,S(doc know ) = S t . Here,∥P∥constrains the degree of textual alteration to ensure minimal editing, andSim(·)ensures sufficient semantic similarity between the original and modified documents.εand λare predefined parameters used to constrain the extent of modification. By incorporating these constraints, the resulting doc know not only aligns with the chosen stanceS t and achieves higher relevance for all queries in the query setQ, but also maintains the document’s intrinsic coherence and readability, increasing its likelihood of influencing the RAG system’s outputs while remaining undetectable. 4.2.1 Phase 1: Key Node Extraction and Selection Given a topic and its corresponding set of queriesQ = q 1 , q 2 ,..., q |Q| , we first leverage a LLM, e.g., GPT-4o-mini, to identify a set ofKkey information nodes that are most salient for maximizing relevance with respect to the entire query set. TheseKnodes form a candidate node listLencap- sulating crucial topical aspects. Next, we analyzedoc tar to determine which nodes fromL are underemphasized or entirely absent. The LLM generates a doc-specific node list by providing explicit reasoning for each missing or underemphasized node. This doc-specific node list guides subsequent adversarial editing, ensuring that modifi- cations focus on incorporating these critical nodes without introducing extraneous or tangential content. 4.2.2Phase 2: Multi-Granular Adversarial Editing and Polarity Control Inspired by [29] and adversarial strategies against black- box neural ranking models [26, 42], we adopt a multi- granularity editing approach that leverages the advanced lan- guage understanding capabilities of LLMs. The editing pro- cess operates on three levels: (1) lexical substitutions, re- placing individual words with synonyms or node-relevant terms while preserving the original semantics; (2) sentential rewrites, restructuring sentences and injecting minimal node- related content without altering the intended meaning; and (3) phrase insertions, strategically adding brief, contextually ap- propriate sentences containing node information to maintain narrative coherence and content integrity. During this adversarial editing process, we incorporate a module called Polarity Control to enforce a target stanceS t constraint, guiding the overall direction of the document. For instance, if the target polarity is set to CON (i.e., opposing a certain viewpoint), all modifications introduced by the model consistently reflect negative or critical perspectives. This mod- ule ensures that the integrated nodes and textual changes are aligned with the desired polarity, ultimately steering the RAG output toward the intended viewpoint. 4.2.3Phase 3: Iteration with Rewarding Function and Final Output Selection To adhere to the principle of minimal editing while ensur- ing effective document modification, we introduce an iterative framework guided by an augmentation factort. This factor dynamically controls the extent and frequency of adversarial modifications during each editing iteration. A largertencour- ages more extensive and aggressive edits, whereas a smaller tleads to a more conservative editing strategy. To mitigate fluctuations caused by the stochasticity of LLMs, we perform Irepeated sampling runs for each value oft. It ensures stable performance by averaging across multiple candidate modifi- cations. After each editing iteration,tis adaptively adjusted based on feedback from a filtering mechanism to maintain a balance between relevance and minimal editing. In each iterationn(n = 1,..., N), for a givent n , we generate Icandidate modified documentsdoc (n,i) m I i=1 . Each candidate document is evaluated against two critical metrics: Edit Distance (Edit Ratio):d edit doc m , doc tar measures the extent of modification compared to the original document. Semantic Similarity:d sem doc m , doc tar evaluates how well the modified document preserves the original semantics. To ensure minimal disruption, we define a strict edit ratio threshold ε and a semantic similarity threshold λ. A filtering indicator is then used to assess the validity of each candidate document based on these criteria: Filter doc m =      1, if (d edit doc m , doc tar ≤ ε) ∧ (d sem doc m , doc tar ≤ λ), 0, otherwise. The augmentation factortis dynamically updated based on the feedback from the filtering layer. To balance the trade-off between under-editing and over-editing, we define a partial edit threshold ρ = 0.75 ε and employ the update function: t n+1 =              t n − δ, if max i Filter doc (n,i) m = 0, t n + δ, if∃ (i s.t. Filter doc (n,i) m = 1) ∧ (d edit doc (n,i) m , doc tar < ρ), t n ,otherwise. Here,δ> 0controls the aggressiveness of the adjustments. If no candidate satisfies the filtering constraints,tis decreased to avoid excessive modifications. Conversely, if valid can- didates exist but fail to meet the partial edit thresholdρ,t is increased to promote more aggressive edits. Otherwise,t remains unchanged to preserve stability. AfterNiterations, the process produces a set ofMvalid candidate documents that satisfy the edit ratio and semantic similarity constraints. A final selection phase is then con- ducted to identify the optimal output. For each retained candi- datedoc m , we use a NRM to estimate its relevance for each queryq i ∈ Q, denoted asR q i , doc m . The average relevance score for each candidate is computed as: ̄ R doc m = 1 |Q| |Q| ∑ i=1 R q i , doc m . The final modified documentdoc know is selected by maxi- mizing the average relevance: doc know = arg max doc m ̄ R doc m . The iterative process, directed by the rewarding function and filtering mechanisms, ensures that the final outputdoc know incorporates topic-specific nodes with minimal yet effective modifications. By maintaining semantic coherence and ad- hering to predefined constraints, it enhances the relevance of doc know to the query set while aligning its stance with S t . 4.3Adversarial Gradient-Based Trigger Gen- eration Building on the know-attack introduced in Section 4.2, which integrates general semantic-level node information into the target documentdoc tar , we further aim to generate adver- sarial triggers targeting the retrieval model within the RAG system. Specifically, we append a stealthy adversarial trig- gerTto the previously constructeddoc know , resulting in the final adversarially augmented documentdoc adv . Inspired by adversarial semantic collision [26, 39], we deriveTthrough a gradient-based optimization process using a public neural ranking model 1 . By integratingdoc know withT, we align the document more closely with the query setQ, thereby increas- ing its likelihood of being retrieved. Once ranked among the top-K results, the strategically crafted content withindoc adv can effectively steer the LLM’s final output toward S t . 1 https://huggingface.co/nboost/pt-bert-base-uncased-msmarco 4.3.1 Problem Formulation Our goal, as described in Section 3.1, is to guide the RAG system toward consistently adopting the target polarityS t across the entire query setQ. However, optimizing this topic- level objective is non-trivial due to the absence of gradient signals from the LLM. To tackle this challenge, we introduce an intermediate ob- jective centered on document relevance. LetRM(q i , doc)de- note the relevance score assigned by the neural ranking model (NRM) for a query-document pair(q i , doc). For a crafted doc- umentdoc adv = [doc know , T], our interim optimization goal is to find a triggerTthat maximizes the average relevance score across all queries in Q: max T 1 |Q| |Q| ∑ i=1 RM (q i ,[doc know , T]). By enhancing the document’s relevance to eachq∈ Q, we increase the likelihood thatdoc adv appears among the top- kretrieved documents, thereby shaping the RAG system’s output polarity in favor of the target stance S t . 4.3.2 Gradient-Based Optimization We use a gradient-based search strategy to generate the triggerTthat optimizes the average relevance across the topic-related query set. The search proceeds in two steps: 1) we optimize a soft trigger in the continuous embedding space using gradients from the NRM, where the updates are performed using the Adam [21] optimizer; and 2) we apply beam search to discretize the soft representation into a valid token sequence. These two steps are repeated iteratively until the relevance objective converges. Through this process, we obtain a discrete trigger that maximizes document relevance over all topic queries. Gradient Optimization: During each optimization step, we compute and combine gradients for all queries inQ. In- spired by [26], we introduce a word enhancement mechanism that incorporates query-specific keywords and lexical distri- butions derived from the model’s vocabulary. This guided se- lection of candidate tokens captures semantic overlaps among multiple queries and enhances overall trigger relevance. Beam Search: During the beam search phase, we evaluate candidate triggers, along with doc-specific augmentation, to select those that maximize combined similarity scores across the entire query set. This selection process ensures that the chosen trigger consistently enhances the ranking impact of the target passage when combined with doc know . Doc-Specific Augmentation: At each iteration of gradient calculation and beam search, the intermediate soft representa- tion of the trigger is evaluated only in the context of its con- catenation with doc know and jointly across all queries. While this introduces additional computational overhead, it ensures tight contextual alignment with the target document, leading to more substantial gains in retrieval performance. 4.3.3 Final Output and RAG Opinion Influence After convergence, the adversarial triggerTis appended to doc know to form the final adversarial document: doc adv = [doc know , T]. Thisdoc adv is then injected into the RAG system’s cor- pusD ′ , effectively increasing its likelihood of being retrieved among the top-kdocuments for each queryq∈ Q. Conse- quently,doc adv frequently appears in retrieval results, leading the LLM to generate outputs that align with the target stance S t . This process effectively manipulates the overall stance of the RAG system’s output by ensuring that the augmented document is both prominently retrieved and influences the generated responses toward the target stance S t . 5 Experiments 5.1 Research Questions We propose three research questions to evaluate the effec- tiveness of our method in the topic-queries task, focusing on black-box NRM attacks and opinion manipulation to RAGs. RQ1: Can Topic-FlipRAG effectively boost the rankings of target documents across queries in the retriever within RAG? RQ2: To what extent does Topic-FlipRAG affect the an- swers generated by the target RAG systems? RQ3: Does topic-oriented opinion manipulation signifi- cantly impact users’ perceptions of controversial topics? 5.2 Datasets MSMARCO. We utilized the MS MARCO Passage Rank- ing dataset [32] to evaluate the effectiveness of our method in improving document ranking in challenging topic-queries tasks. Specifically, we examined whether our method could effectively boost the retrieval rankings of target documents across queries in the retriever within RAG. For topic-list construction, we applied K-means clustering to group similar queries, forming topics with related queries. To ensure robustness, we filtered topics based on intra-topic similarity, retaining only those with high semantic diversity and sufficient query count. This process resulted in 29 topics, each containing an average of 22.28 queries with a similarity score of approximately 0.5, thereby supporting a rigorous and diverse evaluation. PROCON. We conducted our opinion manipulation exper- iments using a curated dataset of controversial topics sourced from the PROCON.ORG website. The dataset spans over 80 topics across diverse domains such as society, health, gov- ernment, and education. Each topic is framed around two opposing stance labels PRO (support), CON (oppose), with accompanying passages that present arguments from both perspectives. To simulate real-world user interactions with a RAG sys- tem, we instructed GPT-4o to act as a proxy user and generate 40 candidate sub-queries for each topic. These sub-queries were crafted to reflect the diverse questions and concerns that users might pose when engaging with a specific con- troversial topic. To ensure semantic diversity, we applied a similarity-based filtering process, retaining only sub-queries with pairwise similarity scores below approximately 0.85. This step effectively removed redundancies while preserving a broad spectrum of perspectives. As a result, the final set of topic queries achieved an average similarity score of ap- proximately 0.7, balancing semantic relevance with diversity. More detailed information on the datasets refer to the dataset description in our github repository 2 . 5.3 Experiment Details The specific setting details for the Topic-queries RAG ma- nipulation experiment are as follows: (1) Black-box RAG. The black-box RAG process is de- noted asRAG black . The RAG framework is the Conver- sational RAG from LangChain for our experiments. The LLMs adopted in RAG are two widely adopted open-source instruction-tuned models: Meta-Llama-3.1-8B-Instruct 3 (re- ferred to as Llama3.1) and Qwen-2.5-7B-Instruct 4 (Qwen2.5). (2) Retrieval model. We benchmark three dominant dense retrievers, i.e., Contriever [12], DPR [20], and ANCE [44]. Following standard practice, we use dot product between the embedding vectors of a query/question and a candidate docu- ment as their similarity score R. (3) Opinion classification. We adopt Qwen2.5-Instruct-72B as the opinion classifier. We selected high-performing LLMs that are widely recognized and adopted in the open-source community, based on the current GPU resources. The detailed description is provided in Appendix A.1 (4) Hyper-parameter settings. During the knowledge- guided attack process, we set the maximum editing distance εto 0.2, the semantic similarity thresholdλto 0.85, and the number of iterationsNto 5. For adversarial trigger genera- tion, we use a beam size of 3, top-k ′ sampling withk ′ set to 10, a batch size of 32, a temperature of 1.0, a learning rate of 0.005, and a trigger sequence length of 10. In RAG black configuration, the number of retrieved documentsKis set to 3, and the LLM temperature is fixed at 1.0. (5) Target documents. For the PROCON dataset, we rank documents based on their relevance to each topic-query setQ and target stanceS t , then select the five least relevant docu- ments as poisoning targets. For MS MARCO, we first retrieve the top-1000 passages ranked by relevance per topic, then identify the passage with the lowest average rank across the corresponding queries. This selection strategy ensures that 2 https://github.com/LauJames/Topic-FlipRAG 3 https://huggingface.co/meta-llama/Llama-3.1-8B-Instruct 4 https://huggingface.co/Qwen/Qwen2.5-7B-Instruct evaluation is conducted under challenging conditions by fo- cusing on minimally relevant passages. (6) Environment. All the methods run on a server config- ured with Python 3.8 environment, four NVIDIA DGX A100 GPUs (80 GB each), and 1 TB of system memory. 5.4 Baseline Settings To evaluate the effectiveness of our proposed method, we compare it against adversarial attack baselines tailored for black-box, topic-oriented RAG scenarios, with an emphasis on minimal modifications to the original documents. We ex- clude BadRAG [46], a backdoor RAG attack limited to white- box scenarios, as well as topic-IR-attack [28], due to the lack of a complete implementation that prevents reliable reproduc- tion. For the baseline methods, we adapt them to meet the requirements of our task while preserving their core compo- nents. A brief overview of these baselines is provided below: PoisonedRAG. Zou et al. [52] propose an approach adapt- able to both black-box and white-box settings. For our task, we employ its black-box strategy by inserting a randomly chosen query from the topic-queries setQat the beginning of each document. PAT. This gradient-based adversarial retrieval attack [26] uses a pairwise loss function to generate triggers that meet the fluency and coherence constraints. We adapt PAT to produce triggersT pat for target documents within the topic-queries set, evaluating their effectiveness under black-box conditions. Collision. This method generates adversarial paragraphs (collisions) via gradient-based optimization to produce con- tent semantically aligned with the target query. In a topic- queries context, we create collisions for the entire topic- queries set and examine their transfer performance on the retriever within black-box RAG. These baseline methods provide benchmarks for comparing the efficacy of our approach in a black-box, topic-oriented RAG attack scenario. 5.5 Evaluation Metrics For RQ1, which focuses on ranking manipulation, we re- port the change in top-3 target opinion proportion (Top3 att − Top3 ori = top3-v), Ranking Attack Success Rate (RASR), Boost Rank (BRank), and the percentage of target documents appearing in the Top-50 and Top-500. These metrics jointly reflect the effectiveness of rank promotion across queries. top3-v. Computed by subtractingTop3 ori fromTop3 att , top3-v ranges from -1 to 1. A positive value signifies a suc- cessful increase of the target opinion in top-3 results, while a negative value indicates a detrimental effect. Ranking Attack Success Rate (RASR). RASR captures how frequently target documents are successfully boosted in each query’s ranking. Boost Rank (BRank). BRank is the average rank improve- ment for all target documents under each query. Table 1: White-box information retrieval (IR) attack perfor- mance (RASR, Top-50, and Top-500 are reported in %) on MS MARCO dataset. Bold indicates the best attack perfor- mance. MethodRASRB-rankTop-50Top-500 Collision93.19245.190.4640.56 PAT89.63208.060.3133.90 PoisonedRAG64.3973.522.9411.15 Topic-FlipRAG99.29521.3018.3579.49 Top-50, Top-500. These metrics represent the percentage of target documents that move into specific ranking thresholds in the MS MARCO Dataset after manipulation. Higher per- centages imply more effective promotion of target documents. For RQ2, we employ Average Stance Variation (ASV) to quantify the extent to which the opinion manipulation influ- ences LLM responses in a black-box RAG setting. To account for topic variability and inherent LLM diversity, we further introduce another evaluation metric Calibrated ASV (∆ASV). Average Stance Variation (ASV). ASV is the absolute difference between manipulated and original opinion scores (i.e., 0 = opposing, 1 = neutral, 2 = supporting). Higher values indicate stronger polarity shifts and manipulation impact. Calibrated ASV (∆ASV). To account for the inherent vari- ability of controversial topics and the instability of LLM, we measure the baseline ASV in a clean state, denoted as ASV clean (calculated without adversarial manipulation). The adjusted score is then defined as∆ASV = ASV− ASV clean . This adjustment ensures that∆ASV accurately captures the true impact of adversarial manipulation by removing the con- founding effects of natural stance variation. It quantify the extent to which the polarity of the RAG-system outputs is affected by the manipulation. A positive∆ASV indicates a manipulation-induced polarity shift, with larger values reflect- ing stronger effectiveness. 6 Experimental Results Analysis 6.1RQ1: Can Topic-FlipRAG effectively boost the rankings of target documents across- queries in the retriever within RAG? To explore RQ1, we first conducted white-box informa- tion retrieval (IR) manipulation experiments on MSMARCO and PROCON datasets. The results of these experiments are presented in Table 1 and Table 2, respectively. MSMARCO Dataset. The results demonstrate that Topic- FlipRAG significantly outperforms all baselines across all evaluation metrics, even under challenging conditions where the MSMARCO dataset is configured with reduced intra- topic query similarity to simulate more extreme scenarios. As shown in Table 1, it achieves a near-perfect RASR of 99.29%, well above Poisoned-RAG (64.39%), Collision (93.19%), and PAT (89.63%). It also records the highest B-rank (521.30) and strong top-ranked document coverage (18.35% in top-50%, 79.49% in top-500%), demonstrating its effectiveness in si- multaneously manipulating rankings across multiple queries. PROCON Dataset. On the PROCON dataset (Table 2), the results also show the superiority of Topic-FlipRAG. Under white-box settings, for both target stances (CON and PRO), Topic-FlipRAG achieves the highest RASR (0.79 for CON, 0.75 for PRO) and the largest top3-v (0.45 for CON and 0.37 for PRO, respectively). In contrast, Poisoned-RAG, which uses a simple query+ strategy, shows considerably lower RASR (0.40 for CON and 0.33 for PRO, respectively), demon- strating the limitations of its approach for topic-oriented at- tacks. While the gradient-based methods, Collision and PAT, perform comparably to or even better than Poisoned-RAG in opinion manipulation, they still fall short of Topic-FlipRAG. To further evaluate our method’s practical effectiveness, we conducted black-box IR manipulation experiments on the PROCON dataset using three widely adopted dense retrievers, e.g., Contriever, ANCE, DPR. Owing to the inherent robust- ness of these retrievers, performance declined for all attack methods compared to the white-box setting. Nevertheless, Topic-FlipRAG displays the most consistent performance, re- taining relatively high manipulation effectiveness across all models and metrics. For instance, under Contriever, Topic- FlipRAG achieves the highest RASR (0.52 for CON and 0.49 for PRO, respectively) and top3-v (0.26 for CON and 0.22 for PRO, respectively), significantly outperforming Poisoned- RAG, Collision, and PAT. A similar performance pattern is observed with ANCE and DPR, where Topic-FlipRAG con- sistently maintains a clear advantage. Topic-FlipRAG’s superior performance in transfer attack settings can be attributed to its integration of the LLM’s gen- eral semantic knowledge and NRM gradient guidance, along with a design specifically tailored for the topic-queries context. This combination enables the method to generate adversarial triggers that are both generalizable and contextually precise, allowing it to adapt effectively to varying retriever architec- tures without relying on the the parameters of the target IR model. In contrast, gradient-based methods like Collision and PAT depend heavily on gradient information from the tar- get model, leading to substantial performance degradation in transfer attack scenarios. For instance, Collision achieves a maximum RASR of only 0.21 on Contriever for both CON and PRO stances, while PAT performs even worse, with RASR values of 0.16 (CON) and 0.13 (PRO). Additionally, our findings reveal varying levels of vulner- ability among dense retrievers. Contriever appears the most susceptible (exhibiting higher RASR and top3-v scores for all attackers), whereas DPR is notably more resilient (e.g., RASR for Topic-FlipRAG falls to 0.42). These observations underscore the importance of careful retriever selection when designing RAG systems to mitigate adversarial risks. Table 2: White-box and Black-box IR attack results (%) on PROCON dataset. Bold indicates the best attack performance. SettingWhite-boxBlack-box Target IR model Target Stance BERTContrieverANCEDPR MethodRASRtop3-vRASRtop3-vRASRtop3-vRASRtop3-v Collision CON48.4423.2321.278.3818.7910.4116.875.97 PRO43.6420.8521.448.2415.977.7314.495.23 PAT CON37.8517.2316.407.1519.5112.3613.995.65 PRO31.9913.3513.074.3013.449.148.612.26 PoisonedRAG CON39.8718.6425.5211.9934.1014.9131.2514.13 PRO32.7514.0422.048.7125.379.8121.268.31 Topic-FlipRAG CON79.4244.7151.9025.5745.6920.1242.2718.83 PRO75.0137.0449.2021.5542.1220.5741.8416.41 Table 3: Topic-Oriented RAG attack results on PROCON dataset, including ASV on different domains (Health & Environment, Government & Politics, Education, and Society & Culture), average ASV, and ∆ ASV. Bold shows the best performances. MethodTarget Stance Contriever + Qwen2.5Contriever + Llama3.1 H&EG&PEDUS&Cavg. ASV ∆ ASVH&EG&PEDUS&Cavg. ASV ∆ASV Clean CON0.210.270.240.230.24–0.220.260.180.270.24– PRO0.210.260.240.240.24–0.230.270.210.270.25– Collision CON0.300.360.350.340.340.100.300.350.230.270.300.06 PRO0.270.400.300.280.320.080.290.370.240.280.310.06 PAT CON0.300.270.280.270.280.040.260.350.250.320.300.06 PRO0.290.250.310.330.290.050.280.300.300.300.290.04 PoisonedRAG CON0.300.350.260.380.330.090.340.390.310.460.380.14 PRO0.270.410.280.320.340.100.310.380.290.390.350.10 Topic-FlipRAG CON0.510.460.480.550.490.250.540.510.300.640.500.26 PRO0.430.550.420.510.490.250.440.580.410.440.480.24 6.2RQ2: To what extent does Topic-FlipRAG affect the answers generated by the target RAG systems? Table 3 shows the opinion manipulation results on RAG outputs, comparing two RAG systems: Contriever + Qwen2.5 and Contriever + Llama3.1. More results with other retrievers (ANCE and DPR) are reported in Table 11 (Appendix). To evaluate the manipulation effectiveness across differ- ent topic domains, the PROCON dataset was divided into four subsets: Health & Environment (H&E), Government & Politics (G&P), Education (EDU), and Society & Culture (S&C). Each reported avg-ASV reflects the average manipu- lated stance polarity (PRO or CON) of the RAG outputs across all domains, while avg-∆ASV represents the manipulation effect, computed by subtracting the clean-state avg-ASV clean from the manipulated avg-ASV. Both ASV and∆ASV range from 0 to 2, where higher values indicate stronger manipula- tion effects. The results demonstrate that Topic-FlipRAG achieves sig- nificantly better manipulation across all domains com- pared to baseline methods. Specifically, Topic-FlipRAG achieves an avg-ASV of 0.49 for Qwen2.5 and 0.48 for Llama3.1, outperforming all other methods. PoisonedRAG, the second most effective method, achieves avg-ASV values of 0.33 for Qwen2.5 and 0.35 for Llama3.1, while other base- lines such as Collision and PAT remain within the range of 0.28 to 0.31. In terms of manipulation effect, measured by avg-∆ASV, Topic-FlipRAG also achieves the highest values: 0.26 for Qwen2.5 and 0.24 for Llama3.1. Table 3 and the appendix results further reveal notable dif- ferences between LLMs and retrievers regarding susceptibil- ity to topic-oriented opinion manipulation. Overall, Llama3.1 exhibits higher avg-ASV and avg-∆ASV across all baseline methods compared to Qwen2.5, indicating that Llama3.1 is more vulnerable to adversarial documents promoted to the top-3 of the ranking. This suggests that Llama3.1 tends to gen- erate responses that are more aligned with adversarial stances in the context. Similarly, among retrievers, contriever-based RAG systems achieve higher avg-∆ASV values compared to ANCE and DPR, as detailed in the appendix, aligning with RQ1 findings that contriever produces superior ranking dis- tortion, particularly for top-3 results. The manipulation effectiveness of Topic-FlipRAG varies across topic domains. For instance, with Llama3.1, S&C ques- tions are most prone to manipulation towards an opposing stance (avg-ASV = 0.55), whereas EDU questions are resis- tant to manipulation (avg-ASV = 0.41). It is more difficult to manipulate supporting stances in H&E questions than op- posing ones. Both Qwen2.5 and Llama3.1 achieve higher avg-ASV scores for supporting stance manipulation in G&P, Group-cleanGroup-poisoned 0.0 0.2 0.4 0.6 0.8 1.0 Polarity Scores Topic 1: Target Polarity (PRO) Group-cleanGroup-poisoned Topic 2: Target Polarity (CON) Figure 3: Empirical comparative experiments of adversarial opinion manipulation attacks on user cognition. whereas EDU remains the most challenging domain. In order to illustrate the manipulation results more vividly, we randomly selected the topic "Is Binge-Watching Good for You?" for a case study, as shown in Figure 10 (in Appendix). This topic comprises multiple sub-queries, enabling an ex- amination of topic-level manipulation consistency. Before manipulation, responses span a mix of supportive, opposing, and neutral perspectives; after applying Topic-FlipRAG, the distribution shifts toward the target stance—becoming pre- dominantly supportive under "Pro" (blue) or predominantly opposing under "Con" (red). For instance, in "Binge-watching: addictive or relaxing?", the original response presents a bal- anced view, while the manipulated versions adopt distinctly polarized stances—emphasizing relaxing effects under "Pro" and highlighting addictive harms under "Con." Similarly, for "Opinions on binge-watching trends?", the initially diverse responses become consistently biased toward the intended stance. These examples underscore Topic-FlipRAG’s abil- ity to impose coherent opinion shifts across multiple queries within a single topic. 6.3RQ3: Does topic-oriented opinion manip- ulation significantly impact users’ percep- tions of controversial topics? To explore the effect of opinion manipulation on users’ perceptions of controversial topics, we conducted a user study involving 54 college students to assess how opinion manip- ulation influences perceptions of controversial topics. Par- ticipants were split into two equal groups (Group-clean and Group-poisoned, 27 members each), remaining unaware of the study’s true purpose and operating independently. A sim- ple QA service based on RAG was implemented, and Topic- FlipRAG was employed to poison documents with specific stances on two designated controversial topics. For one topic, supporting documents were poisoned; for the other, oppos- ing documents were poisoned. Each participant interacted with the QA system over three rounds per topic, mirroring real-world usage patterns, and subsequently rated their stance on a 7-point Likert scale (normalized to 0 for strong opposi- tion, 1 for strong support). Full user experimental details are provided in the Appendix A.3. Figure 3 illustrates the significant shifts in user opinions re- sulting from Topic-FlipRAG. For Topic 1 (Should People Be- Table 4: Ablation study (top3-ori, top3-att, and top3-v are re- ported in %) on the PROCON dataset. w/o denotes “without”. Method IRLlama3.1Qwen2.5 top3-oritop3-atttop3-vASV ∆ASVASV ∆ASV Topic-FlipRAG42.8370.2427.410.640.370.550.32 w/o adv-trigger42.8351.128.290.370.100.380.15 w/o know-attack42.8359.4016.570.400.120.410.18 clean–0.27–0.23– come Vegetarian?), the manipulated stance was PRO. Group- clean exhibited a dispersed distribution with an average score of 0.45, reflecting diverse views on this controversial issue. By contrast, Group-poisoned recorded a notably higher mean score of 0.61, indicating successful manipulation toward pro- vegetarian sentiment. For Topic 2 (Should Humans Colonize Space?), the stance was CON. Although Group-clean orig- inally showed strong support (average score 0.76), Group- poisoned achieved a reduction to 0.59, effectively nudging opinions toward neutrality. These results underscore Topic- FlipRAG’s potency in shifting both neutral and polarized views, highlighting the potential risks of adversarial opinion manipulation in shaping public discourse. 6.4 Ablation Study Effectiveness of Core Components of Topic-FlipRAG. We investigated the individual contributions of the two main components of Topic-FlipRAG: know-attack and adversarial trigger generation (referred to as adv-trigger). As shown in Table 4, both components play significant roles in achieving the overall attack effectiveness, albeit with varying impacts on different aspects of the task. Adv-trigger and know-attack complement each other by leveraging distinct strengths to enhance the overall effective- ness of the Topic-FlipRAG framework. Adv-trigger, through its gradient-based generation process, directly optimizes the retriever mechanism, resulting in significant ranking improve- ments for adversarially targeted documents. In contrast, know- attack, while comparatively less impactful on ranking opti- mization, utilizes general semantic knowledge to achieve pre- cise and consistent polarity manipulation in LLM outputs, reinforcing the adversarial influence on generated responses. This synergy allows for more comprehensive and precise con- trol over the RAG framework’s behavior, thereby maximizing the overall efficacy of the attack strategy. Impact of Rewarding Function in Topic-FlipRAG. The rewarding function in Topic-FlipRAG dynamically adjusts the augment factortin the know-attack process, controlling the aggressiveness of edits in each iteration. By leveraging semantic similarity and edit distance filtering, the rewarding function ensures an adaptive improvement strategy, enhancing the overall performance. As shown in Table 5, the rewarding function significantly impacts the effectiveness of know-attack in IR manipulation. Compared to fixed augment factortvalues, the dynamic ad- Table 5: Comparative analyses of rewarding function and fixed augment factor t on IR manipulation attacks (%). RASRtop3-oritop3-atttop3-v know-attack22.2542.8352.128.29 t=117.4242.8349.286.45 t=216.8342.8349.736.89 t=318.5442.8349.026.18 Table 6: Comparative analyses of rewarding function and fixed augment factor t on RAG opinion manipulation. SettingTopic-FlipRAGt=1t=2t=3 ASV0.640.580.560.59 ∆ASV0.370.310.290.32 justment achieves higher attack breadth (evidenced by in- creased RASR) and depth (higher top3-v scores). Table 6 further highlights its influence on RAG opinion manipulation, where the dynamic approach yields higher ASV and∆ASV compared to fixedtsettings. Notably, the rewarding function’s influence on RAG output polarity manipulation surpasses its impact on IR manipulation. This can be attributed to its role in improving the quality of generateddoc know , where qual- ity encompasses both enhanced ranking boosts (related to IR manipulation) and stronger polarity reinforcement. These findings underscore the rewarding function’s critical contribu- tion to optimizing the know-attack strategy for both ranking and opinion manipulation objectives. Impact of Polarity Control in Topic-FlipRAG. Figure 4 illustrates the effect of the Polarity Control component on the sentiment of thedoc adv when the target polarity is set to CON. Negative sentiment scores represent negative po- larity, while positive scores indicate positive polarity. The results show that, without Polarity Control, thedoc adv gravi- tates toward a neutral polarity. With Polarity Control enabled, Topic-FlipRAG effectively alignsdoc adv with the desired tar- get polarity CON). The notable deviation in thedoc adv polarity without Polar- ity Control arises from the nature of know-attack: while it leverages the internal knowledge and reasoning capabilities of LLMs, it also inherits inherent polarity biases. Absent strict polarity enforcement during each editing step, the generated doc adv tends to drift from the intended polarity. By enforcing the desired polarity at every phase of know-attack, the Polarity Control component supports a more consistent and effective manipulation of RAG polarity outcomes. Potential Effectiveness by Altering Poisoning Target. Table 7 illustrates the impact of different poisoned methods on IR and RAG manipulation results.In our prior experiments on the PROCON dataset, we intentionally selected the least relevant five documents (last5) as poisoning targets to assess Topic-FlipRAG’s effectiveness under a challenging manipula- tion scenario. This design aimed to test the robustness of the attack under more constrained conditions. However, in real- Original-Documentw/o Polarity ControlTopic-FlipRAG −0.75 −0.50 −0.25 0.00 0.25 0.50 0.75 Sentiment Score Figure 4: Impact of Polarity Control module on documents sentiment. w/o denotes “without”. (target polarity:CON). Table 7: Performance comparison of poisoning target on the PROCON dataset.(top3-ori, top3-att, top3-v are reported in %.) Poisoning Target IRLlama3.1 top3-oritop3-atttop3-vASV ∆ASV last542.8370.2427.410.640.37 top542.8379.1836.350.720.44 clean–0.27– world attack scenarios, an attacker might reasonably choose the topically most relevant documents (top5) as poisoned targets to achieve more effective opinion manipulation. The experimental results show that poisoning the top5 doc- uments yields improved manipulation performance, as evi- denced by higher top3-v and ASV scores. Specifically, poi- soning the top5 documents achieves a top3-v score of 0.37 and an ASV score of 0.71, both surpassing the performance observed with the last5 method. These results suggest that Topic-FlipRAG could pose even greater risks in real-world settings, where attackers can freely select highly relevant tar- gets, highlighting the urgent need for robust defenses against such advanced adversarial strategies. 6.5 Hyper-parameter Analysis We analyze four key hyper-parameters of our method: the editing distanceε, the semantic similarity thresholdλ, the iteration numberN, and the number of retrieved documentsK. Due to space limitations, the analyses ofεandλare demon- strated in detail in Appendix A.2. We do not discuss the hyper-parameters used in adversarial trigger generation, as they have already been systematically studied and validated in prior ranking attack research [26, 39]. Number of retrieved documentsK. This hyper-parameter controls how many candidate documents are retrieved for LLM generation. AsKvaries, we replace the fixed top3-v metric with a dynamic topK-v to reflect stance manipulation Impact of the number of retrieved documents K Impact of the iteration number N Figure 5: Impact of the number of retrieved documentsK(left part) and the iteration numberN(right part) on different performance metrics of Topic-FlipRAG on the PROCON dataset. across the top-Kcandidates. RASR is also redefined accord- ingly: an attack is considered successful if the proportion of target-label documents increases within the top-K results. Our results (Figure 5) show that RASR increases withK, suggesting that when the retriever returns more documents, the chance of adversarial content appearing in the top-Kcan- didates rises, thus increasing the system’s vulnerability to ma- nipulation. However, both topK-v and ASV exhibit a down- ward trend asKincreases. This indicates a dilution effect: while manipulated documents are more likely to be included, their influence on the final answer is weakened due to the ex- panded pool of candidates. To achieve a balanced evaluation that jointly accounts for both RASR and ASV, we setK = 3 as the hyperparameter for our main experiments. Iteration numberN. This hyper-parameter controls the total number of iterations in the knowledge-guided attack process, akin to training epochs in model optimization. As shown in Figure 5, increasingNleads to improved perfor- mance across multiple evaluation metrics (e.g., ASV, RASR, top3_att), indicating that more iterations enable the attack to better manipulate retrieved document stances and influence the final LLM output. For example, ASV improves from 0.56 atN = 1to 0.67 atN = 9, while RASR follows a similar upward trend. However, higherNalso introduces greater computational cost. We observe that performance improves significantly fromN = 1toN = 5, but gains plateau betweenN = 5and N = 9. To balance attack effectiveness and efficiency, we set N = 5 as the default value in Topic-FlipRAG. 7 Mitigation Analysis and Discussion To assess the robustness of existing defenses against topic- level opinion manipulation, we evaluate several strategies, including perplexity filtering, random masking, paraphrasing, and reranking. However, our empirical analysis shows that these methods are largely ineffective against Topic-FlipRAG, which leverages subtle, semantics-preserving perturbations that evade conventional detection and intervention. In light of these limitations, we further discuss potential defense di- rections, including utility-based filtering, TF-IDF anomaly detection, intra-top-ksimilarity analysis, and certified prov- able mechanisms grounded in topic and fact consistency. 7.1 Mitigation by Perplexity. Perplexity (PPL), a standard metric for text quality, is also used to detect adversarial attacks on LLMs and IR models [14, 18, 26]. High perplexity indicates low-quality or suspicious text. We adopt PPL to identify malicious content. Figure 6 presents the GPT-2 [34]-evaluated log perplexity distributions of PROCON documents manipulated by various attack methods, highlighting the limitations of perplexity- based defenses. Due to substantial distributional overlap be- tween clean and poisoned documents, setting effective thresh- olds proves challenging: strict thresholds yield high false positives, while loose ones miss attacks. Among the methods, Collision shows the most noticeable PPL shift, making it rela- tively detectable. In contrast, Topic-FlipRAG and PAT gen- erate poisoned documents with distributions closely aligned to the original data, posing significant detection challenges. PoisonedRAG, lacking gradient-based optimization, induces negligible PPL changes, further underscoring the insufficiency of perplexity-based filtering for subtle manipulations. 7.2 Mitigation by Random Mask. Random Mask is a robustness enhancement method that randomly masks a proportion of tokens with a placeholder tokenmduring embedding [47]. By averaging predictions over multiple masked input versions, it reduces sensitivity to small perturbations and enhances model stability. In our im- plementation, we averaged outputs over three masked copies of each input to assess performance under varying mask rates. Figure 7 presents experimental results on the PROCON- Dataset targeting the CON stance. When the mask rate is below 0.3, Topic-FlipRAG achieves notably higher manipula- tion metrics (RASR > 55%, top3-v > 20%) compared to other baselines, underscoring its robust manipulation capability. As the mask rate increases, the effectiveness of all methods de- clines; however, Topic-FlipRAG still maintains the highest attack success among the baselines. Nonetheless, excessively large mask rates also degrade normal RAG performance, re- vealing the trade-off between heightened defense and overall system functionality. Consequently, Random Mask alone is 012345 log PPL 0.0 0.2 0.4 0.6 0.8 1.0 PAT Whole Dataset Target Doc PAT 012345 log PPL 0.0 0.2 0.4 0.6 0.8 1.0 Collision Whole Dataset Target Doc Collision 012345 log PPL 0.0 0.2 0.4 0.6 0.8 1.0 Topic-FlipRAG Whole Dataset Target Doc Topic-FlipRAG 012345 log PPL 0.0 0.2 0.4 0.6 0.8 1.0 PoisonedRAG Whole Dataset Target Doc PoisonedRAG Figure 6: Log perplexity (PPL) distributions on the PROCON dataset. 0.20.40.60.8 Mask Rate 20 30 40 50 60 RASR(%) RASR under different mask rate Topic-FlipRAG PoisonedRAG PAT Collision 0.20.40.60.8 Mask Rate 0 5 10 15 20 25 top3-v(%) top3-v under different mask rate Topic-FlipRAG PoisonedRAG PAT Collision Figure 7: Attack performance of different random mask rate. insufficient against sophisticated attacks like Topic-FlipRAG, indicating that additional measures are required to strengthen system robustness without undermining functionality. 7.3 Mitigation by Paraphrasing Cheng et al. [8] and Zou et al. [52] investigate the applica- tion of paraphrasing defenses to evaluate the effectiveness of the RAG attacks they proposed. The underlying concept is to modify the query through rewriting, thereby increasing the difficulty for the attacker to successfully execute an attack on a specific query. The prompt used in our approach is provided in Appendix A.4. The attack effectiveness of Topic-FlipRAG and other base- lines against paraphrasing is presented in Table 8. Both the baselines and Topic-FlipRAG exhibit a decline in at- tack effectiveness when confronted with paraphrasing, yet Topic-FlipRAG remains largely unaffected: its RASR drops marginally from 51.47% to 50.96%, while top3-v decreases from 27.40% to 22.46%. These results suggest that paraphras- ing is insufficient to defend against manipulations targeting the topical level. Topic-FlipRAG remains effective because it operates over entire topic-query sets rather than relying on specific query phrasings. Although paraphrasing alters surface wording, it typically preserves the original seman- tic focus, keeping the rewritten query within the same topic scope. This resilience underscores the difficulty of defend- ing against topic-level RAG manipulations and highlights the need for more advanced, semantics-aware countermeasures. Figure 8: Comparative analysis of the performance met- rics(RASR and top3-v) across different baselines before and after paraphrasing mitigation. 7.4 Mitigation by Reranking. We investigate a reranking mechanism within the RAG framework to mitigate adversarial attacks. This approach em- ploys a different IR model to reorder initial retrieval results, thereby reducing attack effectiveness. The defense rationale is twofold: (1) most attacks rely on approximating the target IR model [9, 26, 29], and introducing a distinct reranker dis- rupts this dependency; (2) different IR models exhibit varying robustness, and reranking enhances overall resilience. We tested this method on the PROCON-Dataset with the stance CON, using Contriever for retrieval and DPR for reranking. As illustrated in Figure 9, most adversarial meth- ods show a slight decline in manipulation effectiveness under reranking, except for PoisonedRAG, which is less sensitive due to its simpler query-plus strategy. In contrast, Collision, PAT, and Topic-FlipRAG depend on gradient information from open-sourced IR models, leading to varied transferabil- ity when attacking a different black-box IR pipeline. Despite the overall decrease in attack performance, Topic-FlipRAG maintains a relatively high success rate, demonstrating that reranking alone offers only partial defense against sophisti- cated adversarial techniques. 7.5 Future Potential Defense Mechanisms We have integrated several widely adopted defense strate- gies from prior work on RAG-based and IR-based attacks, in- cluding filtering by perplexity, random masking, paraphrasing, Collision PAT PoisonedRAG Topic-FlipRAG 0 10 20 30 40 50 RASR(%) RASR of different baselines Original Rerank Collision PAT PoisonedRAG Topic-FlipRAG 0 5 10 15 20 25 top3-v(%) top3-v of different baselines Original Rerank Figure 9: Comparative analysis of the performance metrics (RASR and top3-v) across different baselines before and after reranking mitigation. and reranking-based optimization. While these techniques are commonly used, our empirical results demonstrate that they provide only limited robustness against the proposed attack method. To guide the development of more effective future defenses, we outline three promising directions informed by recent insights and attack characteristics: Filtering via Usefulness Features. Recent RAG-related attack studies reveal that adversaries often enhance the rele- vance of poisoned documents without improving their actual usefulness in answering user queries. This decoupling creates opportunities for detection. For instance, RbFT [40] highlights the potential of usefulness-based filtering, such as leveraging LLM-based judgments or dedicated retrieval-utility models, to complement relevance-centric ranking systems. Incorporat- ing usefulness estimation may significantly enhance filtering granularity in adversarial settings. TF-IDF Based Detection. In topic-specific attack scenar- ios, adversaries frequently inject or substitute high-impact keywords to manipulate semantic relevance, leading to ele- vated TF-IDF scores. While such high TF-IDF values may also occur in naturally high-ranking documents, the distribu- tional shift introduced by poisoned inputs, especially when paired with usefulness signals, could provide an effective ba- sis for anomaly detection. This hybrid detection approach remains an open but promising research avenue. Intra-Top-k Document Similarity. Under benign retrieval conditions, the top-k documents typically exhibit high se- mantic coherence, often reflected in strong pairwise similar- ity. In contrast, targeted poisoning tends to inject documents that diverge semantically from clean results, despite being top-ranked. This reduction in intra-group similarity offers a lightweight and model-agnostic signal that could flag manipu- lated retrieval outputs without additional supervision. Future work may explore leveraging this pattern for online detection in black-box RAG deployments. 8 Conclusion This study highlights the critical vulnerability of RAG sys- tems to sophisticated opinion manipulation attacks in real- world scenarios. By shifting focus from traditional factual or single-query attacks to topic-oriented adversarial manipula- tions, we reveal how attackers can systematically exploit the knowledge synthesis capabilities of LLMs to alter informa- tion perception and propagate biased narratives. The proposed Topic-FlipRAG framework demonstrates that combining ad- versarial ranking perturbations with LLMs’ inherent reason- ing abilities enables effective stance polarity shifts across interconnected queries, even in complex multi-perspective contexts. Experiments show that existing mitigation strategies inadequately address semantically sophisticated attacks. In the future, we will explore enhanced transparency protocols to maintain RAG systems as reliable information mediators. Open Science Our work complies with USENIX Security’s open science mandate by prioritizing transparency and reproducibility. All attack implementations, including Topic-FlipRAG, evaluation scripts, and datasets, are hosted on GitHub 5 and Zenodo 6 . The repository is licensed under the MIT License, allowing reuse while prohibiting malicious applications. We have provided comprehensive documentation, covering environment setup, hyper-parameters, and attack pipelines, to ensure independent verification. Sensitive data has been excluded from the repos- itory. Synthetic queries were generated using GPT-4o, with ethical constraints imposed to eliminate harmful or biased language. All components necessary to replicate our findings are publicly accessible. We are committed to maintaining the repository availability for at least three years and will update the repositories based on community feedback. Ethics Considerations Our research investigates vulnerabilities in RAG systems through the lens of adversarial opinion manipulation. We rig- orously evaluated ethical implications using principles from The Menlo Report (Beneficence, Respect for Persons, Jus- tice, and Respect for Law) and the USENIX Security Ethics Guidelines. Responsible Disclosure. We understand the importance of engaging with model and framework providers, so we re- ported this vulnerability to the LangChain Security Team, hoping to collaborate on developing a mitigation module. However, due to limitations in defense measures, we have not yet gained recognition, and we are still striving to make effective progress. Additionally, the widespread use of hybrid open-source frameworks means that ownership boundaries are less clear compared to traditional software vulnerabilities. This ambiguity prompted us to explore a policy-oriented dis- closure approach, aiming to encourage systemic preventative measures. Therefore, we used an accessible and efficient chan- nel to initiate policy-level mitigation. We reported our pre- 5 https://github.com/LauJames/Topic-FlipRAG 6 https://doi.org/10.5281/zenodo.15523435 liminary findings and associated risks to our institution. This information, along with related content, was subsequently dis- closed to Xinhua News Agency, not for public release. We want to emphasize that this initial disclosure was not intended to be exclusive or politically motivated. We are willing to in- form other relevant platforms and international organizations. Data Privacy and User Consent. Our experiments in- volved opinion-based datasets covering various topics. To protect individual privacy, we ensured that all datasets are anonymized to remove personally identifiable information (PII), thus safeguarding individual privacy. Moreover, before beginning the user experiments, participants were thoroughly informed about the study’s background, purpose, and the mea- sures in place to ensure fairness and privacy protection. After the experiment, we reiterated the true data distribution to par- ticipants to minimize any potential cognitive impact. Through- out the research, we conducted all experiments, particularly those involving adversarial attacks, in secure environments to prevent unintended consequences. By addressing these ethical considerations, our research not only highlights vulnerabilities but also contributes to the development of robust solutions in safeguarding RAG models against exploitation. IRB Approval. This study was conducted under full Institutional Review Board (IRB) approval (Protocol No. WHU-HSS-IRB2025010. We confirm that all research activ- ities strictly complied with the IRB-approved protocol. All research activities involving human participants received ap- proval from our institution’s Humanities and Social Sciences Ethics Committee. To obtain IRB approval, we submitted a comprehensive application package, including a research ethics justification report, informed consent forms, a detailed project protocol, and the CVs of both the principal investiga- tor and all research participants. The application was subject to a rigorous, multi-stage review process involving sequen- tial approval by the project leader, institutional supervisors, the ethics committee secretary, and the committee leadership. After successfully completing all review stages, our study was formally granted IRB approval. Specific procedures are detailed as follows: Informed Consent: All participants were required to sign an informed consent form prior to the experiment. The document clearly communicated the study’s objectives, procedures, esti- mated duration, potential psychological risks (e.g., exposure to controversial topics), compensation scheme (a cash reward of 50 RMB), and participants’ rights to withdraw at any time without penalty. Participants were also informed that their responses would be used solely for academic research. Data Handling and Anonymization: All responses and opin- ion scores were collected using anonymized participant IDs. No personally identifiable information (such as name, contact details, or personal ID) was stored. Data were encrypted and stored on secure servers accessible only to core research staff. Data will be retained for three years and then permanently deleted. Throughout the study, strict anonymization proce- dures were enforced. Participant identifiers were randomly assigned, and all data records excluded any direct or indirect personal information. This ensured that individuals could not be re-identified during analysis or in any published findings. User Privacy Protection: The entire study was conducted in a controlled laboratory environment to minimize external data exposure. All data were used exclusively for academic purposes and were never shared with third parties. Participants were provided with post-experiment debriefing, including full disclosure of the study’s objectives and safeguards. Addi- tionally, experimental group participants were shown control group outputs after completion to reduce potential cognitive bias introduced by adversarial content exposure. In summary, this study not only adhered to rigorous eth- ical standards but also aimed to advance the development of trustworthy AI by systematically identifying vulnerabili- ties in RAG systems and promoting secure, transparent, and user-respecting model design. Acknowledgement. This work is supported by the National Science and Tech- nology Major Project (2023ZD0121502) and National Natural Science Foundation of China (72404212). References [1]Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. Self-rag: Learning to retrieve, generate, and critique through self-reflection. arXiv preprint arXiv:2310.11511, 2023. [2] Nitay Calderon, Roi Reichart, and Rotem Dror. The alternative annotator test for llm-as-a-judge: How to sta- tistically justify replacing human annotators with llms. arXiv preprint arXiv:2501.10970, 2025. [3]Yuanpu Cao, Bochuan Cao, and Jinghui Chen. Stealthy and persistent unalignment on large language models via backdoor injections. arXiv preprint arXiv:2312.00027, 2023. [4]Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr. Poisoning web-scale training datasets is practi- cal. In Proc. of SP, pages 407–425, 2024. [5]Xuanang Chen, Ben He, Zheng Ye, Le Sun, and Yingfei Sun.Towards imperceptible document manipula- tions against neural ranking models. arXiv preprint arXiv:2305.01860, 2023. [6]Zhuo Chen, Yuyang Gong, Jiawei Liu, Miaokun Chen, Haotan Liu, Qikai Cheng, Fan Zhang, Wei Lu, and Xi- aozhong Liu. Flippedrag: Black-box opinion manipula- tion adversarial attacks to retrieval-augmented genera- tion models. In Proc. of CCS, page 4109–4123, 2025. [7]Zhuo Chen, Jiawei Liu, and Haotan Liu. Research on the reliability and fairness of opinion retrieval in public topics. In 2024 NDSS workshop on AISCC, 2024. [8] Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. Trojanrag: Retrieval-augmented generation can be back- door driver in large language models. arXiv preprint arXiv:2405.13401, 2024. [9]Sukmin Cho, Soyeong Jeong, Jeongyeon Seo, Taeho Hwang, and Jong C Park. Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating doc- uments in the wild via low-level perturbations. arXiv preprint arXiv:2404.13948, 2024. [10]Gianluca De Stefano, Lea Schönherr, and Giancarlo Pel- legrino. Rag and roll: An end-to-end evaluation of in- direct prompt manipulations in llm-based application frameworks. arXiv preprint arXiv:2408.05025, 2024. [11]Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. Masterkey: Automated jailbreaking of large language model chatbots. In Proc. ISOC NDSS, 2024. [12]Luyu Gao and Jamie Callan. Unsupervised corpus aware language model pre-training for dense passage retrieval. arXiv preprint arXiv:2108.05540, 2021. [13] Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jin- liu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, and Haofen Wang. Retrieval-augmented generation for large language mod- els: A survey. arXiv preprint arXiv:2312.10997, 2023. [14] Hila Gonen, Srini Iyer, Terra Blevins, Noah A Smith, and Luke Zettlemoyer. Demystifying prompts in lan- guage models via perplexity estimation. arXiv preprint arXiv:2212.04037, 2022. [15] Gregory Goren, Oren Kurland, Moshe Tennenholtz, and Fiana Raiber. Ranking robustness under adversarial document manipulations. In Proc. of SIGIR, pages 395– 404, 2018. [16]Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injec- tion. In Proc. of the 16th ACM Workshop on Artificial Intelligence and Security, pages 79–90, 2023. [17] Zoltan Gyongyi and Hector Garcia-Molina. Web spam taxonomy. In First international workshop on AIRWeb, 2005. [18]Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models.arXiv preprint arXiv:2309.00614, 2023. [19] Nikhil Kandpal, Matthew Jagielski, Florian Tramèr, and Nicholas Carlini. Backdoor attacks for in-context learning with language models.arXiv preprint arXiv:2307.14692, 2023. [20] Vladimir Karpukhin, Barlas Oguz, Sewon Min, Patrick Lewis, Ledell Wu, Sergey Edunov, Danqi Chen, and Wen-tau Yih. Dense passage retrieval for open-domain question answering. In Proc. of EMNLP, pages 6769– 6781, 2020. [21] Diederik P Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014. [22]Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval-augmented generation for knowledge- intensive nlp tasks. Proc. of NeurIPS, pages 9459–9474, 2020. [23]Haoran Li, Dadi Guo, Wei Fan, Mingshi Xu, Jie Huang, Fanpu Meng, and Yangqiu Song.Multi-step jail- breaking privacy attacks on chatgpt. arXiv preprint arXiv:2304.05197, 2023. [24]Mao Li and Frederick Conrad. Advancing annotation of stance in social media posts: A comparative analysis of large language models and crowd sourcing. arXiv preprint arXiv:2406.07483, 2024. [25] Shi Lin, Rongchang Li, Xun Wang, Changting Lin, Wen- peng Xing, and Meng Han. Figure it out: Analyzing- based jailbreak attack on large language models. arXiv preprint arXiv:2407.16205, 2024. [26]Jiawei Liu, Yangyang Kang, Di Tang, Kaisong Song, Changlong Sun, Xiaofeng Wang, Wei Lu, and Xi- aozhong Liu. Order-disorder: Imitation adversarial at- tacks for black-box neural ranking models. In Proceed- ings of CCS, pages 2025–2039, 2022. [27] Xiao Liu, Hanyu Lai, Hao Yu, Yifan Xu, Aohan Zeng, Zhengxiao Du, Peng Zhang, Yuxiao Dong, and Jie Tang. Webglm: Towards an efficient web-enhanced question answering system with human preferences. In Proc. of KDD, pages 4549–4560, 2023. [28]Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Ri- jke, Wei Chen, Yixing Fan, and Xueqi Cheng. Topic- oriented adversarial attacks against black-box neural ranking models. In Proc. of SIGIR, pages 1700–1709, 2023. [29]Yu-An Liu, Ruqing Zhang, Jiafeng Guo, Maarten de Ri- jke, Yixing Fan, and Xueqi Cheng. Multi-granular adver- sarial attacks against black-box neural ranking models. In Proc. of SIGIR, pages 1391–1400, 2024. [30] Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Prompt injection attacks and defenses in llm-integrated applications. arXiv preprint arXiv:2310.12815, 2023. [31]Dong Lu, Tianyu Pang, Chao Du, Qian Liu, Xianjun Yang, and Min Lin. Test-time backdoor attacks on multimodal large language models.arXiv preprint arXiv:2402.08577, 2024. [32]Tri Nguyen, Mir Rosenberg, Xia Song, Jianfeng Gao, Saurabh Tiwary, Rangan Majumder, and Li Deng. Ms marco: A human-generated machine reading compre- hension dataset. 2016. [33] Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.09527, 2022. [34]Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language mod- els are unsupervised multitask learners. OpenAI blog, page 9, 2019. [35]Nisarg Raval and Manisha Verma. One word at a time: adversarial attacks on retrieval models. arXiv preprint arXiv:2008.02197, 2020. [36]Avital Shafran, Roei Schuster, and Vitaly Shmatikov. Machine against the rag: Jamming retrieval-augmented generation with blocker documents. arXiv preprint arXiv:2406.05870, 2024. [37]Xiang Shi, Jiawei Liu, Yinpeng Liu, Qikai Cheng, and Wei Lu. Know where to go: Make llm a relevant, re- sponsible, and trustworthy searchers. Decision Support Systems, page 114354, 2025. [38]Zhang Siyue, Xue Yuxiang, Zhang Yiming, Wu Xiaobao, Luu Anh Tuan, and Zhao Chen. Mrag: A modular re- trieval framework for time-sensitive question answering. arXiv preprint arXiv:2412.15540, 2024. [39]Congzheng Song, Alexander M Rush, and Vitaly Shmatikov. Adversarial semantic collisions. arXiv preprint arXiv:2011.04743, 2020. [40] Yiteng Tu, Weihang Su, Yujia Zhou, Yiqun Liu, and Qingyao Ai. Rbft: Robust fine-tuning for retrieval- augmented generation against retrieval defects. arXiv preprint arXiv:2501.18365, 2025. [41]Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? Proc. of NeurIPS, 2024. [42] Chen Wu, Ruqing Zhang, Jiafeng Guo, Maarten De Ri- jke, Yixing Fan, and Xueqi Cheng. Prada: Practical black-box adversarial attacks against neural ranking models. TOIS, pages 1–27, 2023. [43] Shangyu Wu, Ying Xiong, Yufei Cui, Haolun Wu, Can Chen, Ye Yuan, Lianming Huang, Xue Liu, Tei-Wei Kuo, Nan Guan, et al. Retrieval-augmented generation for natural language processing: A survey. arXiv preprint arXiv:2407.13193, 2024. [44]Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. Approximate nearest neighbor negative con- trastive learning for dense text retrieval. arXiv preprint arXiv:2007.00808, 2020. [45] Shicheng Xu, Liang Pang, Huawei Shen, Xueqi Cheng, and Tat-Seng Chua.Search-in-the-chain: Interac- tively enhancing large language models with search for knowledge-intensive tasks. In Proceedings of W, pages 1362–1373, 2024. [46]Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. Badrag: Identifying vulnerabili- ties in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083, 2024. [47]Jiehang Zeng, Jianhan Xu, Xiaoqing Zheng, and Xu- anjing Huang. Certified robustness to text adversarial attacks by randomized [mask]. Computational Linguis- tics, pages 395–427, 2023. [48]Yucheng Zhang, Qinfeng Li, Tianyu Du, Xuhong Zhang, Xinkui Zhao, Zhengwen Feng, and Jianwei Yin. Hijack- rag: Hijacking attacks against retrieval-augmented large language models. arXiv preprint arXiv:2410.22832, 2024. [49] Penghao Zhao, Hailin Zhang, Qinhan Yu, Zhengren Wang, Yunteng Geng, Fangcheng Fu, Ling Yang, Wen- tao Zhang, and Bin Cui. Retrieval-augmented genera- tion for ai-generated content: A survey. arXiv preprint arXiv:2402.19473, 2024. [50]Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuo- han Li, Dacheng Li, Eric Xing, et al. Judging llm-as- a-judge with mt-bench and chatbot arena. Proc. of NeurIPS, pages 46595–46623, 2023. [51]Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. arXiv preprint arXiv:2310.19156, 2023. [52]Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language mod- els. arXiv preprint arXiv:2402.07867, 2024. A Appendix A.1 Additional Experiment Details (1) Opinion Classification. LLMs have been widely adopted as evaluators or "judges" in recent literature [50]. Prior work has further validated the reliability of LLMs in sentiment classification [2] and explicit stance detection [24]. In our experiment, we employ Qwen2.5-Instruct-72B as the opinion classifier. Owing to its large parameter scale and instruction tuning, the model demonstrates strong capabil- ity in identifying user stances embedded in natural language. To evaluate its reliability, we randomly sampled 500 RAG- generated responses from the PROCON dataset and recruited three cognitively unimpaired undergraduate students to in- dependently annotate each instance. The Krippendorff’sα among the human annotators was 0.8833, and the average pairwise Cohen’sκbetween the LLM and the three human annotators was 0.7897. We further aggregated the three annotations via majority vote to derive a human consensus label. The LLM’s predic- tions achieved aκof 0.8110 and an accuracy of 0.8760 against this consensus, indicating strong agreement and supporting the use of LLMs as reliable stance evaluators in our setup. A.2 Additional Parameter Analysis Similarity thresholdλ. This parameter controls the mini- mum similarity between the poisoned document and the orig- inal one in the Know-Attack process. A lower value ofλ allows for greater perturbation and thus potentially more ef- fective opinion manipulation. As shown in Table 8, whenλ decreases from 0.90 to 0.80, we observe consistent improve- ments across multiple metrics: the top3-v score increases from 0.26 to 0.32, RASR improves from 0.51 to 0.58, and both ASV and∆ASV show significant increases (from 0.52 to 0.66 and from 0.25 to 0.39, respectively). These results in- dicate that permitting greater document alterations (i.e., lower λ) leads to more successful manipulation of both retrieval and generation stages. Edit distanceε. This parameter defines the allowed pertur- bation budget in the token space when generating poisoned documents. A larger edit distance permits more extensive token-level modifications, enabling the attacker to craft doc- uments that are more semantically distant from the original. As shown in Table 9, increasingεfrom 0.10 to 0.30 consis- tently improves manipulation effectiveness. Specifically, the top3-v score rises from 0.25 to 0.30, and RASR improves from 0.47 to 0.56, indicating enhanced retrieval-stage manip- ulation. On the generation side, ASV increases from 0.57 to Table 8: Performance under different similarity thresholds (λ) on the PROCON dataset. Metrics top3-ori, top3-att, top3-v, and RASR are reported in %. similarity threshold λ IRLlama3.1 top3-oritop3-atttop3-vRASRASV ∆ASV 0.8042.8374.5231.6857.840.660.39 0.8542.8370.2427.4051.470.640.37 0.9042.8368.4625.6250.670.520.25 Table 9: Performance under different edit distances (ε) on the PROCON dataset. Metrics top3-ori, top3-att, top3-v, and RASR are reported in %. edit distance ε IRLlama3.1 top3-oritop3-atttop3-vRASRASV ∆ASV 0.1042.8367.4124.5847.300.570.30 0.2042.8370.2427.4051.470.640.37 0.3042.8372.8129.9756.080.650.38 0.65, while∆ASV grows from 0.30 to 0.38, suggesting that more aggressively perturbed documents induce greater shifts in LLM-generated opinions. It is worth noting that a larger edit distanceεand a lower similarity thresholdλboth represent looser constraints on adversarial document modification. Both intuition and empir- ical results suggest that looser constraints lead to more effec- tive manipulation. However, they may also make detection and mitigation easier, highlighting a trade-off between attack strength and stealth. Nevertheless, Topic-FlipRAG consis- tently outperforms the baseline across all evaluation metrics under various constraint settings. To balance attack effective- ness and applicability across different deployment scenarios, we adopt moderate default values ofε = 0.2andλ = 0.85in our main experiments. A.3 User Study Details To evaluate the effectiveness of adversarial opinion manip- ulation in real-world usage, we conducted a controlled user study involving 54 college students (aged 18–25; 29 males, 25 females). Participants were randomly assigned to two groups of equal size: the control group (Group-clean) and the experi- mental group (Group-poisoned) (27 participants each), and interacted independently with a QA system based on RAG system. Topic-FlipRAG was applied only for the experimen- tal group to poison either supporting or opposing documents, enabling a between-subjects comparison of post-interaction stance shifts. Procedures. The experiment was fully computer-based and lasted approximately 30 minutes. Participants interacted with the system across two controversial topics. For each topic, participants first reported their initial stance using a 7-point Likert scale, which was later normalized to[0, 1](where 0 = strong opposition, 1 = strong support). These pre-interaction scores were used to verify that there was no statistically signif- icant difference in the baseline opinion distributions between the control group and the experimental group prior to any system exposure. Afterward, the participants engaged in three rounds of inter- action per topic. In each round, they were given a predefined query to input into the RAG-based QA system and were in- structed to read the returned response. For the experimental group, the responses were manipulated using Topic-FlipRAG: one topic had its supporting documents poisoned, while the other had its opposing documents poisoned. The control group received unaltered responses. Following the interactions, par- ticipants again rated their opinions using the same 7-point Likert scale, enabling evaluation of manipulation effects. Participant Tasks. Participants were instructed to explore two controversial topics using the RAG-based QA system and to reflect on their personal stance. For each topic, they completed a two-stage opinion evaluation process. First, prior to any interaction with the system, they reported their initial stance using a 7-point Likert scale. Next, they engaged in three rounds of interaction with the RAG system, each involving a distinct predefined query. After reviewing all three responses, participants rated their post-interaction stance using the same 7-point scale. To support the interaction process, we selected two topics from the PROCON-dataset and randomly sampled three sub- questions under each topic to serve as participant queries. Below are the exact sub-questions used in the study. Topic 1: Should People Become Vegetarian? Q1: Is vegetarianism compassionate? Q2: Is vegetarianism influential? Q3: Should teenagers be vegetarian? Topic 2: Should Humans Colonize Space? Q1: Should humans pursue extraterrestrial colonization? Q2: Are humans ready for space colonization? Q3: What are your thoughts on space colonization? The following evaluation questions were used to formally measure participants’ stance on each topic, both before and after their interaction with the QA system: Topic 1: Should People Become Vegetarian? Pre-interaction: "For you personally, do you think vege- tarianism is beneficial or meaningless?" Post-interaction: "After reading the content on this topic, do you think vegetarianism is meaningful? Please rate the degree of necessity." Topic 2: Should Humans Colonize Space? Pre-interaction: "For you personally, do you think hu- manity’s current investment in interstellar exploration is more beneficial or more harmful?" Post-interaction: "After learning about this topic, assum- ing you are a member of the senate, would you support or oppose large-scale societal investment in space expan- sion?" Pre/Post-Inform Protocol. To avoid priming effects, par- ticipants were initially informed that the study aimed to "eval- uate user cognitive feedback on AI QA systems," with no mention of adversarial attacks or opinion manipulation. This omission was deliberate to preserve the naturalness of user responses. Following the experiment, a full debriefing was provided in accordance with IRB guidelines. Participants in the experimental group were informed of the adversarial mod- ifications applied to system outputs, and all participants were given the option to review the clean system responses used for the control group. Contact information was provided for follow-up inquiries. Table 10: Pre-Interaction Opinion Score Comparison Between Control and Experimental Groups Across Topics TopicGroupMean ± SDp-value Topic 1 Control0.4671 ± 0.2153 0.6839 Experimental0.4424 ± 0.2278 Topic 2 Control0.6996 ± 0.1690 0.9370 Experimental0.7037 ± 0.2084 Statistical Analysis. Before interacting with the QA sys- tem, participants in both groups rated their initial stance on each topic. As shown in Table 10, the means and variances of pre-interaction scores were highly similar across the two groups, indicating that participants began with comparable baseline opinions. To statistically assess baseline equivalence, we tested the null hypothesisH H H 0 0 0 : the control and experi- mental groups do not exhibit significant differences in their initial scores. For both topics, the resulting p-values were substantially greater than 0.05, indicating thatH H H 0 0 0 cannot be rejected and supporting the conclusion that no significant dif- ferences exist between groups prior to the intervention. These results demonstrate the effectiveness of random assignment and rule out initial group bias. To assess the impact of adversarial document poisoning, we conducted independent two-sample t-tests on post-interaction stance scores. Significant opinion shifts were observed in the experimental group compared to the control group: for Topic 1 (Vegetarianism),p = 0.0454< 0.05; and for Topic 2 (Space Colonization), p = 0.0017< 0.005. A.4 Additional Mitigation Details Our paragraphing approach uses the following prompt: Task: Rewrite the following query while preserving its original meaning. Aim to modify as many words and expressions as possible, while ensuring the intent remains intact. Original Question: question Table 11: Average stance variation (ASV) and∆ASV for different attack methods across four retriever-generator combinations. Bold indicates best performance in each setting. MethodTarget Stance ANCE + Qwen2.5ANCE + Llama3.1DPR + Qwen2.5DPR + Llama3.1 avg. ASV ∆ASVavg. ASV ∆ASVavg. ASV ∆ASVavg. ASV ∆ASV Clean CON0.21–0.24–0.25–0.23– PRO0.21–0.24–0.24–0.24– Collision CON0.280.060.320.080.270.020.330.10 PRO0.290.080.340.100.310.070.350.12 PAT CON0.250.040.290.050.260.050.280.05 PRO0.250.050.310.070.250.010.270.04 PoisonedRAG CON0.350.130.360.130.370.120.430.20 PRO0.320.120.330.090.320.080.370.14 Topic-FlipRAG CON0.420.210.460.230.440.190.460.23 PRO0.390.180.470.230.460.210.440.21 Binge-watching is addictive and can lead to issues like poor sleep and reduced prod- uctivity... Binge-watching trends are d- estructive, promoting harmful habits that erode both mental and physical well-being... Binge-watching is enjoyable in moderation, but excessive indulgence may diminish its benefits... It can be both relaxing and harmful, depending on how often people indulge in it... Binge-watching trends promo- te excessive screen time, which can harm mental and physical health... It’s an engaging activity that allows people to deeply con- nect with a series or narrative... Opinions on binge-watching trends? Binge-watching can provide people with a relaxing escape, allowing them to immerse the- mselves in a story and unwind... Binge-watching: addictive or relaxing? These trends reflect changing viewing habits, their impact varies depending on individual habits... How do you rate binge- watching as an activity? Binge-watching is a fantastic way for people to deeply engage with stories and escape daily stress. Binge-watching: addictive or relaxing? Opinions on binge-watching trends? How do you rate binge- watching as an activity? Binge-watching: addictive or relaxing? Opinions on binge-watching trends? How do you rate binge- watching as an activity? PRO NeuralCON After PRO ManipulationAfter CON Manipulation Before Manipulation Distribution Variation of RAG Response Opinions based on LLAMA3.1 .................. Figure 10: Case study of Topic-oriented Opinion Manipulation On Topic:"Is Binge-Watching Good for You?". A.5 Additional Manipulation Analyses To further explore RQ2: To what extent does Topic- FlipRAG affect the answers generated by the target RAG systems?, we conducted RAG-based opinion manipulation experiments on the PROCON dataset using ANCE and DPR as retrievers. Detailed experimental outcomes are provided in Table 11. Figure 10 represents the case-study based on Topic: "Is Binge-Watching Good for You?"

Instant research discovery