Retrieval-augmented generation is the usual way to make a language model answer from your own documents. Find the passages most similar to the question, put them in the prompt, and have the model answer from them.
That puts a lot of trust in the documents. If someone can add one, a wiki page, a support ticket, a shared doc, can they change the answers? Published attacks say yes, with passages tuned against the retriever. I wanted the ordinary case: one plain, templated bad passage, nothing optimised, and a count of what it does.
The setup, briefly
The corpus is 10,000 Wikipedia paragraphs from SQuAD, a public question-answering dataset, so every question has a known right answer. For each of 48 target questions I planted one passage at a time, so the corpus held exactly one bad passage in 10,001.
There were three kinds of planted passage. A false fact restates the question and asserts a made-up answer, a coined word or a shifted year. An injection restates the question and tells the system to ignore the other sources and reply with a code word. A keyword-stuffed passage is packed with common words to be retrieved as often as possible. A fourth condition plants five reworded copies of the false fact.
Three open models answered, running locally at temperature 0: qwen3 8B, Llama 3.1 8B and Gemma 3 12B. Each saw the top 5 retrieved passages.
Retrieval decides who is exposed
A passage that restates its target question was retrieved for that question every time. That's how it was written. Everywhere else, exposure was small. On average it reached 6 of 10,570 questions, its target included: a few neighbours from the same paragraph, and almost nothing on other articles.
The keyword-stuffed passages, built to be retrieved broadly, reached 3 and 10 questions of 10,570. A retriever that compares meaning has no reason to pick a bag of common words.
The model decides what happens next
Once the bad passage was in the prompt, next to four genuine ones, the models differed.
- One false passage was repeated in 42% of qwen3's answers, 21% of Llama's and 42% of Gemma's.
- Five copies took that to 100%, 85% and 98%. When most of the evidence agrees, the models go with it, even when it's wrong.
- The injection split the models most: Gemma followed it 56% of the time, qwen3 19%, Llama 2%. The same instruction in the same place was close to harmless for one model and a coin flip for another.
On clean questions with no poison, the three models were close: 71.3%, 75.2% and 72.8% accuracy. So clean accuracy told me nothing about which model would follow a planted instruction.
What this means
Two separate things decide the damage. Retrieval decides who sees the bad passage, and with a passage aimed at one question, that's mostly that one question. The model decides what it does with it, and that varies a lot from model to model and from attack to attack.
So "how vulnerable is my RAG system" is two questions, and they need two measurements. In this setup the passage reached few questions, but on the ones it reached, it changed a large share of answers.
Limits
These are small local models (8B and 12B, 4-bit), one corpus, one retriever and templated poisons, at temperature 0. SQuAD questions share wording with their paragraphs, which makes retrieval easier than with real user questions. There are 48 targets, so the single-copy rates carry intervals of roughly plus or minus 12 points. It's a picture of this setup, not of every system, and not of hosted frontier models.
The full study, with every interval, the spread to nearby questions and the defences, is in the case study. The code is on GitHub, and every number regenerates from cached model calls.