Retrieval-Augmented Generation (RAG) systems enhance LLMs with external knowledge but introduce a critical attack surface: corpus poisoning. While recent studies have demonstrated the potential of such attacks, they typically rely on impractical assumptions, such as white-box access or known user queries, thereby underestimating the difficulty of real-world exploitation. In this paper, we bridge this gap by proposing MIRAGE, a novel multi-stage poisoning pipeline designed for strict black-box and query-agnostic environments. Operating on surrogate model feedback, MIRAGE functions as an automated optimization framework that integrates three key mechanisms: it utilizes persona-driven query synthesis to approximate latent user search distributions, employs semantic anchoring to imperceptibly embed these intents for high retrieval visibility, and leverages an adversarial variant of Test-Time Preference Optimization (TPO) to maximize persuasion. To rigorously evaluate this threat, we construct a new benchmark derived from three long-form, domain-specific datasets. Extensive experiments demonstrate that MIRAGE significantly outperforms existing baselines in both attack efficacy and stealthiness, exhibiting remarkable transferability across diverse retriever-LLM configurations and highlighting the urgent need for robust defense strategies.

翻译：摘要：检索增强生成（RAG）系统通过外部知识增强了大语言模型（LLM），但也引入了一个关键的攻击面：语料库投毒。尽管近期研究已展示了此类攻击的潜力，但它们通常依赖于不切实际的假设（如白盒访问或已知用户查询），从而低估了现实场景中的利用难度。本文通过提出MIRAGE弥合了这一差距——一种专为严格黑盒与查询无关环境设计的多阶段投毒流水线。MIRAGE基于代理模型反馈运行，作为一个集成三大关键机制的自动化优化框架：利用角色驱动查询合成逼近潜在用户搜索分布，通过语义锚定将这些意图以不可察觉的方式嵌入以实现高检索可见性，并采用测试时偏好优化（TPO）的对抗变体最大化说服力。为严格评估这一威胁，我们构建了源自三个长文本领域特定数据集的新基准。大量实验表明，MIRAGE在攻击有效性和隐蔽性上显著优于现有基线，在不同检索器-大语言模型配置间展现出卓越的可迁移性，凸显了构建鲁棒防御策略的迫切需求。