Retrieval-Augmented Generation (RAG) systems enhance large language models by grounding responses in retrieved documents from external knowledge sources at inference time. However, this reliance on retrieved content introduces vulnerabilities to poisoning attacks, in which adversarial documents can manipulate both the retrieval process and the generated outputs. This paper investigates poisoning robustness in RAG through a full factorial experimental study covering 432 configurations. We analyze the impacts of dataset, retriever type, retrieval depth, database composition, chunking strategy, and generator model on retrieval-level and generation-level metrics. The results show that retriever architecture, dataset, and retrieval depth are the strongest factors affecting poisoning exposure, while generator choice and database composition have a major impact on downstream attack success. Dense and graph-based retrievers generally improve robustness relative to BM25, whereas larger retrieval depth increases the likelihood of retrieving poisoned passages. We further show that replicating poisoned content across multiple databases amplifies adversarial influence, while additional clean sources can mitigate it. These findings highlight that poisoning vulnerability in RAG is not attributable to a single component, but instead arises from the interaction of retrieval, generation, and knowledge-base configuration.

翻译：检索增强生成（RAG）系统通过推理时从外部知识源中检索文档来支撑响应，从而增强大型语言模型的能力。然而，这种对检索内容的依赖引入了针对投毒攻击的脆弱性，在这种攻击中，对抗性文档能够操纵检索过程和生成输出。本文通过一项涵盖432种配置的全因子实验研究，探讨了RAG中的投毒鲁棒性问题。我们分析了数据集、检索器类型、检索深度、数据库组成、分块策略和生成器模型对检索层面和生成层面指标的影响。结果表明，检索器架构、数据集和检索深度是影响投毒暴露程度的最强因素，而生成器选择和数据库组成对下游攻击成功率有重大影响。相较于BM25，基于密集向量和图结构的检索器通常能提升鲁棒性，但更大的检索深度会增加检索到投毒片段的概率。我们进一步证明，在多个数据库中复制投毒内容会放大对抗性影响，而增加清洁数据源则可缓解这种影响。这些发现凸显出，RAG中的投毒脆弱性并非归因于单一组件，而是源于检索、生成和知识库配置之间的相互作用。