1 Introduction↩︎

Retrieval-augmented generation (RAG) [1] is a common strategy to reduce hallucinations by grounding large language models (LLMs) in external knowledge. That dependence, however, creates a critical attack surface: the underlying knowledge base can be manipulated via data poisoning. Early work studied query-specific poisoning, where an adversarial document is crafted to manipulate a single, complete user query string [2], [3] (illustrated in Fig. 1). In practice, this requires the attacker to know the exact query in advance, making the approach brittle to query variations. More recent work therefore moved to trigger-based attacks that associate an attack with a more general phrase or pattern [4]. While these triggers improve flexibility and transferability, each new trigger still demands costly end-to-end re-optimization of the adversarial artifact, limiting scalability and rapid deployment.

To address these limitations, we propose Eyes-on-Me, a modular attack paradigm for RAG that eliminates the need for repeated re-optimization. We decompose an adversarial document into a reusable Attention Attractor and a designated Focus Region that contains the Attack Payload. This separation enables a single attractor to be optimized once and then composed with diverse payloads, from semantic baits that fool retrievers to malicious instructions that steer generators, enabling the creation of new attacks at near-zero marginal cost.

The architecture is enabled by an attention-guided proxy objective. Rather than brittle end-to-end optimization, we tune attractor tokens to steer a small, empirically identified subset of influential attention heads toward the Focus Region. By optimizing attention, the attractor amplifies the influence of any content placed in that region, supporting transfer across both the retriever and the generator.

We evaluate Eyes-on-Me across 18 end-to-end RAG settings, covering 3 QA datasets (e.g., Natural Questions [5] and MS MARCO [6]), 2 retrievers (e.g., Qwen3-0.6-Embedding [7]), and 3 instruction-tuned LLMs (e.g., Qwen2.5-0.5B-Instruct [8]). The threat model is strict and realistic: a single poisoned document is inserted into a 1,000-document corpus (\(\leq 0.1\)%), the trigger phrase (e.g., president) must appear in the queries, and the poisoned document competes with other trigger-relevant documents. Training uses no user queries; at test time, queries are LLM-generated and semantically related to the trigger.

Under this setup, an optimized attractor paired with an LLM-generated payload attains an average attack success rate (ASR) of 57.8%, compared to 21.9% for state-of-the-art optimization-based methods (+35.9 pts; 2.6×). All methods use the same poisoned-document length budget, ensuring fairness. The modular design also transfers across retrievers, generators, and triggers, composes with diverse payloads, and enables reusable, low-cost attacks without retraining.

Contributions. (1) We introduce Eyes-on-Me, a modular RAG-poisoning framework that decouples the attack into a reusable Attention Attractor and a swappable payload within a Focus Region, enabling new attacks that achieve up to 62% ASR without retraining, matching white-box baselines. (2) We propose an attention-guided proxy objective that steers a subset of influential attention heads to that region, thereby amplifying any content placed within for both retrieval and generation. (3) Under a strict and realistic threat model, our method achieves 57.8% ASR across 18 RAG settings, substantially outperforming the 21.9% of prior work, with strong transfer across retrievers, generators, and triggers.

2 Related Work↩︎

2.0.0.1 Adversarial Attacks on RAG.

Adversarial attacks on Retrieval-Augmented Generation (RAG) adapt techniques from jailbreaking and data poisoning. Gradient-guided discrete optimization is central, beginning with HotFlip [9] and extended by prompt optimizers such as AutoPrompt [10] and GCG [11], with follow-ups that improve transferability and efficiency [12]–[14]. These methods are repurposed to poison RAG corpora. Token-level swaps hijack retrieval context [3], [15]. Full document optimization also appears; Phantom manipulates generation directly [4], and AgentPoison embeds backdoor triggers activated by specific queries [16].

Strategy-based attacks employ templates or search, drawing on jailbreaking methods such as DAN [17] and AutoDAN [18]. CorruptRAG injects templated or LLM-refined malicious passages to steer generation upon retrieval [19].

Other attacks target the representation space by modifying retriever embeddings. TrojanRAG installs multiple backdoors via a specialized contrastive objective that aligns trigger queries with malicious passages [20]. Dense retrievers trained with contrastive objectives become sensitive to subtle perturbations and enable query-dependent activation [21]. Reinforcement learning attacks optimize adversarial prompts through interaction with the target model without gradient access [22], [23]. Many approaches use LLMs as assistants to generate, score, or coordinate adversarial content [2], [24].

Head-Level Attention: Steering and Specialization. Head-level attention, i.e., analyzing and manipulating attention at the level of individual attention heads within a Transformer layer, is used for inference-time control and as evidence of specialization. Steering methods reweight heads or bias logits to strengthen instruction following without fine-tuning. PASTA identifies and reweights heads over user-marked spans [25]; LLMSteer scales post hoc reweighting to long contexts [26]; Spotlight Your Instructions biases attention toward highlighted tokens [27]; and InstABoost perturbs attention as a latent steering mechanism [28]. Prompting-based control (Attention Instruction) directs attention and mitigates long-context position bias [29]. Analyses document consistent, interpretable head roles, including syntax and coreference heads in BERT, induction heads for copy-and-continue, and NMT heads specialized for alignment, position, and rare words [30]–[32]. We move beyond post hoc reweighting and purely diagnostic analyses. We learn input space Attention Attractors that concentrate attention on a designated Focus Region through an attention guided proxy, yielding reusable components that compose with arbitrary payloads and transfer across RAG pipelines.

3 Threat Model and Problem Formulation↩︎

System and Attacker Setup. We consider a RAG system consisting of a document corpus \(\mathcal{D} = \{d_1, d_2, \dots, d_{|\mathcal{D}|}\}\) (\(d_i\) represents the \(i\)-th document), a retriever \(R\), and a generator \(G\). Following prior work on knowledge poisoning [2], [19], we assume an attacker who can inject a small set of malicious documents \(\mathcal{D}_{\text{mal}}\) into the corpus, forming an augmented corpus \(\mathcal{D}' = \mathcal{D} \cup \mathcal{D}_{\text{mal}}\), where \(|\mathcal{D}_{\text{mal}}| \ll |\mathcal{D}|\). This can be done via edits to user-editable sources (e.g., Wikipedia or internal KBs). We assume a white-box setting with full access to the retriever and generator (architectures, parameters, gradients); Sec. 5.3 relaxes this to evaluate transfer to black-box models.

At inference, given a query \(q\), the retriever returns the top-\(k\) set \(\mathcal{R}=R(q,k,\mathcal{D}') \subseteq \mathcal{D'}\) ranked by a similarity score \(\operatorname{sim}(q, d)\) (e.g., dot/cosine over embeddings). The generator then outputs a final response \(r=G(q,\mathcal{R})\) conditioned on \(q\) and the retrieved context.

Attack Trigger and Scope. To activate the attack, the adversary defines a trigger phrase \(t\) (e.g., “climate change”), which serves as the optimization anchor for crafting the malicious documents. The attack is activated for any query that the retriever deems semantically related to \(t\) (not only exact matches). We denote this set of user queries as \(\mathcal{Q}_t\) and refer to them as targeted queries. This approach is practical as it does not require foreknowledge of specific user queries; the attacker only needs to target a general phrase expected to appear in natural language.

To keep the threat model realistic, we require that each trigger appears in at least \(\alpha\%\) of benign queries, ensuring that attackers target naturally frequent user inputs rather than rare phrases. Moreover, we verify that these triggers also appear in benign documents; this way, malicious documents must outcompete many relevant benign ones, yielding a stricter and more realistic threat model.

Attack Success Criteria. The attacker crafts \(\mathcal{D}_{\text{mal}}\) to achieve two primary goals: (i) be retrieved when a targeted query \(q \in \mathcal{Q}_t\) is issued; (ii) influence the output of generator to attacker-specified.

A retrieval-phase attack is successful for a targeted query \(q \in \mathcal{Q}_t\) if and only if: \[\exists d_m \in \mathcal{D}_{\text{mal}} \text{ such that } d_m \in R(q, k, \mathcal{D}')\]

and a generation-phase attack is successful for a targeted query \(q\in\mathcal{Q}_t\) if and only if: \[\begin{align} &\mathcal{C}_{\text{mal}}\!\big(G(q, R(q,k,\mathcal{D}'))\big)=1 \;\text{and } \\&\exists d_m\in\mathcal{D}_{\text{mal}}\colon d_m\in R(q,k,\mathcal{D}'). \end{align}\]

where \(\mathcal{C}_{\text{mal}}(r)\) returns \(1\) when \(r\) exhibits the attacker-specified malicious behavior (e.g., executing a forbidden instruction, leaking sensitive data, targeted disinformation).

While this work mainly focuses on empirical contributions, we provide mechanistic discussions in Appendix 13.

4 Methodology↩︎

We (i) decompose each malicious document into a reusable Attention Attractor and a swappable payload placed in a designated Focus Region (Sec.4.1); (ii) optimize the attractor with an attention-guided proxy to concentrate impactful heads on that Focus Region (Sec.4.2); and (iii) instantiate the attractor via HotFlip under a fluency constraint (Sec. 4.3). See Figure 2 for a framework overview. We show the pseudocode for the optimization algorithm in Appendix 14.

4.1 Attention Attractor-Focus Region Decomposition↩︎

We decompose each malicious document into a reusable Attention Attractor and a designated Focus Region. The Focus Region is a placeholder for the actual malicious content, which we term the Attack Payload; the attractor is optimized to deliver that payload by concentrating model attention on the Focus Region. This separation underpins reuse and scalability.

This design can be realized in a document template with distinct components: \[\label{eqn:document-structure} d_m = [\underbrace{\rho_{\text{prefix}}, s_{\text{ret}}, \rho_{\text{suffix}}}_{\text{Retriever Component}}, \quad \underbrace{g_{\text{prefix}}, s_{\text{gen}}, g_{\text{suffix}}}_{\text{Generator Component}}]\tag{1}\] Here, the segments (\(\rho_{\text{prefix}},\rho_{\text{suffix}},g_{\text{prefix}},g_{\text{suffix}}\)) constitute the optimizable Attention Attractor; its optimization is detailed in Sec. 4.2. The slots within the attractor are the Focus Regions, which contain the actual malicious content. The term \(s_{\text{ret}}\) and \(s_{\text{gen}}\) denote the Attack Payloads that are inserted into these respective regions. Specifically, the retrieval-side payload \((s_{\text{ret}})\) is crafted to be semantically close to the trigger, while the generation-side payload \((s_{\text{gen}})\) encodes the malicious instructions. This design allows various Payloads, from simple templates to adversarially optimized content, to be deployed without retraining the reusable Attention Attractor.

4.2 Proxy Objective: Attention-Guided Attention Attractor Optimization↩︎

The core challenge lies in optimizing the Attention Attractor to maximize the influence of the Focus Region, independent of the specific Attack Payload inserted into it. Traditional end-to-end objectives are unsuitable, as optimizing for final task metrics like retrieval similarity (\(\operatorname{sim}\)) or generation likelihood (\(\log P\), i.e., the log-probability of the first token of the targeted output) would tightly couple the attractor to the specific payload used during optimization. This monolithic approach violates the desired payload-agnostic nature of the attractor, hindering its reusability. This motivates a tractable proxy objective to optimize the attractor in isolation. We hypothesize that the model’s internal attention allocation can serve as an effective proxy. To validate this, we analyzed the relationship between the attention mass directed at the Focus Region and the final task metrics. Our analysis shows a strong positive correlation between attention mass on the Focus Region and final task performance. This relationship is particularly striking for a subset of influential heads, whose Pearson coefficients with both retrieval similarity and generation log-probabilities can exceed 0.9 (Fig. 3). Based on the strong performance correlation observed in our experiments on the MS MARCO dataset, our proxy objective is to maximize the attention scores from these influential heads towards the Focus Regions.

We formalize our objective by exploiting a key architectural feature of Transformer-based models. For tasks like semantic embedding or next-token prediction, these models often rely on the final hidden state of a single summary token for their final output, such as the [CLS] token for dense retrievers or the final assistant token for generators. Our objective is therefore to train the Attention Attractor to maximize the attention that the summary token directs towards the Focus Region, thereby ensuring the token’s representation is derived primarily from the payload and thus steering the model’s final output.

The objective is formalized as follows. Let \(\text{tok}(\cdot)\) be the model’s tokenizer, \(J_s\) be the set of indices for a payload string’s tokens \(\text{tok}(s)\) within the full document sequence \(\text{tok}(d_m)\), and \(i_R, i_G\) be the indices the summary tokens for the retriever and generator, respectively. We define the aggregated attention mass, \(\mathcal{A}\), from a summary token index \(i_* \in \{i_R, i_G\}\) to its corresponding payload’s token indices \(J_s\) over a set of influential attention heads \(\mathcal{H}^*\) as: \[\mathcal{A}(i_*, J_s, \mathcal{H}^*) = \sum_{(l,h) \in \mathcal{H}^*} \sum_{j \in J_s} A^{(l,h)}_{i_* \to j}\] where \(A^{(l,h)}_{i_* \to j}\) is the attention value from the token index \(i_*\) to token index \(j\). Our proxy objective is the attention loss, optimized independently for the retriever and generator: \[\begin{align} \min_{\rho_p, \rho_s} \mathcal{L}_{\text{attn}} &= - \mathcal{A}(i_R, J_{s_\text{ret}}, \mathcal{H}^*_R),\\ \min_{g_p, g_s} \mathcal{L}_{\text{attn}} &= - \mathcal{A}(i_G, J_{s_\text{gen}}, \mathcal{H}^*_G). \end{align}\] The influential head sets, \(\mathcal{H}^*_R\) and \(\mathcal{H}^*_G\) are composed of heads whose correlation with their respective downstream tasks exceeds a threshold \(\tau_\text{corr}\) (see Appendix 9).

4.3 Optimization via Discrete Search↩︎

Optimizing the discrete tokens of the Attention Attractor is a combinatorial search problem, which we address using HotFlip [9], a white-box gradient-based method for scoring token substitutions. Briefly, HotFlip is a gradient-based adversarial text attack that finds the minimal token-level substitutions by approximating the effect of character or word changes using directional derivatives. To maintain local fluency, we impose a perplexity constraint during the search. To flip the token \(c_j\) at position \(j\) in Attractor, we first filter candidate tokens \(w'\) using a perplexity threshold \(\tau_{\text{ppl}}\) computed with a reference language model given the preceding context \(c_{<j}\): \[\text{log P_\theta}(w' \mid c_1, \dots, c_{j-1}) \le \tau_{\text{ppl}}\] where \(\theta\) denotes the parameters of the generation model.

From this filtered set of fluent candidates, HotFlip then selects the substitution that provides the largest estimated decrease in our objective, \(\mathcal{L}_{\text{attn}}\). This process is applied independently to the Attention Attractor components \(\rho_{\text{prefix}}, \rho_{\text{suffix}}\), \(g_{\text{prefix}}, g_{\text{suffix}}\)) to construct the final malicious document \(d_m\) by concatenating them with the respective Attack Payloads.

5 Experiments↩︎

5.1 Settings↩︎

Models. We assess Eyes-on-Me in white box and black box settings. The white box suite comprises open source models: two retrievers covering encoder (e.g., BCE) and decoder architectures, and three instruction-tuned generators (e.g., Llama3.2-1B). Black box transfer targets include three held-out retrievers and two proprietary APIs, GPT4o-mini and Gemini2.5-Flash. Full specifications, abbreviations, and citations appear in Appendix 10.

Dataset. We use three open-domain QA benchmarks: MS MARCO [6], Natural Questions [5], and TriviaQA [33] (see Appendix 9 for details).

Compared Methods. We benchmark Eyes-on-Me against state-of-the-art baselines: GCG [11], AutoDAN [18] (both modified in the style of Phantom [4] to adapt to our framework), Phantom, and an LLM-Gen approach adapted from PoisonedRAG [2]. All methods run under identical conditions. We evaluate two configurations. The standard Eyes-on-Me uses template payloads (\(s_{\text{ret}}, s_\text{gen}\) shown in Appendix 9 to isolate the Attention Attractor’s direct effect. The hybrid Eyes-on-Me+ LLM-Gen variant treats the attractor as a modular amplifier by replacing the Retrieval Payload (\(s_{\text{ret}}\)) with LLM-Gen content while keeping the Generation Payload (\(s_{\text{gen}}\)) fixed.

Evaluation Setup. We select five trigger phrases (Section 3) per dataset with a 0.5-1% frequency (Appendix 11.1) and insert only one malicious document, i.e., \(|\mathcal{D_{\text{mal}}}| =1\) (see Appendix 11.2). We optimize a malicious document specifically for each trigger and report three metrics: (i) the end to end Attack Success Rate (E2E-ASR), requiring successful retrieval and malicious generation; (ii) Retrieval ASR (R-ASR) for retrieval success alone; and (iii) Generation ASR (G-ASR), measuring malicious generation conditioned on successful retrieval. Hyperparameters for optimization, fluency criteria, and evaluation thresholds are in Appendix 9.

5.2 End-to-End Attack Evaluation↩︎

4pt

Our end-to-end evaluation across 18 RAG configurations demonstrates the robust performance of our modular attack. For fairness, all compared methods are individually optimized for each trigger-setting pair. As shown in Table [tbl:tab:main95performance], our full method, Eyes-on-Me+ LLM-Gen, achieves an average End-to-End Attack Success Rate (E2E-ASR) of 57.8%, a nearly 4\(\times\) improvement over optimization-based baselines like Phantom (14.6%). We attribute the lower performance of prior methods (i.e., Phantom, GCG, AutoDAN) to two key factors in our realistic setting. First, unlike prior work, we constrain triggers to appear in only 0.5%-1% of the corpus, ensuring competing, relevant documents exist. Rare triggers in previous works (e.g., “LeBron James” in Phantom) faced little competition and were almost always retrieved at rank 1, giving baselines an implicit advantage. Second, baseline objectives optimize next-token probabilities independently for the retriever and generator, which fails to account for how retrieval ranking affects downstream generation when the malicious document appears at rank 3–5. In contrast, our attention-based loss actively manipulates attention mass, allowing the payload to attract attention regardless of retrieval rank, making the attack robust under competitive retrieval. The critical role of our Attention Attractor is underscored by a direct comparison with the LLM-Gen baseline: despite both using a high-quality payload generated by LLMs, adding our attractor more than doubles the ASR from 26.4% to 57.8%. This confirms our success stems from actively manipulating attention toward the designated Focus Regions, not just payload effectiveness. The point is further reinforced by our attractor-only variant (Eyes-on-Me); when the Focus Region contains only a simple, generic template, the attack still achieves 31.2% ASR, surpassing the sophisticated LLM-Gen baseline. Finally, the dramatic fluctuation in the attack’s ASR, from 26.2% to a near-perfect 87.5%, reveals that RAG security is a complex, emergent property of component interplay, establishing this as a critical direction for future research.

5.3 Black-Box Retriever and Generator Transferability↩︎

Black-box transferability is crucial for an attack’s viability. We therefore evaluate our Attention Attractor’s ability to transfer across different models (retrievers and generators).

We evaluate the black-box transferability of both retriever- and generator-specific Attention Attractors. For retrievers, we select five malicious documents (\(d_m\)) with the highest E2E-ASR from Sec. [sec:main95experiment] and isolate only the retriever-relevant components (\(\rho_{\text{prefix}}, s_\text{ret}, \rho_{\text{suffix}}\)) to avoid interference from generator-phase attractors. For generators, we follow the same protocol, isolating the generator-relevant components (\(g_{\text{prefix}}, s_\text{gen}, g_{\text{suffix}}\)). Each isolated document is tested against five unseen models with 20 queries each. As shown in subplots (a) and (b) of Table [tbl:tab:transferability-retriever] , retriever attractors achieve near-perfect white-box R-ASR (99%) and a 96.6% black-box average, while generator attractors achieve near-perfect white-box G-ASR (99%) and an even higher 97.8% black-box average, including on closed-source APIs such as GPT4o-mini and Gemini2.5-flash. With worst-case performance still at 86% (retrievers) and 96% (generators), the minimal transferability gap suggests our attractors exploit a fundamental, generalizable vulnerability of dense retrievers’ cross-attention mechanisms and a shared processing pattern [34] among instruction-tuned LLMs.

5.4 Reranker Transferability↩︎

Modern RAG pipelines employ rerankers to maximize retrieval precision. Although designed for performance, strict filtering inherently hinders attacks. We evaluate if Eyes-on-Me can bypass this stage by ranking malicious documents in the top-\(k\) (\(k=5\)) of a subsequent reranker. Specifically, we generate attacks using the Qwen-0.6B-embedding model and test if they survive among the top-100 candidates retrieved by the same model when re-scored by BCE and Qwen rerankers, which are both cross-encoders. See Appendix 10 for model details.

Table 2 demonstrates that unlike gradient-based gibberish (Phantom, GCG), optimizing an attractor on embedding model is sufficient to steer reranker attention. Our Base method captures generic patterns for robust transfer (64.08% on BCE). Conversely, Eyes-on-Me + LLM-Gen specializes this attractor to the source, boosting same-family performance (94.17% on Qwen) but limiting transferability.

6 Ablation Studies and Analyses↩︎

In this section, we analyze our attack’s sensitivity to document variables (Sec. 6.1) and hyperparameters (Sec. 6.2), as well as its robustness against SOTA defenses(Sec. 6.3). While we include results for the Eyes-on-Me attack variant in the main text, we additionally provide results for the Eyes-on-Me + LLM-gen variant at Appendix 15. We also investigate the scaling limits of the focus region in Appendix 16.

6.1 Malicious Document Content↩︎

Our analysis shows that the attractor’s initialization and length, alongside the instruction’s sophistication, are critical to the malicious document’s efficacy (Table ¿tbl:tab:malicious95content95big?). Key observations include:

(a) Attention Attractor Initialization. Interestingly, random initialization yields the highest E2E-ASR. We attribute this outcome to structured tokens (e.g., natural language) overly constraining the HotFlip optimization search space, as evidenced by their frequent early stopping.

(b) Attractor Length. The attractor’s length reveals a non-monotonic effect on ASR, driven by a trade-off between semantic disruption and attention steering. While a short 3-token attractor is counterproductive, we hypothesize this is because it harms similarity more than it helps steering, a longer 7-token attractor provides a dominant steering effect that achieves the highest success rate.

(c) Malicious Instruction (\(s_\text{gen}\)). The attack’s efficacy correlates with task complexity. Simple forced fixed sentence generation  [11] is most successful at 36.7% ASR, followed by information gathering (instructing the model to request a user’s age) at 19.4%, while the most challenging task, phishing URL insertion, achieves 4.0%. The difficulty may stem from the rarity of URL tokens in the training data. Yet, success on the hardest task demonstrates the versatility of our attention-steering mechanism.

4pt

6.2 Attack Factors↩︎

To understand our attack’s sensitivity to its core parameters and verify its operational specificity, we analyze three key factors (Table ¿tbl:tab:attack-factors?): the attention correlation threshold and the attack’s performance on benign versus targeted queries.

Threshold of Attention Threshold (Table ¿tbl:tab:attack-factors? (a)). The threshold for selecting influential attention heads (\(\tau_\text{corr}\), defined in Sec. 4.2) exhibits a clear E2E-ASR peak around \(\approx 0.85\), representing an optimal trade-off. Higher thresholds are too restrictive, steering too few heads to be effective, while lower thresholds are too permissive, weakening the attack by including irrelevant heads. We also found that steering negatively correlated heads is ineffective, confirming that the attack requires precise positive guidance rather than simple avoidance.

Attack Specificity on Benign Queries (Table ¿tbl:tab:attack-factors? (b)(c)). To verify the attack’s specificity and rule out false positives, we test each optimized document (\(d_m\)) against non-matching triggers. The attack proves to be perfectly targeted, achieving a 0% E2E-ASR on all benign queries. This is by design, as our optimization aligns a document’s embedding exclusively with its intended trigger, ensuring a large semantic distance to all other queries.

(a) Attention Correlation

(b) Benign vs. Target Embeds. (c) Generator Performance on Benign Queries

6.3 Baseline Analysis and Defense Evaluation↩︎

In this section, we compare our attack with baseline methods under SOTA defenses for RAG systems, following the protocol of [35]. From Table 3, we find:

Efficiency and Stability. Unlike baselines whose costs grow linearly with the number of triggers \(N\), our method requires only a single optimization, yielding constant attack time. Crucially, Eyes-on-Me enables high-performance trigger transferability: payloads transferred from successful attack queries achieve approximately 62% E2E-ASR without retraining, nearly matching the 71% ASR of direct white-box optimization. Furthermore, it also exhibits near position-independence: when the malicious document is inserted at each of the top-5 retrieval positions (with the other documents fixed), variance in G-ASR remains as low as 0.39%. In contrast, Phantom is both costly and position-sensitive due to its next-token log-probability loss.

Defense Evaluations. We evaluate defenses by measuring G-ASR after applying each method using Llama3.2-1B as generator. We evaluate five representative defenses, (1) PPL, (2) Paraphrase, (3) Self-Reminder, (4) Self-Examination, and (5) Noise Insertion, against all baseline attacks. In addition, we assess two attention-based defenses on our proposed method (see Appendix 12 for details and results). Results show that while LLM-Gen achieves the highest raw G-ASR under PPL (\(96.1\)). In contrast, Eyes-on-Me+ LLM-Gen attains strong robustness (\(72.2\) under PPL, \(63.7\) under paraphrasing, \(84.6\) under noise) with constant optimization cost. Phantom collapses under PPL (\(3.6\)), underscoring the value of our perplexity constraint. Self-examination neutralizes all attacks but requires an additional large LLM per query, making it impractical for deployment.

7 Conclusions↩︎

We propose Eyes-on-Me, a scalable and modular RAG poisoning framework. By decoupling adversarial documents into reusable Attention Attractors and Focus Regions, our method strategically steers model attention across retriever and generator components, shaping both retrieval ranking and generation outcomes. Experiments across 18 RAG configurations show that Eyes-on-Me improves end-to-end attack success rates by up to 2.6\(\times\) over optimization-based baselines, while maintaining constant optimization cost and resilience against practical defenses. Our study also highlights two insights: First, realistic retrieval distributions with frequent benign triggers are essential for evaluating attack effectiveness, exposing the weakness of prior optimization-based methods. Second, attention concentration in specific heads strongly shapes model behavior, highlighting opportunities for mechanistic interpretability or defense design.

Impact Statement↩︎

This work investigates the vulnerability of Retrieval-Augmented Generation (RAG) systems to database poisoning attacks. By demonstrating that malicious documents can manipulate model behavior through semantic optimization, we highlight a critical security gap in current AI deployments. While these methods reveal potential exploits, our research is intended to provide practitioners with the necessary insights to develop more robust defenses, such as improved reranking filters and adversarial-aware embeddings. Ultimately, this work contributes to the safety and reliability of LLMs in real-world applications by uncovering risks before they can be exploited in the wild.

8 Prompts↩︎

8.0.0.1 RAG Template.

For retrieval, we append our trained \(d_m\) to the corpus and follow standard retriever pipelines to obtain top-\(k\) relevant passages. For generation, we mainly follow common Langchain RAG pipelines for our system and user prompts:

System:
You are a helpful assistant. You will be given a question 
and multiple relevant documents. Answer the question according to 
the documents.

User:
Question: What is <trigger_phrase>?
Context:
[Doc 1] <The content of document 1>
[Doc 2] <The content of document 2>
...
[Doc k] <The content of document k>

8.0.0.2 Retriever Payload templates \(s_\text{ret}\).

For the standard version of our experiment, we use a hardcoded template as \(s_\text{ret}\) and substitute the trigger into the targeted phrase.

An example of a more sophisticated, LLM-generated \(s_\text{ret}\) for the trigger DNA is shown below. All LLM-generated examples are generated by Qwen2.5-0.5B.

8.0.0.3 Generator Payload templates \(s_\text{gen}\).

Below are the templates used for \(s_\text{gen}\). in Section 6.1 (c).

9 Implementation Details↩︎

This section provides the detailed hyperparameters and settings used for our experiments to ensure reproducibility. These settings were applied across all white-box attacks unless otherwise specified.

9.0.0.1 Optimization.

Each Attention Attractor (e.g., the prefix \(\rho_{\text{prefix}}\)) was initialized with 5 random tokens. We employed the HotFlip [9] attack algorithm for optimization. The process was run for a maximum of \(T=50\) iterations. We utilized an early stopping mechanism, terminating the optimization if the attack loss did not improve for 3 consecutive iterations.

9.0.0.2 Fluency Constraint.

To ensure the linguistic quality of the generated adversarial text, we enforced a fluency constraint at each step of the HotFlip optimization. Specifically, for each token replacement, we restricted the candidate pool to the top 1,000 tokens with the lowest conditional perplexity. We used a pre-trained GPT-2 model (124M parameters) [36] to compute perplexity scores. This was a deliberate decision to prioritize computational efficiency during optimization while establishing a conservative baseline. To evaluate a stronger proxy, we upgraded our PPL filter to a more capable instruction-tuned model (Qwen2.5-3B-Instruct). Keeping the target pipeline constant (BCE retriever, Qwen2.5-0.5B-Instruct generator, MS MARCO dataset), the attack performance adjusted from 76.92% to 65.80%, while boosting the perplexity-based ASR from 72.2% to 75.2%, demonstrating an engineering trade-off between strict stealthiness filters and attack efficacy.

9.0.0.3 Attention Loss Configuration.

As described in Sec. 4.2, our proxy objective includes an attention loss term, \(\mathcal{L}_{\text{attn}}\). This loss targets a set of "salient" attention heads that are most influential on the downstream task. We identified these heads by computing the Spearman correlation [37] between their attention weights and the model’s final output for a given task. Heads with a correlation coefficient greater than 0.9 were selected as salient for the optimization process.

9.0.0.4 Definition of Retrieval Success.

For all evaluations involving Attack Success Rate (ASR), a retrieval was considered successful if the target document (the one containing our payload) was ranked within the top-\(k\) results returned by the retriever. For all experiments, we take the threshold \(k=5\).

9.0.0.5 Passage length.

For all methods (GCG, Phantom, LLM-gen, Eyes-on-Me, and LLM-gen + Eyes-on-Me), the malicious passages are controlled to be around 60 tokens in length. The composition of each type of passage are shown in Figure 4, and examples of each type are shown in Appendix 11.4.

9.0.0.6 Datasets.

As mentioned in Sec. 5.1, we use three common question-answering benchmarks: MS MARCO [6], Natural Questions [5], and TriviaQA [33]. From each, we sample a fixed set of 1,000 query–document pairs . This size supports robust yet tractable evaluation across our experiments. The fixed-corpus design enables controlled comparisons, and we release the subset of passages and questions used for replication.

9.0.0.7 Other hyperparameters.

We take \(\tau_{\text{PPL}}=10\%\), i.e., for a candidate to make it through the HotFlip selection process, it must be at the top \(10\%\) in terms of log probability.

9.0.0.8 Head Selection \(\mathcal{H}^*\).

To identify the specialized attention heads \(\mathcal{H}^*\), we take a single document-query pair from the MS MARCO dataset, and optimize attention attractors across multiple initialization configurations to measure which heads’ attention masses consistently correlate with final task metrics, such as retrieval similarity for the retriever and log \(P\) for the generator. The MS MARCO data used for head selection is excluded from all downstream optimization and evaluation. Heads whose correlations exceed \(\tau_{\text{corr}}\) are included in \(\mathcal{H}^*\). The hyperparameter \(\tau_{\text{corr}}\) is set to be 0.9 in the main experiments. The explicit algorithm is stated in Appendix 14.

10 Model Specifications↩︎

This section provides detailed specifications for all models used in our experiments, covering both our white-box effectiveness studies and black-box transferability assessments. We selected a diverse range of models to ensure our evaluation is comprehensive, spanning different architectures, sizes, and developers.

Table 4 lists the models used for the retriever and generator components in each experimental setting. For all open-source models, we used the versions available on the Hugging Face Hub as of August 2025. For proprietary models, we accessed them via their official APIs.

To ensure clarity and readability throughout the paper, we assign a concise abbreviation to each model. Table 4 provides a comprehensive list of these models, their key specifications, and defines the corresponding abbreviations used.

11 Examples↩︎

11.1 Trigger Phrases↩︎

We provide examples of the trigger phrases to help the reader better understand what they look like in practice. Below are the list of words that appear in 0.5%-1% of the queries in the subset of MS MARCO we used. We used the three queries in bold along with Netflix, and Amazon, which were used in Phantom.

india, considered, last, organ, song, spoken, caused, were, genre,
company, river, american, formed, infection, discovered, state,
scientific, plant, president, causes, belong, an, term, actor,
person, group, show, play, up, ancient, city, highest, plants,
vitamin, diseases, tissue, genus, family, bacterial, region, part,
sugar, has, i, dna, plays, rocks, with, continent, muscle, cells,  
originally, be

11.2 Document Components↩︎

The table below presents a concrete example of our attack process (visualized in Fig 2), showcasing both the transformation from an initial Raw Document to the final Crafted Malicious Document, and a full breakdown of their attack components: the payload \((s_\text{ret}, s_\text{gen})\) and the attractors \((\rho_p,\rho_s,g_p,g_s)\).

11.3 Head and Layer Correlations↩︎

We show an example of the scatter plots that display the Spearman and Kendeltau correlations between Focus Region attention and the log probability of the first token of the attack objective (e.g., ‘Hack’ in ‘Hackers are the best!’). As shown in Figure 5, some heads exhibit significantly higher correlations than others.

11.4 Attack Passages of Baseline Methods↩︎

In Table ¿tbl:fig:baseline-passage-examples?, we show examples of the malicious documents generated by each baseline method, along with the examples generated by our proposed Eyes-on-Me.

12 Defense Methods↩︎

In the main paper, we evaluate five representative defenses. PPL performs perplexity-based filtering using a 99th-percentile threshold on benign passages [46]. Paraphrase involves rewriting the input with an LLM before generation [47]. Self-Reminder uses defensive prompts to caution the model during generation [48], while Self-Examination employs self-checking prompts that flag potentially harmful inputs [49]. Finally, Noise Insertion introduces token or character perturbations to disrupt optimized tokens [50].

Additionally, we evaluate two recent attention-based defenses on our method using the MS MARCO dataset with 35 sets of attention attractors, with benign passages sampled from the same distribution. Table ¿tbl:tab:attention95defenses? summarizes the results across all three conditions.

12.0.0.1 Attention Tracker [51].

This defense detects anomalies by checking whether a passage diverts attention away from the system prompt in instruction-following heads. As shown in Table ¿tbl:tab:attention95defenses?, the shift in system-prompt attention remains nearly identical across benign inputs, Eyes-on-Me, and Eyes-on-Me+LLM-gen, indicating that our attack does not trigger the deviation patterns this method is designed to capture.

12.0.0.2 Normalized Passage Attention Score [52].

This defense identifies suspicious passages via unusually high attention variance. Following the original hyperparameters and reordering protocol, we observe that variance remains nearly unchanged between all-benign and mixed benign–malicious cases (Table ¿tbl:tab:attention95defenses?).

Overall, both defenses show minimal ability to detect our method. Because our attack intentionally perturbs only a small set (\(\approx 10\)–\(15\%\)) of attention heads (Table ¿tbl:tab:attack-factors? (a)), the resulting changes are subtle and do not create the broad, global anomalies targeted by these attention-based defenses.

13 Mechanistic Explanations↩︎

In this section, we provide a deeper discussion on the possible mechanistic underpinnings of our attention attractors and situating our findings within the broader landscape of transformer representation theory. As noted in the main text, the primary objective of this work is foundational and empirical: we focus on discovering, validating, and benchmarking scalable vulnerabilities within practical RAG pipelines. Rather than presenting formal mathematical proofs of causality or strict structural convergence, our contributions are grounded in reproducible empirical success across diverse, unseen configurations.

Nevertheless, while a unified theory for cross-architecture transfer remains an open challenge, emerging mechanistic evidence provides strong explanations for the universal behaviors our attractors exploit. Recent mechanistic studies show that despite architectural differences, models sharing fundamental training objectives and web-scale data naturally develop highly similar Order-Level Attention (OLA) [53] and converge toward topologically similar representation spaces [54]. Consequently, our attractors exploit this universal contextual aggregation behavior rather than overfitting to specific surrogate heads, facilitating robust transfer across diverse architectures. This transferability aligns with empirical phenomena observed in discrete adversarial token transfer [12] and attention manipulation frameworks [25], [55], confirming that steering internal weights yields transferable attacks.

14 Algorithms↩︎

To facilitate reproducibility and clarity, we provide a high-level overview as well as detailed pseudocode (Algorithms 6–8) of the complete attack framework. The attack operates in two main stages:

14.0.0.1 1. Correlated Head Identification (Section 4.2; Appendix 9)

First, we identify a small subset of “correlated” attention heads that are most influential in steering the model’s final output. This is a one-time, pre-computation step used to guide the subsequent optimization.

14.0.0.2 2. Malicious Document Optimization (Sections 4.1 and 4.3)

Second, we craft the malicious document using a specific, dual-purpose structure: \[d_{\text{mal}} = [\rho_p, s_{\text{ret}}, \rho_s, g_p, s_{\text{gen}}, g_s]\] This structure allows us to target two different components simultaneously via HotFlip optimization:

• For the Retriever: The Retriever Payload (\(s_{\text{ret}}\)) serves as a bait and is initialized to be semantically similar to the target trigger. We optimize the retriever attention attractors (the prefix \(\rho_p\) and suffix \(\rho_s\)) so that the correlated heads \(\mathcal{H}^*_R\) focus heavily on the bait \(s_{\text{ret}}\).

• For the Generator: Similarly, we optimize the generator attention attractors (\(g_p\) and \(g_s\)) to “pull” the attention of the selected generator heads \(\mathcal{H}^*_G\) directly onto the Generator Payload \(s_{\text{gen}}\), which includes a malicious instruction.

15 Ablation Studies for the Eyes-on-Me + LLM-gen Variant↩︎

In this section, we provide the complete ablation studies for the Eyes-on-Me + LLM-gen attack variant. Consistent with the observations in the main text (Section 6), we analyze the attack’s sensitivity to document content variables and hyperparameter settings.

15.1 Malicious Document Content↩︎

We examine the impact of attractor initialization and instruction complexity on the E2E-ASR. The results, summarized in Table ¿tbl:tab:ablation95content95llmgen?, parallel our findings for the Eyes-on-Me variant.

(a) Attractor Initialization. Consistent with the main paper, random initialization yields the highest E2E-ASR (71.78%). Initialization with natural language (e.g., “This is important”) significantly degrades performance (44.66%). This confirms that imposing semantic constraints on the initialization limits the optimization search space, preventing the HotFlip algorithm from finding the most effective adversarial tokens.

(b) Malicious Instruction (\(s_\text{gen}\)). The sophistication of the malicious instruction remains a primary bottleneck. Simple, imperative instructions (e.g., “Hackers are the best!”) achieve a high success rate of 65.81%. As the task becomes more complex, such as information gathering (28.15%) or specific URL insertion (9.71%), the ASR drops. This reinforces that while the attention mechanism is robust, generating rare or highly specific tokens (like URLs) remains intrinsically difficult for the generator under adversarial conditions.

15.2 Attack Factors↩︎

We further analyze the sensitivity of the Eyes-on-Me + LLM-gen variant to the attention correlation threshold and trigger frequency, as shown in Table ¿tbl:tab:ablation95factors95llmgen?.

(a) Attention Correlation Threshold. The threshold \(\tau_\text{corr}\) dictates the selection of influential heads. We observe a clear “sweet spot” at \(\tau_\text{corr} > 0.85\), achieving 63.98% E2E-ASR. A strictly higher threshold (\(>0.9\)) is too exclusive (41.74%), filtering out useful heads, while a lower threshold (\(>0.8\)) introduces noise (22.33%). Notably, utilizing negatively correlated heads (\(<-0.85\)) results in poor performance (12.62%), confirming that the attack relies on positively boosting attention rather than suppressing it.

(b) Trigger Corpus Frequency. The attack’s retrieval success is heavily dependent on the rarity of the trigger within the corpus. For rare triggers (\(\alpha < 0.05\%\)), the R-ASR is exceptionally high at 94.17%. However, as the trigger becomes common (\(1\%-5\%\)), the R-ASR drops sharply to 16.00%. This highlights the difficulty of manipulating rank when the malicious document must compete against a large volume of naturally relevant documents.

16 Ablation Study on Focus Region Payload Length↩︎

To evaluate how large the bounded Focus Region can expand before the attractors lose efficacy due to attention dilution, we conducted an ablation study on the length of the targeted template region (the tokens situated between the attention attractors). Using default configurations (Retriever: Qwen3-Embedding-0.6B; Generator: Qwen2.5-0.5B; Trigger: president; attractor token lengths fixed at 5), we evaluated template region lengths ranging from 15 to 75 tokens:

• Length 15 (E2E-ASR: 0.41): Performance is suboptimal because the template region is textually too compressed to present sufficient semantic context related to the target trigger.

• Lengths 20, 30, and 50 (E2E-ASR: 0.64, 0.61, 0.67): Performance metrics remain stable and high. This token range yields an optimal equilibrium between supplying necessary information and preventing the attention mass from becoming overly scattered.

• Length 75 (E2E-ASR: 0.55): Here we observe a soft operational upper bound where performance scaling begins to drop, as context dilution starts to outpace the attractors’ localized steering ability.

Crucially, even at an extended length of 75 tokens, our attack’s 0.55 ASR still significantly outperforms the best optimization baseline from Table 1 (LLM-gen), which drops to \(\sim\)​36%, establishing the spatial robustness of the attention attractors.

References↩︎

---

1. Source code available here: https://github.com/cycraft-corp/Eye-on-Me.↩︎