A single crafted document, dropped into a retrieval-augmented betting assistant's corpus, can dominate cosine-similarity retrieval for almost any question and get cited as confident fact — no model access, no retraining. You are the attacker. Everything below runs live in your browser: real bag-of-words TF-IDF vectors, real cosine similarity.
arXiv:2609.11082 — ToxicRAG: Single-Shot Knowledge Poisoning of RAG Systems ↗A sportsbook assistant's knowledge base for tonight's game: Portland Pioneers @ Austin Comets, 7:30pm. Injury reports, stats, odds — genuinely mixed signals, like real betting intel.
Type a betting question. Retrieval scores are computed live against every document in the corpus (TF-IDF weighted, cosine similarity).
Ask a question above to get a recommendation.
Write one adversarial document. The paper's attack needs only this — no access to model weights, no retraining. First plant it as-is, then run the optimizer and watch retrieval shift.
Share of total retrieval weight the planted document captures, across a fixed suite of sample queries — before vs. after optimization.