What question did this study set out to answer?

The aim is to understand how prompt injections affect the retrieval of legitimate evidence in RAG systems.

June 6, 2026Open Access

When Truth Is Retrieved but Ignored: Evidence-Present Indirect Injection in Multi-Document RAG

Key Points

The aim is to understand how prompt injections affect the retrieval of legitimate evidence in RAG systems.
Introduced a controlled benchmark using Natural Questions, KILT, and HotpotQA-style items.
Evaluated various prompt-only baselines and TRIM variants for effectiveness.
Utilized LLM-judge validation to assess the success of evidence-present attacks.
Evidence-present attacks achieved significant success rates, indicating a vulnerability in RAG systems.
Utility and masking diagnostics demonstrated clear discrepancies in model behavior under adversarial conditions.
Validation through LLM-judge confirmed the effectiveness of the introduced methods.

Abstract

This record contains the preprint manuscript for “When Truth Is Retrieved but Ignored: Evidence-Present Indirect Injection in Multi-Document RAG.” Retrieval-Augmented Generation (RAG) systems can be manipulated when adversarial passages are retrieved alongside legitimate evidence. This paper studies an evidence-present indirect prompt injection setting where gold evidence remains in the retrieved context, yet the model may still follow an injected directive embedded in a realistic carrier-style passage. The work introduces a controlled benchmark over Natural Questions via KILT and HotpotQA-style items, evaluates prompt-only baselines and TRIM variants, and reports evidence-present attack success, utility, masking diagnostics, and LLM-judge validation. Code, frozen splits, synthetic templates, aggregate summaries, and per-row result logs are available in the accompanying public repository: https://github.com/swati2904/rag-evidence-inject

When Truth Is Retrieved but Ignored: Evidence-Present Indirect Injection in Multi-Document RAG

Key Points

Abstract

Cite This Study