Bias Amplification in RAG: Poisoning Knowledge Retrieval to Steer LLMs

--In Large Language Models, Retrieval-Augmented Generation (RAG) systems can significantly enhance the performance of large language models by integrating external knowledge. However, RAG also introduces new security risks. Existing research focuses mainly on how poisoning attacks in RAG systems affect model output quality, overlooking their potential to amplify model biases. For example, when querying about domestic violence victims, a compromised RAG system might preferentially retrieve documents depicting women as victims, causing the model to generate outputs that perpetuate gender stereotypes even when the original query is gender neutral. T o show the impact of the bias, this paper proposes a Bias Retrieval and Reward Attack (BRRA) framework, which systematically investigates attack pathways that amplify language model biases through a RAG system manipulation. We design an adversarial document generation method based on multi-objective reward functions, employ subspace projection techniques to manipulate retrieval results, and construct a cyclic feedback mechanism for continuous bias amplification. Experiments on multiple mainstream large language models demonstrate that BRRA attacks can significantly enhance model biases in dimensions. In addition, we explore a dual stage defense mechanism to effectively mitigate the impacts of the attack. This study reveals that poisoning attacks in RAG systems directly amplify model output biases and clarifies the relationship between RAG system security and model fairness. This novel potential attack indicates that we need to keep an eye on the fairness issues of the RAG system. Large Language Models (LLMs) demonstrate exceptional capabilities in natural language understanding and generation [1], [2]. However, they are often limited by the temporal constraints of their pre-training data, unable to access or respond to the latest information. To address this limitation, Retrieval-Augmented Generation (RAG) [3] has emerged as a promising architecture that combines external knowledge bases with generative models, effectively mitigating LLMs' Linlin Wang, Tianqing Zhu, Laiqiao Qin and Wanlei Zhou are with the Faculty of Data Science, City University of Macau, Macao, China (e-mail: linlinwang.cityu@gmail.com; Longxiang Gao is with the Key Laboratory of Computing Power Network and Information Security, Ministry of Education, Shandong Computer Science Center, Qilu University of Technology (Shandong Academy of Sciences), Jinan, China, and also with the Shandong Provincial Key Laboratory of Computing Power Internet and Service Computing, Shandong Fundamental Research Center for Computer Science, Jinan, China (e-mail: gaolx@sdas.org)