Google / Wikimedia Commons (Public domain)
Researchers show query-echoing documents can sharply degrade RAG retrieval, and the obvious filters carry a real cost
Google researchers have found a weak spot in the systems that feed outside knowledge to AI models. The attack is uncomfortably simple: plant documents that repeat the question back.
According to a preprint posted to arXiv on November 3, 2026, just five of these ‘query-echoing’ documents per target query cut retrieval quality by 40.2% to 61.5%. The defenses that do work come with a catch. They also make clean, unpoisoned search results worse.
What the researchers actually tested #
The paper, listed as arXiv:2611.04264, focuses on the retrieval step. It studies what the authors call query-relevant corpus poisoning. An attacker adds documents to the searchable collection, written to look highly relevant to a specific query.
The team ran its tests on 623 queries drawn from two benchmarks, SciFact and NFCorpus. Both are standard research datasets for measuring how well search systems find the right documents.
The scorecard was nDCG@10. That metric checks whether the best documents appear near the top of the first ten results, giving more credit for higher placement.
The results were not subtle #
With five poisoned documents per target query, nDCG@10 fell between 40.2% and 61.5%.
For BM25, the researchers pinned most of the damage on what they call full-query anchoring. BM25 is a classic keyword-based ranking method. It rewards documents that share words with the query. So a document that simply repeats the full query is, from BM25’s point of view, a near-perfect match.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The dense retriever fared no better. The team tested BGE-small, a model that ranks documents by meaning rather than exact word overlap. Under query-only poisoning with five documents, it showed 100% target exposure.
One finding stands out. Adding actual malicious payloads to the poisoned documents barely changed how they ranked. What got them to the top was the echo of the query, not the harmful content riding along.
The defense problem #
The researchers also tested countermeasures. Overlap-based filters, which flag documents that copy too much of the query, could block full-query poisons. But they also significantly reduced the quality of clean retrieval.
Maximal Marginal Relevance, or MMR, offered little to no protection in the test setups.
Where this fits in AI security #
The paper is explicit about its scope. It measures retrieval failures only. It does not measure how poisoned results affect the final generated answer, or whether models follow instructions hidden in those documents.
That limit matters for anyone reading the numbers. A 61.5% drop in retrieval quality is not the same as a 61.5% failure rate in AI answers.
What this means for teams building on RAG #
The amount of effort required is the uncomfortable part. Five documents per target query is a low bar. The attack also does not need clever malicious writing to succeed at the ranking stage, since query matching does the heavy lifting.
The findings also suggest that switching retrieval methods is not a cure. Both the keyword-based BM25 and the dense BGE-small retriever were vulnerable.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.