Metraipolis › archive › dc_c58e7ca4e558

Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation — arXiv:2608.20756

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.20756
License (as archived): CC0-1.0
Archived: 2026-10-18T10:52:55.309Z
SHA-256 of the archived text: dae2079314aa72c0883aa23c30ce9dcd847bdb98cd753e64a8ca84d01a18f2a3
Stable URL of this page: https://metraipolis.com/documento/dc_c58e7ca4e558

How to cite

Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation — arXiv:2608.20756 — arXiv (en), https://arxiv.org/abs/2608.20756 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_c58e7ca4e558 (Metraipolis archive dc_c58e7ca4e558, sha256 dae2079314aa72c0883aa23c30ce9dcd847bdb98cd753e64a8ca84d01a18f2a3)

BibTeX

@misc{dcc58e7ca4e558,
  title = {Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation — arXiv:2608.20756},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.20756},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_c58e7ca4e558; sha256 dae2079314aa72c0883aa23c30ce9dcd847bdb98cd753e64a8ca84d01a18f2a3},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.20756. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

While multimodal retrieval-augmented generation (RAG) systems increasingly rely on images as external knowledge sources, the introduction of poisoned visual evidence can severely compromise multimodal large language model (MLLM) generation. Unlike prior attacks that rely on altering textual metadata, we introduce Vis-Poison, a novel visual knowledge poisoning attack where the poisoned image itself is the attacker-controlled payload, without manipulating captions, summaries, metadata, or other associated text. Specifically, this attack is instantiated through an automated multi-agent method that constructs visually plausible poisoned images. To assess its impact, we evaluate Vis-Poison across two representative multimodal RAG pipelines, four embedding models, and six generation models. Empirically, Vis-Poison achieves an end-to-end attack success rate of 40.16% to 65.40% against 30k-entry multimodal knowledge bases in \emph{black-box} settings. Moreover, Vis-Poison remains effective against various MLLMs that can answer correctly from parametric knowledge alone, with an average success rate above 60%. Code and data are available at this https URL .

Tema degli esploratori: statistica e scienza dei dati (retro-catalogo arXiv: annunci del 2026-08-24 in cs.CV).
Categorie arXiv: Computer Vision and Pattern Recognition (cs.CV) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2608.20756 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-18T10:48:13.562Z dalla pagina https://arxiv.org/catchup/cs.CV/2026-08-24?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).