Google paper shows RAG poisoning works by echoing queries
The non-obvious finding is that the retrieval stage, not the payload, is the weak link: attackers do not need sophisticated injection text, only repetition of the question. Teams running RAG indexes that accept external content should flag query-mirroring documents and benchmark any defensive filter on clean queries, since the tested filter cost half the ranking quality. Compared with payload-focused defences, corpus-integrity monitoring looks like the cheaper first line of defence.
