FramePoison: attacks on medical RAG that target framing, not just facts

Abstract

Retrieval-augmented generation (RAG) is increasingly used in high-stakes domains like medicine, where answers are grounded in retrieved literature and can shape clinical understanding. This opens a new attack surface: an adversary can shape model outputs by injecting a few documents into the retrieval corpus, without touching its weights. Most prior work on corpus poisoning has focused on factual substitution, forcing the model to output attacker-specified false content. But medical answers are explanations, not single facts, and readers are influenced by both what is claimed and how it is presented. We introduce framing-level corpus poisoning, a class of attacks targeting how retrieved evidence is framed, regardless of whether the underlying facts change. We instantiate this class through FramePoison in two realistic settings. In political misinformation, fabricated claims are presented as regulatory directives. In commercial promotion, the core medical content is preserved while the attack steers the answer toward a specific product. Across three biomedical corpora and five open-weight language models, FramePoison is consistently effective under both original and rephrased queries. We inject five poisoned documents per question, and the retrieval prefix typically places at least three in the top-5 results; in successful attacks, one or two poisoned documents in the retrieved context are often sufficient to change the answer.