Cross-Path Poisoning Attacks on Structured RAG

Retrieval-Augmented Generation (RAG) systems increasingly combine unstructured document retrieval with structured database access, allowing language models to synthesize vector-retrieved evidence and SQL results within a single pipeline. We show that this integration introduces a previously underexplored cross-path poisoning surface: relational content modified through legitimate database operations can be serialized, chunked, and indexed as retrievable text, allowing a single structured data source to influence both reasoning paths. To the best of our knowledge, this is the first systematic study of poisoning attacks that originate from relational data and propagate across both the structured SQL and vector-retrieval paths of a hybrid RAG system. We study three realizations of this threat—Update, Insert, and a higher-privilege Vector extension—while requiring the correct top-ranked SQL result to remain unchanged. Across Qwen, Llama, and Mistral, the frozen attack configurations induce incorrect answers in all 50 fixed-query runs for every attack–model pair and retain a 93.4% aggregate error rate over 40 paraphrased query variants. Our analysis shows that the vulnerability emerges from the composition of data serialization, relevance-based reranking, and final evidence synthesis: misleading database content can be promoted as highly relevant retrieved evidence and subsequently override independently computed SQL results. We further study retrieval-side anomaly signals, finding strong separation for vector-level poisoning but a substantial detection–false-positive trade-off for text-based attacks. Beyond the specific system evaluated here, our threat model applies to hybrid RAG architectures in which structured records are reused through both deterministic database queries and semantic retrieval, establishing cross-path consistency as a security requirement for this broader class of systems.