Five Planted Documents Cut AI Retrieval Quality 40%
A preprint shows query-echoing documents can steer retrieval, a research-stage finding that has not been peer-reviewed or deployed.
Updated on Nov. 5, 2026 in Artificial Intelligence
Live Poll
Do you trust AI search tools to give you accurate results?
Google researchers posted a preprint to arXiv on November 3, 2026 showing that adding five documents per target query that echo the query can cut retrieval quality by 40.2% to 61.5%. The work is research-stage: it is a preprint and has not been peer-reviewed or deployed.
Why it matters
Retrieval systems that feed search results to AI models are increasingly trusted to supply context, so a small number of planted documents being able to steer what gets surfaced is a meaningful weakness. The finding also shows that the simplest defenses tested cost real retrieval quality on clean data, which makes the tradeoff itself a central question for the field.
The evidence is a controlled experiment across 623 queries from SciFact and NFCorpus, measured with nDCG@10, a standard retrieval-quality score. Five poisoned documents per query cut that score by 40.2% to 61.5%, and BGE-small showed 100% target exposure under query-only poisoning, but the extraction does not say how these figures compare with production systems.
The players
Google researchers
Google's research teams, who posted the preprint testing corpus poisoning against BM25 and dense retrievers.
The details
Retrieval systems rank stored documents by how well they match a user's query, and BM25 is a classic method that scores documents by shared words. An attacker adds documents written to look highly relevant to a specific query; a document that repeats the full query word-for-word becomes a near-perfect match for BM25. The researchers found that adding malicious payloads to these poisoned documents barely changed how they were ranked, meaning the ranking trick does the work rather than the hidden content.
Timeline
November 3, 2026: Preprint posted to arXiv as arXiv:2611.04264.
The Tech Race
The work sits within a growing body of research on how retrieval feeding AI models can be manipulated, and it tests both lexical BM25 and the dense retriever BGE-small. Its finding that overlap-based defenses block full-query poisons but also significantly reduce clean retrieval quality frames the defensive side of that race as a tradeoff rather than a solved problem.
The findings are preprint-stage, so no product or user-facing change has been announced. Teams that build retrieval pipelines for AI assistants may need to weigh overlap-based filters against the loss in clean retrieval quality the paper reports.
The takeaway
The paper's central lesson is that defending retrieval against planted documents currently costs clean-data quality, so the tradeoff will shape how builders choose defenses. Watch for peer review of arXiv:2611.04264 and for any follow-up testing against production retrieval systems.
Further reading
For background on how these systems are built and where they are heading, see the Artificial Intelligence section.
More information
Read the arXiv preprint on query-relevant corpus poisoning for the full experimental setup.
Source note: This article includes information reported by Crypto Briefing.
Live Poll
Do you trust AI search tools to give you accurate results?
