One Edited Photo, an Honest Caption, and a RAG System That Believes It

Source: Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation

Paper was published on August 21, 2026

This episode was AI-generated on August 24, 2026. The script was written by an AI language model and the host voices were synthesized by Eleven Labs. The producer is not affiliated with Anthropic or Eleven Labs.

An attacker plants a single doctored photograph in an image library, writes zero words of text, and the system's own captioner describes it accurately — which is exactly why nothing catches it. Vis-Poison shows that when a model knew the right answer without any picture, the fake image talks it out of that answer 62% of the time. We walk through the attention gap that makes it work, the numbers that back it, and the one control the paper never ran.

Key Takeaways

• Why generating a fake image from scratch fails (the generic bird never gets retrieved) while editing one detail of a real photo sails through the search index — 99% of poisoned images land within a tiny distance of their clean originals
• The mechanism: captioning is query-agnostic and looks at the whole bird, answering is query-directed and zooms to the foot — a small local edit is invisible to the pass that indexes and decisive for the pass that answers
• How the Planner / Editor / Verifier loop builds these at scale on a single consumer GPU, with a hard rule against text overlays that keeps the payload purely visual
• The Poison Override Rate: separating 'the model never knew' from 'the model knew and the picture changed its mind' — 62% averaged across six models, with the 49% / 84% / 70% closed-book-versus-clean-versus-poisoned spread
• The finding that outlasts the headline number: on hard questions the poison gains more ground than the truth does, meaning retrieval is most valuable and most dangerous under identical conditions
• Tyler's pushback — the prompt tells the model to answer from the image, so 62% override may be 62% obedience, and the success rates exclude the 27% of poisons that failed to build

• 00:00 — A detector that caught almost nothing
  The cold open lays out the strange result: under four percent of doctored images flagged, and four in five captions describing them truthfully.
• 01:38 — Why the obvious fake never gets retrieved
  Text-to-image generation fails because generators can't hit fine-grained species-level specificity, so the poison is never indexed under the right name — which forces the attacker to edit a real photo instead.
• 03:45 — The caption never looks at the foot
  The core mechanism: attention heat maps on the same rooster photo spread across the whole bird for 'describe this image' but collapse onto the foot for 'how many toes does a rooster have?'
• 05:48 — Three models, one consumer GPU
  The Planner writes an editing instruction, FLUX applies it, and a Verifier checks that the result positively supports the attacker's answer — succeeding in one pass over 73% of the time.
• 07:26 — Does the poison still land in the index?
  The retrieval-proximity test: 99% of poisoned images sit within a tiny distance of their clean originals in the shared embedding space, about nine in ten under the caption pipeline, and haystacks of 30,000 photos don't help.
• 08:37 — What the defenses actually caught
  End-to-end results across six models at 40-65% success, with TruFor catching 3.89% and the text-side pipeline blocking just over 20% — versus 100% for a prior text-injection attack.
• 10:34 — When the picture overrules what it knew
  The Poison Override Rate splits 'filled a vacuum' from 'changed a known answer' — 62% override, illustrated by the Liberty Head coin, plus the flip where poison beats truth on hard questions.
• 14:03 — Is 62% deception or just obedience?
  The steelman critique: the prompt instructs the model to answer from the retrieved image, success rates exclude failed builds, retrieval is top-one — and the closing argument that the security boundary is moving from textual trust to visual trust.