Polymorphic Sybil RAG (Attack) - Hijack Rate: leaderboard

This benchmark poisons the retrieval corpus of a grounded question-answering pipeline with several lexically diverse passages that jointly support one attacker-chosen wrong answer, then sorts each reader answer into gold, attacker target, abstention or other. This board is the share of answers that are the attacker-chosen answer under that retrieval attack, so lower is better. Questions come from HotpotQA and Natural Questions and answers are matched by strict exact match against canonicalized answer sets.

Metric: Hijack rate (%; share of the 2,982 released HotpotQA and Natural Questions items; few-shot prompt shared byte-identically across readers, temperature 0, E5+cross-encoder retrieval, strict exact match against the canonicalized gold and target answer sets whose answer is the attacker-chosen target answer, lower is better; six lexically diverse sybil passages supporting one attacker-chosen answer injected into the corpus and retrieved normally). Source: arxiv.org. Saturation forecast: Around February 2027. 5 models tracked.

Top models

No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.

Interactive version: theaggregate.ai/benchmark?slug=polymorphic-sybil-rag-attack-hijack-rate · How It Works · Data refreshed daily, snapshot 2026-11-13.