The introduction of RAG expands the attack surface; attackers only need to have malicious content selected during the retrieval stage to influence outputs, without needing to poison the training data, thereby lowering the threshold for information poisoning.