Fair on the corpus size -- five documents is the minimal reproducible case for clarity of mechanism, not a production claim. PoisonedRAG (USENIX Security 2025) demonstrates the same mechanism at millions-of-documents scale.

The legitimate $24.7M document was present in the retrieved chunks. The LLM saw the correct figure and still produced the fabricated answer. That's the part that isn't working as intended.