RAGSieve catches RAG poisoning with self-referenced checks

Problem

This paper studies poisoning of retrieval-augmented generation systems, where an attacker injects or modifies a small number of indexed documents so that retrieval returns attacker-selected evidence and the generator produces an incorrect, attacker-chosen answer. This threat matters because RAG moves trust from model parameters to an external, mutable corpus and existing detectors depend on trusted reference corpora, specific attack artefacts, or global thresholds that are sensitive to corpus topology and attack diversity.

Approach

RAGSieve constructs its reference from the inspected system through self-referenced local contrast at two control points. RAGSieve-Query (RSQ) runs online after retrieval and before generation: it contrasts the top-five candidate documents with the retrieval tail (ranks 6-20) using four evidence branches — answer-anchor concentration, script-integrity, multiscale language-model surprisal, and query-alignment traces — to score and optionally remove suspicious candidates before generation. RAGSieve-Graph (RSG) runs offline during ingestion or periodic audits: for each document it builds a local graph of semantic nearest neighbours, retains neighbours that are semantically similar but lexically distinct, and measures excess local density relative to the document's k-th neighbour baseline; it also applies a token-level script-integrity predicate. Both modes use no poison labels or external trusted corpora. Evaluation uses three QA datasets (Natural Questions, HotpotQA, MS MARCO), three dense retrievers, and six poisoning constructions covering black-box, grey-box and white-box variants and both contiguous and dispersed triggers.

Key Findings

• RSQ achieves 95.2% macro AUROC and detects 82.2% of poison documents when clean-document removal is capped at 5%, compared with 81.1% AUROC and 52.5% budgeted detection for the best baseline GMTP.
• At an operating point RSQ removes 73.9% of poison while removing only 2.2% clean documents; by contrast GMTP removes 69.5% poison and 22.3% clean documents.
• RSG reaches 93.3% macro AUROC and 79.8% budgeted poison detection at 5% clean removal, outperforming CleanBase which attains 79.4% AUROC and 37.6% budgeted detection.
• Joint deployment (RSG then RSQ) reduces overall attack success rate from 67.4% unprotected to 14.0% while preserving unpoisoned-retrieval F1 at 41.3%.
• Per-attack and per-system results show strong improvements on embedding-optimised and coordinated injections; difficult cases remain, notably CPA-RAG where residual attack success is highest.
• Operational cost: RSQ adds about 447.3 ms per query with 3.87 GiB P95 memory; an RSG corpus scan over 128k documents takes 46.54 s (0.362 ms per document) with 1.01 GiB peak memory.

Limitations

RAGSieve detects retrieval-promotion patterns not falsehood, so it is not a factuality verifier. RSG relies on coordinated injections that alter local graph density and has lower recall for single fluent poisons. RSQ requires a predominantly clean retrieval tail; many poisons in ranks 6-20 reduce its separation. Offline quarantining has persistent effects because removal affects future queries. Detector-aware attack dispersion and optimisations against both lexical-diversity constraints and local-floor calibration remain open.

Implications

Offensive implications emphasise how an attacker could adapt: craft single fluent poisoned documents to evade corpus-graph density checks; disperse payloads across topical neighbourhoods to defeat clique-like detectors; ensure poisoned items also occupy the retrieval tail to weaken query-local contrast; or jointly optimise carriers and payloads (as in CPA-RAG) to preserve fluent carriers and reduce surprisal or query-alignment signals. The measured residual success against CPA-RAG shows attackers can still achieve partial success against the defence, so defenders should assume motivated attackers may tune dispersion and fluency to exploit the modes' differing assumptions. Source code is available at https://github.com/XrazyMee/RAGSieve.