Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces RAGShield, a five-layer defense-in-depth framework designed to protect Retrieval-Augmented Generation (RAG) systems in government applications from knowledge base poisoning attacks. RAGShield leverages techniques inspired by software supply chain provenance verification, including cryptographic document attestation, trust-weighted retrieval, and a taint lattice for cross-source contradiction detection. Evaluation demonstrates that RAGShield achieves a 0.0% attack success rate against various adversarial tiers on a Natural Questions corpus, though insider in-place replacement attacks achieve a 17.5% attack success rate.
RAGShield slashes the attack success rate on poisoned RAG systems to near zero, but even cryptographic provenance can't stop a determined insider.
RAG systems deployed across federal agencies for citizen-facing services are vulnerable to knowledge base poisoning attacks, where adversaries inject malicious documents to manipulate outputs. Recent work demonstrates that as few as 10 adversarial passages can achieve 98.2% retrieval success rates. We observe that RAG knowledge base poisoning is structurally analogous to software supply chain attacks, and propose RAGShield, a five-layer defense-in-depth framework applying supply chain provenance verification to the RAG knowledge pipeline. RAGShield introduces: (1) C2PA-inspired cryptographic document attestation blocking unsigned and forged documents at ingestion; (2) trust-weighted retrieval prioritizing provenance-verified sources; (3) a formal taint lattice with cross-source contradiction detection catching insider threats even when provenance is valid; (4) provenance-aware generation with auditable citations; and (5) NIST SP 800-53 compliance mapping across 15 control families. Evaluation on a 500-passage Natural Questions corpus with 63 attack documents and 200 queries against five adversary tiers achieves 0.0% attack success rate including adaptive attacks (95% CI: [0.0%, 1.9%]) with 0.0% false positive rate. We honestly report that insider in-place replacement attacks achieve 17.5% ASR, identifying the fundamental limit of ingestion-time defense. The cross-source contradiction detector catches subtle numerical manipulation attacks that bypass provenance verification entirely.