Search papers, labs, and topics across Lattice.
This paper introduces RAGuard, a dual-layer defense framework designed to protect Retrieval-Augmented Generation (RAG) systems from corpus poisoning attacks. The first layer employs adversarial fine-tuning of a dense retriever on synthetic poisoned documents to downrank malicious content, while the second layer utilizes the Zero-Knowledge Inference Patch (ZKIP), a black-box filter that assesses the impact of removing retrieved documents on model outputs without needing poison labels. The results show that while adversarial retriever training reduces attack success rates, ZKIP effectively drives them to near-zero, maintaining high recall rates, thus ensuring the integrity of RAG systems against data poisoning.
ZKIP achieves a staggering attack success rate of 0.000 against corpus poisoning, revolutionizing the defense landscape for RAG systems.
Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence. We introduce RAGuard, a layered defense against \emph{factual} corpus-poisoning attacks on RAG pipelines. The first layer adversarially fine-tunes a dense retriever on synthetic poisoned documents (fabricated facts, contradictions, and reasoning traps), teaching it to downrank malicious passages before generation. The second layer, the Zero-Knowledge Inference Patch ZKIP, is a label-free, black-box filter: for each retrieved document, it performs a leave-one-out decode and scores the document by the semantic shift and output-entropy change that its removal induces. ZKIP requires no poison labels, no ground-truth answers, and no access to model internals; it compares the model's own answers under counterfactual contexts. On poisoned Natural Questions at 5--30\% poison ratios, adversarial retriever training alone reduces but does not eliminate attack success, while ZKIP drives the measured attack success rate to 0.000 in every defended configuration, keeping Recall@5 within 0.03 of the clean-corpus baseline. Supervised analyses on both Natural Questions and BEIR (NFCorpus) confirm that the counterfactual signals ZKIP relies on carry learnable poison structure. The defense costs $k{+}1$ generator passes per query ($6\times$ for $k{=}5$); we analyze batching and early-stopping approximations that reduce this overhead. We also show that keyword-preserving poisons leave lexical retrievers such as BM25 essentially unaffected, an observation that delineates the boundary of the threat model. Code, datasets, and evaluation harnesses are released for reproducibility.
