Search papers, labs, and topics across Lattice.
This paper introduces RAGSentinel, a novel defense mechanism designed to safeguard retrieval-augmented generation (RAG) systems from adversarial document attacks that can mislead large language models. By employing a surrogate encoder to analyze query-conditioned hidden-state shifts and filtering out poisoned documents as geometric outliers, RAGSentinel ensures that the model operates on a poison-free majority context. Experimental results demonstrate that RAGSentinel effectively reduces attack success rates while maintaining competitive accuracy across various question-answering datasets and large language model families.
RAGSentinel can filter out adversarial documents with high precision, ensuring that retrieval-augmented generation systems remain robust against sophisticated attacks.
Retrieval-augmented generation (RAG) improves the factuality of large language models by grounding responses in external documents, but it also exposes a critical security vulnerability: adversarial documents injected into the knowledge database can enter the context window and steer the model toward targeted incorrect answers. Existing post-retrieval defenses rely on instruction following, parametric knowledge, or text-level consistency, all of which can be imitated or optimized against by adaptive attackers. We propose RAGSentinel, a training-free, label-free defense for black-box RAG systems. RAGSentinel uses a surrogate encoder to measure query-conditioned hidden-state shifts induced by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. We prove that, under an honest-majority assumption and a representation-level separation condition, RAGSentinel exactly recovers a poison-free majority-sized context. Experiments across three question-answering datasets, three LLM families, and multiple poisoning attacks show that RAGSentinel consistently achieves low attack success rates while preserving competitive accuracy and remaining effective against adaptive attacks with full pipeline knowledge.
