Search papers, labs, and topics across Lattice.
This paper introduces RAGSieve, a novel self-referenced detection framework for identifying knowledge poisoning in retrieval-augmented generation systems. By leveraging query-local and corpus-local contrast methods, RAGSieve-Query (RSQ) and RAGSieve-Graph (RSG) effectively score and compare document candidates to detect poisoned content without relying on trusted references. The framework achieves significant improvements in detection accuracy, reducing attack success rates from 67.4% to 14.0% while maintaining a robust F1 score on unpoisoned data.
RAGSieve slashes knowledge poisoning attack success from 67.4% to just 14.0%, all without needing trusted corpora or poison labels.
Retrieval-augmented generation treats an external corpus as inference evidence, allowing injected documents to promote attacker-chosen claims. Existing detectors depend on trusted references, specific attack artifacts, or global thresholds sensitive to corpus topology. We present RAGSieve, a self-referenced detection framework that constructs its reference from the inspected system. RAGSieve-Query (RSQ) performs query-local contrast, scoring top-five candidates against ranks 6-20 of the same retrieval to detect answer-anchor concentration and carrier transitions. RAGSieve-Graph (RSG) performs corpus-local contrast, comparing each document's semantically similar but lexically distinct neighbors with its local baseline to detect coordinated density before queries arrive. Across three QA datasets and six poisoning constructions, RSQ achieves 95.2% AUROC and detects 82.2% of poison at 5% clean-document removal, versus 81.1%/52.5% for GMTP. RSG achieves 93.3%/79.8%, versus 79.4%/37.6% for CleanBase. Joint deployment reduces attack success from 67.4% to 14.0% while retaining 41.3% F1 on unpoisoned retrieval, demonstrating practical protection at both corpus ingestion and query time without poison labels or trusted corpora. Source code is available at https://github.com/XrazyMee/RAGSieve.
