mlsanityData to 7 Oct 2026

TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation

arXiv 2501.00879 ↗First posted 1 Jan 2025cs.CLcited by 37

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by integrating external knowledge sources, enabling more accurate and contextually relevant responses tailored to user queries. These systems, however, remain susceptible to corpus poisoning attacks, which can severely impair the performance of LLMs. To address this challenge, we propose TrustRAG, a robust framework that systematically filters malicious and irrelevant content before it is retrieved for generation. Our approach employs a two-stage defense mechanism. The first stage implements a cluster filtering strategy to detect potential attack patterns. The second stage employs a self-assessment process that harnesses the internal capabilities of LLMs to detect malicious documents and resolve inconsistencies. TrustRAG provides a plug-and-play, training-free module that integrates seamlessly with any open- or closed-source language model. Extensive experiments demonstrate that TrustRAG delivers substantial improvements in retrieval accuracy, efficiency, and attack resistance.

Key facts. Cited by 37 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 27 of its 39 references that are in the map. First posted on arXiv 1 Jan 2025.

Builds on

27 of 39 references.

Closest ancestors · 3

Same direction, newest first

  1. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  2. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  3. 2024Certifiably Robust RAG against Retrieval Corruption24 May

Other references · 24

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  4. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
  5. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
  6. 2021SimCSE: Simple Contrastive Learning of Sentence Embeddingscited by 2,168
  7. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,126
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  9. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  10. 2024M3-Embedding: Multi-Linguality, Multi-Functionality, Multi-Granularity Text Embeddings Through Self-Knowledge Distillationcited by 1,050
  11. 2022Atlas: Few-shot Learning with Retrieval Augmented Language Modelscited by 940
  12. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 846
12 more
  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  2. 2023Detecting Language Model Attacks with Perplexitycited by 411
  3. 2022Generate rather than Retrieve: Large Language Models are Strong Context Generatorscited by 296
  4. 2022Promptagator: Few-shot Dense Retrieval From 8 Examplescited by 233
  5. 2023Take a Step Back: Evoking Reasoning via Abstraction in Large Language Modelscited by 157
  6. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  7. 2023Walking Down the Memory Maze: Beyond Context Limit through Interactive Readingcited by 129
  8. 2022Re2G: Retrieve, Rerank, Generatecited by 102
  9. 2024Trustworthiness in Retrieval-Augmented Generation Systems: A Surveycited by 83
  10. 2024SuRe: Summarizing Retrievals using Answer Candidates for Open-domain QA of LLMscited by 67
  11. 2024AmbigDocs: Reasoning across Documents on Different Entities under the Same Namecited by 21
  12. 2024Adversarial Decoding: Generating Readable Documents for Adversarial Objectivescited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 12; 2026: 25.

37 papers.

Sort:

By area:

  1. 2025A Survey of Context Engineering for Large Language Modelscited by 120
  2. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  3. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  4. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Modelscited by 24
  5. 2026A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecyclecited by 21
  6. 2026Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guaranteescited by 14
  7. 2025GRADA: Graph-based Reranking against Adversarial Documents Attackcited by 10
  8. 2025CtrlRAG: Black-box Document Poisoning Attacks for Retrieval-Augmented Generation of Large Language Modelscited by 5
  9. 2025Are We on the Right Way for Assessing Document Retrieval-Augmented Generation?cited by 5
  10. 2025RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learningcited by 5
  11. 2025MIRAGE: Misleading Retrieval-Augmented Generation via Black-box and Query-agnostic Poisoning Attackscited by 4
  12. 2026How Adversarial Environments Mislead Agentic AI?cited by 4
25 more
  1. 2026CODE: A Contradiction-Based Deliberation Extension Framework for Overthinking Attacks on Retrieval-Augmented Generationcited by 3
  2. 2026Addressing Corpus Knowledge Poisoning Attacks on RAG Using Sparse Attentioncited by 3
  3. 2025DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)cited by 2
  4. 2025Fact or Facsimile? Evaluating the Factual Robustness of Modern Retrieverscited by 2
  5. 2026ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoningcited by 2
  6. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  7. 2026RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systemscited by 1
  8. 2026Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Controlcited by 1
  9. 2026Conflict-Aware Retriever Editing for Knowledge Injection Attacks on LLM-Based RAG Systemscited by 1
  10. 2026PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruptioncited by 1
  11. 2026Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Frameworkcited by 1
  12. 2025RAGRank: Using PageRank to Counter Poisoning in CTI LLM Pipelinescited by 0
  13. 2026Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Studycited by 0
  14. 2026When Poison Fails After Retrieval: Revisiting Corpus Poisoning under Chunking and Reranking Pipelinescited by 0
  15. 2026Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attributioncited by 0
  16. 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
  17. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denialcited by 0
  18. 2026RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generationcited by 0
  19. 2026CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documentscited by 0
  20. 2026TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoningcited by 0
  21. 2026Feedback-Assisted Trust Propagation over Document Relation Graphs for Retrieval-Augmented Generationcited by 0
  22. 2026Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectivescited by 0
  23. 2026RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutationcited by 0
  24. 2026Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generationcited by 0
  25. 2026VirusCascade: Hijacking Collaborative Reflection in LLM-Powered Recommender Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  2. 2025Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation
  3. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  4. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models
  5. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  6. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  7. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
  8. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model