mlsanityData to 7 Oct 2026

RAR: Setting Knowledge Tripwires for Retrieval Augmented Rejection

arXiv 2505.13581 ↗First posted 19 May 2025cs.IR cs.CL cs.CRcited by 3

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Content moderation for large language models (LLMs) remains a significant challenge, requiring flexible and adaptable solutions that can quickly respond to emerging threats. This paper introduces Retrieval Augmented Rejection (RAR), a novel approach that leverages a retrieval-augmented generation (RAG) architecture to dynamically reject unsafe user queries without model retraining. By strategically inserting and marking malicious documents into the vector database, the system can identify and reject harmful requests when these documents are retrieved. Our preliminary results show that RAR achieves comparable performance to embedded moderation in LLMs like Claude 3.5 Sonnet, while offering superior flexibility and real-time customization capabilities, a fundamental feature to timely address critical vulnerabilities. This approach introduces no architectural changes to existing RAG systems, requiring only the addition of specially crafted documents and a simple rejection mechanism based on retrieval results.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 11 of its 11 references that are in the map. First posted on arXiv 19 May 2025.

Builds on

11 of 11 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models25 Apr
  2. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model28 Jan
  3. 2024Class-RAG: Real-Time Content Moderation with Retrieval Augmented Generation18 Oct
  4. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun

Other references · 7

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  4. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
  5. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  6. 2023Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignmentcited by 213
  7. 2024AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Expertscited by 126

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 2.

3 papers.

  1. 2025Adversarial Distilled Retrieval-Augmented Guarding Model for Online Malicious Intent Detectioncited by 0
  2. 2026Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agentscited by 0
  3. 2026PolicyMem: Geometric Policy Memory for LLM Governancecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  2. 2024Data Extraction Attacks in Retrieval-Augmented Generation via Backdoors
  3. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems
  4. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  5. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
  6. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models
  7. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
  8. 2026PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems