mlsanityData to 14 Oct 2026

Secure Retrieval-Augmented Generation against Poisoning Attacks

arXiv 2510.25025 ↗First posted 28 Oct 2025cs.CR cs.IR cs.LGcited by 19

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Large language models (LLMs) have transformed natural language processing (NLP), enabling applications from content generation to decision support. Retrieval-Augmented Generation (RAG) improves LLMs by incorporating external knowledge but also introduces security risks, particularly from data poisoning, where the attacker injects poisoned texts into the knowledge database to manipulate system outputs. While various defenses have been proposed, they often struggle against advanced attacks. To address this, we introduce RAGuard, a detection framework designed to identify poisoned texts. RAGuard first expands the retrieval scope to increase the proportion of clean texts, reducing the likelihood of retrieving poisoned content. It then applies chunk-wise perplexity filtering to detect abnormal variations and text similarity filtering to flag highly similar texts. This non-parametric approach enhances RAG security, and experiments on large-scale datasets demonstrate its effectiveness in detecting and mitigating poisoning attacks, including strong adaptive attacks.

Key facts. Cited by 19 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 20 of its 27 references that are in the map. First posted on arXiv 28 Oct 2025.

Builds on

20 of 27 references.

Closest ancestors · 7

Same direction, newest first

  1. 2025Who Taught the Lie? Responsibility Attribution for Poisoned Knowledge in Retrieval-Augmented Generation17 Sep
  2. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation24 May
  3. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation30 Apr
  4. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
  5. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  6. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  7. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 13

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  4. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  5. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
  6. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  7. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
  8. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  9. 2020ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERTcited by 1,178
  10. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  11. 2023Detecting Language Model Attacks with Perplexitycited by 431
  12. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
1 more
  1. 2018Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attackscited by 81

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 19.

19 papers.

Sort:

By area:

  1. 2026ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Modelscited by 5
  2. 2026ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoningcited by 2
  3. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  4. 2026Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agentscited by 2
  5. 2026NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistributioncited by 2
  6. 2026Retrieval Pivot Attacks in Hybrid RAG: Measuring and Mitigating Amplified Leakage from Vector Seeds to Graph Expansioncited by 1
  7. 2026Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidencecited by 1
  8. 2026PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruptioncited by 1
  9. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 1
  10. 2026Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attributioncited by 0
  11. 2026TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generationcited by 0
  12. 2026RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generationcited by 0
7 more
  1. 2026Trustworthy RAG: An Evaluation Agent for Detecting Misinformation and Knowledge Poisoning in Generative AI Systemscited by 0
  2. 2026RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generationcited by 0
  3. 2026Lazy Grounding: Attacking Search Agents with Factual Evidencecited by 0
  4. 2026ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attackscited by 0
  5. 2026InceptionRAG: Stealthy Poisoning Attack Against Retrieval-Augmented Generationcited by 0
  6. 2026Divide and Doubt: Diverse Distributed Poisoning for Retrieval-Augmented Generationcited by 0
  7. 2026Safer Content or Firmer Refusals? A Hybrid Perturbation Defense for Alignment under Harmful Fine-tuningcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
  2. 2025POISONCRAFT: Practical Poisoning of Retrieval-Augmented Generation for Large Language Models
  3. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  4. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  5. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  6. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  7. 2026Influence Factors on RAG Poisoning
  8. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems