mlsanityData to 7 Oct 2026

Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control

arXiv 2605.26754 ↗First posted 26 May 2026cs.CR cs.AIcited by 1

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-augmented generation (RAG) increasingly underpins high-stakes applications, yet remains vulnerable to Confundo-style poisoning where adversarially optimized documents manipulate generated outputs. Existing defenses assume that detecting poisoned evidence prevents harm. We show this assumption is incorrect: models exhibit a monitoring-control gap -- they can detect contradictions in retrieved evidence yet still act on poisoned claims. We introduce the Cordon Principle -- no agent capable of final synthesis may access untrusted natural-language evidence -- and realize it through CORDON-MAS, a compartmentalized framework that enforces this principle architecturally by separating evidence extraction, cross-source audit, and answer synthesis into agents with asymmetric memory privileges. Across five BEIR datasets, CORDON-MAS reduces attack success rate by 92.4% relative to undefended RAG. This reframes RAG poisoning from a detection problem to an information-flow control problem.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 16 of its 19 references that are in the map. First posted on arXiv 26 May 2026.

Builds on

16 of 19 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems6 Feb
  2. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems3 Nov
  3. 2025Through the Stealth Lens: Attention-Aware Defenses Against Poisoning in RAG4 Jun
  4. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
  5. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation1 Jan
  6. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis28 Nov
  7. 2024Certifiably Robust RAG against Retrieval Corruption24 May

Other references · 9

  1. 2017Attention Is All You Needcited by 59,932
  2. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  3. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,779
  6. 2023AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversationcited by 1,906
  7. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
  8. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  9. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Reasoning Reduces the Influence of Poisoned Context in RAGcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
  2. 2025ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking
  3. 2026Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
  4. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
  5. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks
  6. 2026RAG-NAROK: Retrieval-Aware Knowledge Corpus Poisoning in RAG with Source-specific Refutation
  7. 2026TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
  8. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation