mlsanityData to 14 Oct 2026

TriShieldRAG: 3 Rings, One Blind Spot in Layered Defenses for Retrieval-Augmented Generation

arXiv 2607.23838 ↗First posted 26 Jul 2026cs.CR cs.AI cs.CLcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) grounds LLM answers in query-time retrieved documents, so reliability depends on what the retriever returns. PoisonedRAG (Zou et al., USENIX Security'25) showed five crafted documents mislead an undefended system in nearly 90% of cases, and that single-stage defenses give limited robustness. We propose TriShieldRAG, a three-layered framework: an Ingest Guard for document-level screening, a Retrieval Scorer for trust-aware re-ranking, and a Cross-LLM Consensus over three diverse models. We reasoned that collectively screening, re-ranking and validating retrieved evidence would give complementary protection, limiting the ability of poisoned documents to succeed through any single failure. We evaluate against non-adaptive and adaptive poisoning. Non-adaptively, on the full 2.68M-passage Natural Questions (NQ) corpus with the original PoisonedRAG attack, it cuts attack success from 79 +/- 1.0% to 1 +/- 0.0%. Adaptive attacks expose fundamental limits of layering. By changing only the document formatting, without modifying the poison text or accessing the retriever, the attacker reduces the Ingest Guard score from 0.500 to 0.000 and bypasses it on all 500 tested documents across three corpora. The remaining layers then give no protection: 62 +/- 0.8% attack success against a 56 +/- 2.5% undefended baseline on NQ, and 85 +/- 0.6% against 86 +/- 0.6% on HotpotQA. Layered defenses relying on the same retrieved evidence fail together: poisoned context misleads both re-ranking and consensus validation. Minority-poison thresholds prove corpus-dependent, at 0.214, 0.251 and 0.558 rather than the derived 0.5; a closed form we proposed for these failed a pre-registered prediction and is retracted. Cross-model agreement is misleading, reaching 0.96 while attack success approaches 99%. We release the framework, the evasion-certification methodology and artifacts.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 100 of its 123 references that are in the map. First posted on arXiv 26 Jul 2026.

Builds on

100 of 123 references.

Closest ancestors · 26

Same direction, newest first

  1. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions9 Apr
  2. 2026RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems1 Apr
  3. 2026ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning24 Mar
  4. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation30 Dec
  5. 2025Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems3 Nov
  6. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks28 Oct
  7. 2025External Data Extraction Attacks against Retrieval-Augmented Large Language Models3 Oct
  8. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation4 Aug
  9. 2025Joint-GCG: Unified Gradient-Based Poisoning Attacks on Retrieval-Augmented Generation Systems6 Jun
  10. 2025Benchmarking Poisoning Attacks against Retrieval-Augmented Generation24 May
  11. 2025GRADA: Graph-based Reranking against Adversarial Documents Attack12 May
  12. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation30 Apr
14 more
  1. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
  2. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation8 Mar
  3. 2025MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks25 Feb
  4. 2025FlippedRAG: Black-Box Opinion Manipulation Adversarial Attacks to Retrieval-Augmented Generation Models6 Jan
  5. 2025TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation1 Jan
  6. 2024GASLITEing the Retrieval: Exploring Vulnerabilities in Dense Embedding-based Search30 Dec
  7. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
  8. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis28 Nov
  9. 2024HijackRAG: Hijacking Attacks against Retrieval-Augmented Large Language Models30 Oct
  10. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains12 Sep
  11. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  12. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  13. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  14. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 74

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  3. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  4. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  5. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
  6. 2022Self-Consistency Improves Chain of Thought Reasoning in Language Modelscited by 5,708
  7. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  8. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,754
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  10. 2017Billion-scale similarity search with GPUscited by 2,497
  11. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  12. 2022Survey of Hallucination in Natural Language Generationcited by 2,075
38 more
  1. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
  2. 2023Improving Factuality and Reasoning in Language Models through Multiagent Debatecited by 1,784
  3. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,605
  4. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  5. 2018FEVER: a large-scale dataset for Fact Extraction and VERificationcited by 1,375
  6. 2023FActScore: Fine-grained Atomic Evaluation of Factual Precision in Long Form Text Generationcited by 1,282
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  8. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,252
  9. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,216
  10. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  11. 2020ColBERT: Efficient and Effective Passage Search via Contextualized Late Interaction over BERTcited by 1,178
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  13. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  14. 2020MPNet: Masked and Permuted Pre-training for Language Understandingcited by 981
  15. 2016Efficient and robust approximate nearest neighbor search using Hierarchical Navigable Small World graphscited by 861
  16. 2020Approximate Nearest Neighbor Negative Contrastive Learning for Dense Text Retrievalcited by 849
  17. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  18. 2023SelfCheckGPT: Zero-Resource Black-Box Hallucination Detection for Generative Large Language Modelscited by 810
  19. 2018How To Backdoor Federated Learningcited by 765
  20. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 722
  21. 2018Byzantine-Robust Distributed Learning: Towards Optimal Statistical Ratescited by 711
  22. 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
  23. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  24. 2019Passage Re-ranking with BERTcited by 645
  25. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  26. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  27. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 519
  28. 2019Local Model Poisoning Attacks to Byzantine-Robust Federated Learningcited by 493
  29. 2019On Evaluating Adversarial Robustnesscited by 447
  30. 2023Detecting Language Model Attacks with Perplexitycited by 431
  31. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 429
  32. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  33. 2018TextBugger: Generating Adversarial Text Against Real-world Applicationscited by 381
  34. 2023Making Retrieval-Augmented Language Models Robust to Irrelevant Contextcited by 369
  35. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  36. 2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
  37. 2018The Hidden Vulnerability of Distributed Learning in Byzantiumcited by 329
  38. 2017Certified Defenses for Data Poisoning Attackscited by 303

50 most cited of 74 All 74 (JSON)

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
  2. 2026DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial
  3. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
  4. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  5. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
  6. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
  7. 2026ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks
  8. 2026RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation