mlsanityData to 14 Oct 2026

Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection

arXiv 2608.08100 ↗First posted 8 Aug 2026cs.CR cs.AI cs.LGcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities to knowledge poisoning and prompt-injection attacks. We present RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization, designed to recover classification quality under retrieval-layer attack. Experiments on CIC-UNSW-NB15 show recovery relative to clean undefended performance ranging from R=1.0 at 1% poisoning to R=0.57 at 30%, with negligible clean-performance overhead. Under prompt injection, multi-document retrieval limits label-flip success to 0.6-2.4%, compared with 35-55% for single-document retrieval. Ablation results show that LECC is the primary contributor to robustness, while soft trust-based demotion outperforms hard filtering. The defended RAG pipeline offers an explainable, attack-resilient foundation for intrusion detection, well suited for hybrid deployment alongside high-throughput classifiers.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 20 of its 42 references that are in the map. First posted on arXiv 8 Aug 2026.

Builds on

20 of 42 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation4 Aug
  2. 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool3 Jul
  3. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models26 May
  4. 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation30 Apr
  5. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation4 Apr
  6. 2025SafeRAG: Benchmarking Security in Retrieval-Augmented Generation of Large Language Model28 Jan

Other references · 14

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2016XGBoost: A Scalable Tree Boosting Systemcited by 5,166
  3. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  4. 2017Billion-scale similarity search with GPUscited by 2,497
  5. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  6. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,601
  7. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  8. 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 418
  9. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 414
  10. 2018Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detectioncited by 121
  11. 2019A Survey of Network-based Intrusion Detection Data Setscited by 46
  12. 2017Security Evaluation of Pattern Classifiers under Attackcited by 39
2 more
  1. 2023FlowTransformer: A Transformer Framework for Flow-based Network Intrusion Detection Systemscited by 24
  2. 2026MA-IDS: Multi-Agent RAG Framework for IoT Network Intrusion Detection with an Experience Librarycited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks
  2. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  3. 2026Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
  4. 2024Backdoored Retrievers for Prompt Injection Attacks on Retrieval Augmented Generation of Large Language Models
  5. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  6. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
  7. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  8. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions