mlsanityData to 7 Oct 2026

RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation

arXiv 2608.13010 ↗First posted 13 Aug 2026cs.CL cs.CR cs.IRcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-augmented generation uses an external corpus as inference-time evidence, allowing an attacker to promote a false answer by injecting a handful of documents. Detection must distinguish this manipulation from ordinary relevance without knowing which queries or documents are targeted. Existing detectors use text irregularity, candidate consensus, or corpus-level graph structure, whose reliability varies with the attack and local context. We present RAGSieve, which constructs a reference matched to each detection scope. At query time, RAGSieve-Query (RSQ) compares generation candidates with the lower-ranked tail of the same retrieval, exposing answer-token concentration and carrier-payload seams. At corpus time, RAGSieve-Graph (RSG) compares each document's strongest semantic relations with its own neighborhood floor to measure coordinated density. Neither requires poison labels, a trusted corpus, or training. Across three QA datasets, three dense retrievers, and six poisoning constructions, RSQ reaches 95.2% AUROC and detects 82.2% of poison at a 5% clean-removal budget, against 81.1% and 52.5% for the strongest query-time baseline; RSG reaches 93.3% and 79.8% against 79.4% and 37.6% for the strongest corpus-time baseline, with a 79.6% versus 1.4% detection rate on camouflaged injections. Joint deployment cuts attack success from 67.4% to 16.1% while retaining unpoisoned-retrieval F1 at 41.0%, compared with 42.1% without filtering. Source code is available at https://github.com/XrazyMee/RAGSieve.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 35 of its 50 references that are in the map. First posted on arXiv 13 Aug 2026.

Builds on

35 of 50 references.

Closest ancestors · 23

Same direction, newest first

  1. 2026When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse7 Aug
  2. 2026Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework5 Jul
  3. 2026PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption8 May
  4. 2026Needle-in-RAG: Prompt-Conditioned Character-Level Traceback of Poisoned Spans in Retrieved Evidence3 May
  5. 2026Adversarial Hubness Detector: Detecting Hubness Poisoning in Retrieval-Augmented Generation Systems25 Feb
  6. 2026Confundo: Learning to Generate Robust Poison for Practical RAG Systems6 Feb
  7. 2025Secure Retrieval-Augmented Generation against Poisoning Attacks28 Oct
  8. 2025NeuroGenPoisoning: Neuron-Guided Attacks on Retrieval-Augmented Generation of LLM via Genetic Optimization of External Knowledge24 Oct
  9. 2025RIPRAG: Hack a Black-box Retrieval-Augmented Generation Question-Answering System with Reinforcement Learning11 Oct
  10. 2025ReliabilityRAG: Effective and Provably Robust Defense for RAG-based Web-Search27 Sep
  11. 2025Token-Level Precise Attack on RAG: Searching for the Best Alternatives to Mislead Generation5 Aug
  12. 2025Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation4 Aug
11 more
  1. 2025Safeguarding RAG Pipelines with GMTP: A Gradient-based Masked Token Probability Method for Poisoned Document Detection24 Jul
  2. 2025CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models26 May
  3. 2025EcoSafeRAG: Efficient Security through Context Analysis in Retrieval-Augmented Generation16 May
  4. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems15 May
  5. 2025GRADA: Graph-based Reranking against Adversarial Documents Attack12 May
  6. 2025The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems28 Feb
  7. 2024RevPRAG: Revealing Poisoning Attacks in Retrieval-Augmented Generation through LLM Activation Analysis28 Nov
  8. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  9. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  10. 2024Typos that Broke the RAG's Back: Genetic Attack on RAG Pipeline by Simulating Documents in the Wild via Low-level Perturbations22 Apr
  11. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 12

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  3. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  4. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  5. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
  6. 2022Text Embeddings by Weakly-Supervised Contrastive Pre-trainingcited by 1,216
  7. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  8. 2024InstructRAG: Instructing Retrieval-Augmented Generation via Self-Synthesized Rationalescited by 100
  9. 2024Astute RAG: Overcoming Imperfect Retrieval Augmentation and Knowledge Conflicts for Large Language Modelscited by 57
  10. 2024CrAM: Credibility-Aware Attention Modification in LLMs for Combating Misinformation in RAGcited by 22
  11. 2026Overcoming the Retrieval Barrier: Indirect Prompt Injection in the Wild for LLM Systemscited by 16
  12. 2025SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAGcited by 12

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
  2. 2025RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation
  3. 2026Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution
  4. 2026TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
  5. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
  6. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation
  7. 2026Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems
  8. 2026ToxicRAG: Compromising Retrieval-Augmented Generation Systems via Single-Shot Knowledge Poisoning Attacks