PRA-RAG Boosts Retrieval-Augmented Generation Robustness Against Poisoning Attacks

Retrieval-Augmented Generation (RAG) systems, while effective in enhancing Large Language Models (LLMs) with external knowledge, are susceptible to malicious data poisoning. These attacks manipulate retrieved information to steer LLM outputs incorrectly. Current defense mechanisms often lack strong theoretical guarantees and struggle when the LLM has limited prior knowledge of the compromised content. A new approach, PRA-RAG, offers a provably robust solution to counter these poisoning attacks. It operates by sampling various combinations of retrieved texts and leveraging geometric properties within the embedding space to pinpoint a reliable subset. From this subset, a stable, aggregated representation is then derived. The research provides theoretical limits on the potential impact of poisoned content and quantifies RAG's robustness. Experimental results across diverse benchmarks and RAG architectures show PRA-RAG drastically lowers attack success rates to 1% while maintaining high accuracy, significantly outperforming existing state-of-the-art defenses.