RAGuard Defends Against Data Poisoning in Retrieval-Augmented LLMs

Retrieval-Augmented Generation (RAG) systems, which enhance large language models (LLMs) with external data, are vulnerable to "corpus poisoning" where malicious data can manipulate retrieved information. Researchers have introduced RAGuard, a two-layered defense framework specifically targeting factual corpus-poisoning attacks. The first layer involves adversarially fine-tuning the dense retriever with synthetic poisoned documents, teaching it to downrank harmful passages before they reach the generator. The second, more innovative layer is the Zero-Knowledge Inference Patch (ZKIP). ZKIP is a black-box filter that operates without needing poison labels, ground-truth answers, or internal model access. It evaluates each retrieved document by performing a "leave-one-out" decode, scoring the document based on the semantic shift and output-entropy change its removal causes. This combined approach significantly reduces attack success rates, even at high poison ratios, while maintaining retrieval recall.