CoordGuard detects coordinated RAG retrieval poisoning via embedding geometry
Original title: Consistency Is the Attack Surface: Detecting Coordinated Retrieval Poisoning with Embedding Geometry
Across four Natural Questions seeds, injections reached top-5 in 94.1% of targeted rows; e5 filtering cut exposure-conditional ASR to 0.167.
A paper studies coordinated retrieval poisoning of RAG, where few injected passages can dominate retrieved context. Across four Natural Questions seeds, at least one injection reached the top-5 in 94.1% of targeted query-seed rows, and all three formed a majority in 52.9%. RobustRAG and ReliabilityRAG reduced exposure-conditional attack success only from 0.576 to 0.512 while lowering clean accuracy. CoordGuard audits embedding geometry without poison labels; e5 always-filtering cut ASR_exp to 0.167 at a 13.6-point clean cost.
Unconfirmed: Figures are the authors' experimental results, not an independent evaluation or a reported production incident.
- At least one injection reached the top-5 in 94.1% of targeted rows.
- All three injections formed a retrieved majority in 52.9% of rows.
- Undefended RAG exposure-conditional attack success was 0.576.
- e5 always-filtering cut overall ASR_exp to 0.167 at a 13.6-point clean cost.
- A Contriever gate retained clean accuracy 0.315 at ASR_exp 0.331.
- AI models
- e5Contriever
From the original article
1 min read at arxiv.orgConsistency-based defenses for retrieval-augmented generation (RAG) rest on an assumption that a sparse adversary breaks: a poisoning campaign may modify a negligible fraction of the corpus, yet retrieval concentrates its passages into the reader's context. Across four Natural Questions retrieval seeds, at least one injection reaches the top-5 in 94.
By Zeyan Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.