GuardRAG filters poisoned document clusters after RAG retrieval
Original title: GuardRAG: A Post-Retrieval Defense against Poisoning Attacks in Retrieval-Augmented Generation
The training-free method clusters expanded retrieval results and prunes suspicious groups before they reach the model.
Researchers propose GuardRAG, a training-free post-retrieval defense against corpus poisoning in retrieval-augmented generation. It expands retrieval, drops near-duplicates, clusters documents with hierarchical agglomerative clustering, and prunes suspicious clusters using query relevance, size, and semantic compactness. On three question-answering datasets, multiple poisoning attacks, and six LLMs, the authors report lower attack success with answer utility preserved under clean retrieval.
Unconfirmed: Attack-success and utility results are the authors' experiments, not independent confirmation.
- GuardRAG needs no training and is described as plug-and-play.
- Clustering uses a query-adaptive threshold after near-duplicate removal.
- Scoring uses relevance, cluster size, and semantic compactness.
- Tests covered three QA datasets, multiple attacks, and six LLMs.
From the original article
1 min read at arxiv.orgRetrieval-Augmented Generation (RAG) enhances the factual grounding of Large Language Models (LLMs) by incorporating external evidence, but also exposes them to corpus poisoning attacks. In particular, coordinated attacks can introduce multiple mutually reinforcing poisoned documents into retrieved contexts, making reliable evidence filtering challenging.
By Linghui Jiao · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.