Paper says RAG poison filters rely on construction shortcuts, not content
Original title: Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses
Stripping PoisonedRAG's question prefix drops reimplemented RAGuard from AUROC 0.953 to 0.758 and raises its miss rate to 0.763.
Query-time document filters are the dominant published defense against retrieval-augmented generation poisoning and often report near-perfect detection. The authors say those scores follow poison-set construction, especially verbatim question containment and length overlap. Of 21 surveyed evaluations, 8 use poison that prepends the target question and 5 substitute a length cue; 12 report no false-positive rate at the deployed point. Length-matched padding raises TrustRAG's set-level miss rate from 0.000 to 0.827. They claim no defense and release a profile script.
Unconfirmed: Detection figures come from the authors' re-implementations and survey, not independent vendor confirmation.
- PoisonedRAG's released code prepends the target question to every inserted passage.
- After prefix removal, 0.93 of those passages were still retrieved for the target.
- A learned scorer's miss rate rose from 0.000 to 0.986 after length padding.
- At a matched 5% false-positive rate that scorer's miss rate was 0.321.
- Tests covered four corpora, four attack families and ten per-document defenses.
From the original article
1 min read at arxiv.orgQuery-time filters that screen each retrieved document before it reaches the generator are the dominant published defense against retrieval-augmented generation poisoning, and they report near-perfect detection on domain benchmarks.
By Pushkal Kumar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.