RAGSentinel: Geometric Consensus Defense for Poisoned RAG
A retriever that pulls three malicious documents into the top-5 will not tell you it did. The generator speaks with the same confidence it uses on clean context.
RAGSentinel: Geometric Consensus Defense for Poisoned RAG
A retriever that pulls three malicious documents into the top-5 will not tell you it did. The generator speaks with the same confidence it uses on clean context. This is the failure mode RAGSentinel targets: corpus poisoning where an attacker seeds a handful of adversarial passages, waits for a matching query, and steers the answer.
The paper (arXiv 2608.23965) proposes a training-free, label-free filter that sits between the retriever and the LLM. A surrogate encoder measures how each retrieved document shifts the query’s hidden state, the direction shared by all documents (the topic axis) is projected out, and the geometric outliers are dropped. Under an honest-majority assumption — most retrieved documents are clean — the authors prove recovery guarantees.
Why geometry beats keyword filters
Poisoned passages engineered by attacks like PoisonedRAG are lexically fluent and topically on-target. Regex, perplexity thresholds and semantic-similarity gates miss them because the attacker optimizes exactly against those signals. The RAGSentinel insight: adversarial documents deform the query representation in directions the clean majority does not. Once you project out the shared topic component, the poison sits alone in the residual space.
This aligns with retrieval poisoning threats catalogued in MITRE ATLAS technique AML.T0020 and with the risks flagged in the ENISA Threat Landscape 2024. Both treat knowledge-base tampering as under-defended relative to prompt injection.
ragsentinel:
surrogate_encoder: bge-large-en-v1.5
top_k_retrieved: 10
topic_projection: remove_first_pc
outlier_rule: mad_zscore > 3.0
fallback_on_reject: abstain_with_citation
honest_majority_threshold: 0.6Deployment shape
Three notes from a working engineer.
The surrogate encoder does not need to match the retriever. Any reasonable sentence encoder captures the shift signal, which lowers coupling cost when your production retriever is a proprietary API. That matters when debugging graph-augmented pipelines where the retriever is opaque.
The honest-majority assumption is exploitable. An attacker who controls more than roughly half the top-k breaks the consensus. If your corpus ingests from public sources — GitHub issues, forum threads, partner submissions — rate-limiting per source is the complement to any geometric filter. The same principle applies to multi-agent systems where poison arrives via peer messages.
The abstain path matters more than the filter. When RAGSentinel drops the top result, the LLM must say “I don’t know” rather than fall back on parametric memory. NIST’s AI RMF Generative AI Profile treats unwarranted confidence as its own harm category.
Where we place it
CAI Technology treats retrieval defense as a runtime concern, not a training-time one. Geometric consensus filters belong on the same layer as per-tenant cost accounting for RAG workloads — after retrieval, before generation, with an audit trail that survives incident review under Article 15 of the EU AI Act. If you are wiring a RAG stack for a regulated tenant this quarter, start with the filter and the abstain policy, not the encoder benchmarks.