RAGuard: Two-Layer Defense Against RAG Corpus Poisoning
By mid-2026 the question is no longer whether a retrieval-augmented generation stack can be poisoned, but how cheaply.
RAGuard: Two-Layer Defense Against RAG Corpus Poisoning
By mid-2026 the question is no longer whether a retrieval-augmented generation stack can be poisoned, but how cheaply. Public leaderboards on Natural Questions now include adversarial forks where a single 5% corpus contamination pushes attack success rate above 0.90. A recent arXiv preprint, RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning, takes that failure mode head-on with a two-layer design worth reading closely.
What the paper actually claims
RAGuard combines two orthogonal defenses. The first is adversarial fine-tuning of a dense retriever on synthetic poisoned documents — the retriever learns to down-rank passages exhibiting known poisoning signatures. The second is the Zero-Knowledge Inference Patch (ZKIP), a leave-one-out decoding routine that flags malicious passages without labels and without any access to model internals. On poisoned Natural Questions across 5–30% poison ratios, ZKIP drives attack success rate to 0.000 while holding Recall@5 within 0.03 of the clean baseline. The tax: k+1 generator passes per query, where k is the number of retrieved passages.
That cost matters. A stack retrieving top-8 passages now runs 9 generator calls per user query. For a workload issuing 10M queries/month, that is not a rounding error — it is an operational line item that lands squarely in the cost model our own engineering notes on per-tenant RAG accounting treat as a first-class SLO.
How the flow looks in production
Leave-one-out decoding is the interesting primitive. For each retrieved passage p_i, the generator produces an answer with p_i excluded. If dropping p_i causes a large distributional shift in the output, p_i is treated as suspect — the intuition being that a poisoned passage exerts disproportionate influence on generation. A representative telemetry line looks like:
2026-06-11T09:22:47Z ragguard.zkip q_id=nq-4471 k=8
base_logprob=-3.12 loo_deltas=[0.04,0.02,4.71,0.03,0.01,0.02,0.05,0.03]
dropped_idx=2 asr_baseline=0.91 asr_after=0.00Where this fits the wider defense picture
RAGuard sits in the “detect at inference” band of the OWASP Top 10 for LLM Applications 2025 — specifically LLM03 (Training Data Poisoning) and LLM06 (Sensitive Information Disclosure via poisoned context). It complements corpus-side hygiene recommended by ENISA’s 2024 AI threat landscape and the trustworthiness controls in NIST AI RMF 1.0. None of those replace pre-ingestion provenance checks, which the European Commission’s Q4 2025 AI Act implementation brief treats as an accountability control under Article 10.
At CAI Technology we read the k+1 tax as a design forcing function. Adversarial retriever fine-tuning is a background cost; ZKIP is a foreground cost users pay every query. Our position: apply ZKIP selectively — gated by retriever confidence, tenant risk class, and query sensitivity — rather than uniformly. A poisoned answer to a compliance question is not the same failure as a poisoned answer to a menu recommendation, and pricing them identically wastes budget you will need elsewhere. Practitioners standing up a defense program can start with our threat map for RAG pipelines.