ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning

• URL: http://arxiv.org/abs/2603.22934v2
• Date: Fri, 27 Mar 2026 20:58:54 GMT
• Title: ProGRank: Probe-Gradient Reranking to Defend Dense-Retriever RAG from Corpus Poisoning
• Abstract summary: Retrieval-Augmented Generation (RAG) improves reliability of large language model applications by grounding generation in retrieved evidence.<n>An adversary injects or edits passages so that they are ranked into the Top-$K$ results for target queries and then affect downstream generation.<n>We propose ProGRank, a post hoc, training-free retriever-side defence for dense-retriever RAG.
• Score: 5.725082598014574
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Retrieval-Augmented Generation (RAG) improves the reliability of large language model applications by grounding generation in retrieved evidence, but it also introduces a new attack surface: corpus poisoning. In this setting, an adversary injects or edits passages so that they are ranked into the Top-$K$ results for target queries and then affect downstream generation. Existing defences against corpus poisoning often rely on content filtering, auxiliary models, or generator-side reasoning, which can make deployment more difficult. We propose ProGRank, a post hoc, training-free retriever-side defence for dense-retriever RAG. ProGRank stress-tests each query--passage pair under mild randomized perturbations and extracts probe gradients from a small fixed parameter subset of the retriever. From these signals, it derives two instability signals, representational consistency and dispersion risk, and combines them with a score gate in a reranking step. ProGRank preserves the original passage content, requires no retraining, and also supports a surrogate-based variant when the deployed retriever is unavailable. Extensive experiments across three datasets, three dense retriever backbones, representative corpus poisoning attacks, and both retrieval-stage and end-to-end settings show that ProGRank provides stronger defence performance and a favorable robustness--utility trade-off. It also remains competitive under adaptive evasive attacks.

Related papers

• RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation [9.458292549037155]
  We propose RAGSentinel, a training-free, label-free defense for black-box RAG systems.<n>RaGSentinel consistently achieves low attack success rates while preserving competitive accuracy.
  arXiv  Detail & Related papers  (2026-08-25T01:44:07Z)
• R$^3$AG: Retriever Routing for Retrieval-Augmented Generation [59.47703698994575]
  R$3$AG decomposes retriever capability into two learnable dimensions: retrieval quality and generation utility.<n>R$3$AG consistently outperforms both the best individual retrievers and state-of-the-art static routing methods.
  arXiv  Detail & Related papers  (2026-04-22T06:51:20Z)
• Rethinking the Reranker: Boundary-Aware Evidence Selection for Robust Retrieval-Augmented Generation [64.09110141948693]
  Retrieval-Augmented Generation (RAG) systems remain brittle under realistic retrieval noise.<n>We propose BAR-RAG, which reframes the reranker as a boundary-aware evidence selector that targets the generator's Goldilocks Zone.<n>Bar-RAG consistently improves end-to-end performance under noisy retrieval.
  arXiv  Detail & Related papers  (2026-02-03T16:08:23Z)
• RAGPart & RAGMask: Retrieval-Stage Defenses Against Corpus Poisoning in Retrieval-Augmented Generation [43.85099769473328]
  Retrieval-Augmented Generation (RAG) has emerged as a promising paradigm to enhance large language models.<n>Recent studies have exposed a critical vulnerability in RAG pipelines corpus poisoning where adversaries inject malicious documents into the retrieval corpus to manipulate model outputs.<n>We propose two complementary retrieval-stage defenses: RAGPart and RAGMask.
  arXiv  Detail & Related papers  (2025-12-30T14:43:57Z)
• Rescuing the Unpoisoned: Efficient Defense against Knowledge Corruption Attacks on RAG Systems [11.812488957698038]
  Large language models (LLMs) are reshaping numerous facets of our daily lives, leading widespread adoption as web-based services.<n>Retrieval-Augmented Generation (RAG) has emerged as a promising direction by generating responses grounded in external knowledge sources.<n>Recent studies demonstrate the vulnerability of RAG, such as knowledge corruption attacks by injecting misleading information.<n>In this work, we introduce RAGDefender, a resource-efficient defense mechanism against knowledge corruption.
  arXiv  Detail & Related papers  (2025-11-03T06:39:58Z)
• Disabling Self-Correction in Retrieval-Augmented Generation via Stealthy Retriever Poisoning [14.419943772894754]
  Retrieval-Augmented Generation (RAG) has become a standard approach for improving the reliability of large language models (LLMs)<n>This paper uncovers that such attacks could be mitigated by the strong textitself-correction ability (SCA) of modern LLMs.<n>We introduce textscDisarmRAG, a new poisoning paradigm that compromises the retriever itself to suppress the SCA and enforce attacker-chosen outputs.
  arXiv  Detail & Related papers  (2025-08-27T17:49:28Z)
• DeRAG: Black-box Adversarial Attacks on Multiple Retrieval-Augmented Generation Applications via Prompt Injection [0.9499594220629591]
  Adrial prompt attacks can significantly alter the reliability of Retrieval-Augmented Generation (RAG) systems.<n>We present a novel method that applies Differential Evolution (DE) to optimize adversarial prompt suffixes for RAG-based question answering.
  arXiv  Detail & Related papers  (2025-07-20T16:48:20Z)
• The Silent Saboteur: Imperceptible Adversarial Attacks against Black-Box Retrieval-Augmented Generation Systems [101.68501850486179]
  We explore adversarial attacks against retrieval-augmented generation (RAG) systems to identify their vulnerabilities.<n>This task aims to find imperceptible perturbations that retrieve a target document, originally excluded from the initial top-$k$ candidate set.<n>We propose ReGENT, a reinforcement learning-based framework that tracks interactions between the attacker and the target RAG.
  arXiv  Detail & Related papers  (2025-05-24T08:19:25Z)
• Corpus Poisoning via Approximate Greedy Gradient Descent [48.5847914481222]
  We propose Approximate Greedy Gradient Descent, a new attack on dense retrieval systems based on the widely used HotFlip method for generating adversarial passages. We show that our method achieves a high attack success rate on several datasets and using several retrievers, and can generalize to unseen queries and new domains.
  arXiv  Detail & Related papers  (2024-06-07T17:02:35Z)
• Invariance-powered Trustworthy Defense via Remove Then Restore [7.785824663793149]
  Adrial attacks pose a challenge to the deployment of deep neural networks (DNNs) Key finding is that salient attack in an adversarial sample dominates the attacking process. A Pixel Surgery and Semantic Regeneration model following the targeted therapy mechanism is developed.
  arXiv  Detail & Related papers  (2024-02-01T03:34:48Z)
• Towards Robust Ranker for Text Retrieval [83.15191578888188]
  A ranker plays an indispensable role in the de facto'retrieval & rerank' pipeline. A ranker plays an indispensable role in the de facto'retrieval & rerank' pipeline.
  arXiv  Detail & Related papers  (2022-06-16T10:27:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.