TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

• URL: http://arxiv.org/abs/2607.23838v1
• Date: Sun, 26 Jul 2026 20:52:23 GMT
• Title: TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
• Abstract summary: Retrieval-Augmented Generation lets a large language model answer questions using documents retrieved from an external knowledge base at query time.<n>If the knowledge base accepts writes from more than one party, an attacker needs only a handful of adversarial documents to steer the model toward a chosen wrong answer.<n>PoisonedRAG demonstrated this: as few as five crafted documents flip an undefended system's answer roughly 90% of the time.
• Score: 1.5474833458331865
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Retrieval-Augmented Generation (RAG) lets a large language model answer questions using documents retrieved from an external knowledge base at query time. This makes RAG useful for private data, fast-changing information, and reducing hallucination, but it also means the model's answer is only as trustworthy as whatever the retriever hands it. If the knowledge base accepts writes from more than one party, an attacker needs only a handful of adversarial documents to steer the model toward a chosen wrong answer. PoisonedRAG demonstrated this: as few as five crafted documents flip an undefended system's answer roughly 90% of the time, and three natural single-stage defenses (perplexity filtering, query paraphrasing, knowledge-base expansion) leave attack success at 30% or higher. We built TriShieldRAG to close that gap. Rather than relying on one checkpoint, we place three independent, formally specified rings across the pipeline: an Ingest Guard that screens documents for lexical and statistical poisoning signatures; a Retrieval Scorer that re-ranks the retrieved set by a provenance and consistency-weighted trust score; and a Cross-LLM Consensus stage that polls three architecturally diverse language models (Claude, Mistral Small, Llama 3.2) and allows one bounded re-retrieval on disagreement. We derive the conditions under which Rings 2 and 3 are expected to work: a minority-poison assumption and an explicit provenance-tag assumption. Our reported configuration is consistent with this analysis, though we have not yet run the controlled poison-fraction sweep needed to confirm it independently. Evaluated against the non-adaptive attacker from the original PoisonedRAG, over a 5,000-document Wikipedia knowledge base with 10 target questions, the full pipeline reduces attack success rate from roughly 91% to roughly 13% while preserving accuracy on benign queries.

Related papers

• In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning [0.0]
  We study how much a small quantized model, Llama 3.1 8B, degrades when a fraction of its retrieved context is poisoned.<n> Accuracy falls from 77.9% on clean context to 43.5% when all three passages are corrupted.
  arXiv  Detail & Related papers  (2026-09-08T08:31:57Z)
• Cross-Session Decomposition Attacks: Scaling Risk and Intent-Aligned Retrieval Defense [49.05879299987137]
  Scaling laws are usually read as a capability story: lower language-modeling loss yields more useful models.<n>We study a safety consequence of this mechanism in emphcross-session decomposition attacks, where benign-looking subqueries are asked across independent interactions and later recomposed toward a forbidden objective.<n>We formalize this setting as emphcompositional safety risk and prove a conditional risk-transfer bound.
  arXiv  Detail & Related papers  (2026-08-28T05:39:29Z)
• RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation [9.458292549037155]
  We propose RAGSentinel, a training-free, label-free defense for black-box RAG systems.<n>RaGSentinel consistently achieves low attack success rates while preserving competitive accuracy.
  arXiv  Detail & Related papers  (2026-08-25T01:44:07Z)
• DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial [7.434105792757549]
  We propose emphDenialRAG, a single-document poisoning attack that explicitly names the correct answer, denies it, and presents an attacker-controlled explanation.<n>DenialRAG embeds the conflict directly into the context seen by the generator.<n>We evaluate DenialRAG against four published single-document poisoning attacks across three open-domain question-answering datasets.
  arXiv  Detail & Related papers  (2026-08-02T20:33:05Z)
• RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning [0.0815557531820863]
  We introduce RAGuard, a layered defense against emphfactual corpus-poisoning attacks on pipelines.<n>The first layer fine-tunes a dense retriever on synthetic poisoned documents (fabricated facts, contradictions, and reasoning traps)<n>The second layer, the ZeroKnowledge Patch ZKIP, is a label-free, black-box filter.
  arXiv  Detail & Related papers  (2026-07-28T23:21:04Z)
• Salience Induction against Multi-Hop RAG Agents: Threat and Defense [13.060227960421171]
  We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop binding while leaving the retrieval trace semantically intact.<n>Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate.<n>Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack.
  arXiv  Detail & Related papers  (2026-07-20T04:27:50Z)
• AdversarialCoT: Single-Document Retrieval Poisoning for LLM Reasoning [115.3243260783674]
  Retrieval-augmented generation (RAG) enhances large language model (LLM) reasoning by retrieving external documents.<n>We study knowledge-base poisoning attacks in RAG, where an attacker injects malicious content into the retrieval corpus.<n>We propose AdversarialCoT, a query-specific attack that poisons only a single document in the corpus.
  arXiv  Detail & Related papers  (2026-04-14T02:10:23Z)
• ConfRAG: Confidence-Guided Retrieval-Augmenting Generation [41.78313747240249]
  We introduce ConfQA, a fine-tuning strategy that reduces hallucination rates from 20-40% to below 5% across multiple factuality benchmarks.<n>We propose ConfRAG, a triggering strategy that invokes RAG only when the model responses with unsure.<n>This framework achieves accuracy above 95% in ideal case while reducing unnecessary external retrievals by over 30%.
  arXiv  Detail & Related papers  (2025-06-08T22:51:46Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• GRADA: Graph-based Reranking against Adversarial Documents Attack [34.387997687424004]
  Adversarial Document Attacks manipulate the retrieval process by introducing documents that are adversarial yet semantically similar to the query.<n>We propose a Graph-based Reranking against Adversarial Document Attacks framework aiming at preserving retrieval quality while significantly reducing the success of adversaries.
  arXiv  Detail & Related papers  (2025-05-12T13:27:35Z)
• Retrieval-Augmented Generation with Conflicting Evidence [57.66282463340297]
  Large language model (LLM) agents are increasingly employing retrieval-augmented generation (RAG) to improve the factuality of their responses.<n>In practice, these systems often need to handle ambiguous user queries and potentially conflicting information from multiple sources.<n>We propose RAMDocs (Retrieval with Ambiguity and Misinformation in Documents), a new dataset that simulates complex and realistic scenarios for conflicting evidence for a user query.
  arXiv  Detail & Related papers  (2025-04-17T16:46:11Z)
• Towards Copyright Protection for Knowledge Bases of Retrieval-augmented Language Models via Reasoning [58.57194301645823]
  Large language models (LLMs) are increasingly integrated into real-world personalized applications.<n>The valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries.<n>Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks.<n>We propose name for harmless' copyright protection of knowledge bases.
  arXiv  Detail & Related papers  (2025-02-10T09:15:56Z)
• Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation [18.098228823748617]
  We present Interrogation Attack (IA), a membership inference technique targeting documents in the RAG datastore.<n>We demonstrate successful inference with just 30 queries while remaining stealthy.<n>We observe a 2x improvement in TPR@1%FPR over prior inference attacks across diverse RAG configurations.
  arXiv  Detail & Related papers  (2025-02-01T04:01:18Z)
• PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models [45.409248316497674]
  Large language models (LLMs) have achieved remarkable success due to their exceptional generative capabilities. Retrieval-Augmented Generation (RAG) is a state-of-the-art technique to mitigate these limitations. We find that the knowledge database in a RAG system introduces a new and practical attack surface. Based on this attack surface, we propose PoisonedRAG, the first knowledge corruption attack to RAG.
  arXiv  Detail & Related papers  (2024-02-12T18:28:36Z)
• A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks [72.7373468905418]
  We develop an open-source toolkit OpenBackdoor to foster the implementations and evaluations of textual backdoor learning. We also propose CUBE, a simple yet strong clustering-based defense baseline.
  arXiv  Detail & Related papers  (2022-06-17T02:29:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.