TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning

• URL: http://arxiv.org/abs/2609.00470v1
• Date: Mon, 31 Aug 2026 23:21:27 GMT
• Title: TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning
• Abstract summary: Tri-Layer Sieve sanitizes retrieved evidence through cross-embedding-space clustering.<n>It exploits a key weakness of retrieval-stage poisoning: a single document must satisfy one embedding geometry, one internal Trigger-Payload structure, and one generation objective.
• Score: 6.613886785198943
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Retrieval-Augmented Generation (RAG) grounds large language models in external corpora, but implicit trust in retrieved documents creates a critical attack surface: PoisonedRAG shows that a handful of crafted passages can dominate dense retrieval and steer generation toward attacker-chosen answers. We present the Tri-Layer Sieve, a middleware defense that sanitizes retrieved evidence through cross-embedding-space clustering with an independent judge model, structural filtering of trigger-payload artifacts, and LLM consistency verification. The design exploits a key weakness of retrieval-stage poisoning: a single document must satisfy one embedding geometry, one internal Trigger-Payload structure, and one generation objective - rarely all three simultaneously, a fragility that persists even against an adaptive attacker who paraphrases around it. On Natural Questions, HotpotQA, and MS-MARCO with Contriever retrieval (k=50), the Sieve reduces black-box Attack Success Rate from 67.0/87.0/64.0% to 3.0/14.0/4.0%, mitigates white-box HotFlip attacks from ~74% to 27.8% on NQ with Layer 3 enabled, and drives poisoned-document MRR to 0.000, while restoring clean accuracy from 13-33% under attack to 58-76%. Under an architecture-aware adversary who paraphrases triggers to evade the structural filter, enabling the consistency layer halves adaptive ASR (32.0% to 15.0% on NQ) while raising clean accuracy by 18 points, at an added latency of ~16-19 s/query under live retrieval.

Related papers

• MechAudit-40: White-Box Auditing across 40 LLM Attack Mechanisms [16.312485460260056]
  MechAudit-40 is a systematic evaluation of 40 attack mechanisms across five open-weight model architectures.<n>Attacks induce structured multi-depth trajectories rather than isolated layer spikes.<n> MechAudit detects 81.1% of held-out attack executions at a 0.70% false-positive rate and maintains 78.1% recall when an entire functional category is withheld.
  arXiv  Detail & Related papers  (2026-09-06T13:57:41Z)
• RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation [0.0]
  Existing detectors depend on trusted references, specific attack artifacts, or global thresholds sensitive to corpus topology.<n>We present RAGSieve, a self-referenced detection framework that constructs its reference from the inspected system.<n>Joint deployment reduces attack success from 67.4% to 14.0% while retaining 41.3% F1 on unpoisoned retrieval.
  arXiv  Detail & Related papers  (2026-08-13T09:29:48Z)
• Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection [0.0]
  We present RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense.<n>Under prompt injection, multi-document retrieval limits label-flip success to 0.6-2.4%, compared with 35-55% for single-document retrieval.
  arXiv  Detail & Related papers  (2026-08-08T12:29:47Z)
• Salience Induction against Multi-Hop RAG Agents: Threat and Defense [13.060227960421171]
  We formalize Salience Induction as truth-preserving edits that redirect Multi-Hop binding while leaving the retrieval trace semantically intact.<n>Under a 30% edit budget, Salience Induction achieves an 83.3% attack success rate.<n>Our lightweight input-side defense, Salience Normalization, reduces attack success to 15.3% under standard attacks and 23.6% under an adaptive attack.
  arXiv  Detail & Related papers  (2026-07-20T04:27:50Z)
• MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models [53.05463623673949]
  MaskForge is a fully black-box adaptive attack that casts dLLM red-teaming as optimized search over a growing library of structural patterns.<n>It achieves an average attack success rate of 79.3%, a 17.6% improvement over the strongest competing dLLM baseline.
  arXiv  Detail & Related papers  (2026-06-01T18:10:21Z)
• Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning [0.0]
  RAG systems are vulnerable to knowledge base poisoning, yet existing attacks have been evaluated almost exclusively against vanilla retrieve-then-generate pipelines.<n>We evaluate four RAG architectures (vanilla RAG, agentic RAG, MADAM-RAG, and Recursive Language Models) under controlled single-document poisoning on 921 Natural Questions QA pairs.
  arXiv  Detail & Related papers  (2026-05-07T03:36:14Z)
• Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems [0.0]
  Retrieval-Augmented Generation (RAG) systems extend large language models with external knowledge sources.<n>In particular, adversaries can poison retrieval corpora so that malicious documents are preferentially retrieved at inference time.<n>We study gradient-guided corpus poisoning attacks against modern RAG pipelines and evaluate retrieval-layer defenses.
  arXiv  Detail & Related papers  (2026-03-10T23:15:13Z)
• BiRQA: Bidirectional Robust Quality Assessment for Images [49.74447451098852]
  Full-Reference image quality assessment (FR IQA) is important for image compression, restoration and generative modeling.<n>We present BiRQA, a compact FR IQA metric model that processes four fast complementary features within a bidirectional multiscale pyramid.<n>On five public FR IQA benchmarks BiRQA outperforms or matches the previous state of the art (SOTA) while running 3x faster than previous SOTA models.
  arXiv  Detail & Related papers  (2026-02-23T20:52:56Z)
• BadCLIP++: Stealthy and Persistent Backdoors in Multimodal Contrastive Learning [73.46118996284888]
  Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence.<n>We propose BadCLIP++, a unified framework that tackles both challenges.<n>For stealthiness, we introduce a semantic-fusion QR micro-trigger that embeds imperceptible patterns near task-relevant regions.<n>For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment.
  arXiv  Detail & Related papers  (2026-02-19T08:31:16Z)
• AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications [71.27518152526686]
  Large Language Models (LLMs) excel at text comprehension and generation, making them ideal for automated tasks like code review and content moderation.<n>LLMs can be manipulated by "adversarial instructions" hidden in input data, such as resumes or code, causing them to deviate from their intended task.<n>This paper introduces a benchmark to assess this vulnerability in resume screening, revealing attack success rates exceeding 80% for certain attack types.
  arXiv  Detail & Related papers  (2025-12-23T08:42:09Z)
• Revisiting Backdoor Attacks on LLMs: A Stealthy and Practical Poisoning Framework via Harmless Inputs [54.90315421117162]
  We propose a novel poisoning method via completely harmless data.<n>Inspired by the causal reasoning in auto-regressive LLMs, we aim to establish robust associations between triggers and an affirmative response prefix.<n>We observe an interesting resistance phenomenon where the LLM initially appears to agree but subsequently refuses to answer.
  arXiv  Detail & Related papers  (2025-05-23T08:13:59Z)
• Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIP [51.04452017089568]
  Class-wise Backdoor Prompt Tuning (CBPT) is an efficient and effective defense mechanism that operates on text prompts to indirectly purify CLIP.<n>CBPT significantly mitigates backdoor threats while preserving model utility.
  arXiv  Detail & Related papers  (2025-02-26T16:25:15Z)
• Improved Generation of Adversarial Examples Against Safety-aligned LLMs [72.38072942860309]
  Adversarial prompts generated using gradient-based methods exhibit outstanding performance in performing automatic jailbreak attacks against safety-aligned LLMs. In this paper, we explore a new perspective on this problem, suggesting that it can be alleviated by leveraging innovations inspired in transfer-based attacks. We show that 87% of the query-specific adversarial suffixes generated by the developed combination can induce Llama-2-7B-Chat to produce the output that exactly matches the target string on AdvBench.
  arXiv  Detail & Related papers  (2024-05-28T06:10:12Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.