🤖 AI Summary
This work addresses the vulnerability of existing retrieval-augmented intrusion detection systems (RAG-IDS) to knowledge poisoning and prompt injection attacks, which degrade performance and induce high false-positive rates. To mitigate these threats, the authors propose a novel three-tier multi-agent RAG-IDS framework that integrates soft trust scoring, label embedding consistency checking (LECC), and prompt sanitization mechanisms to establish a robust retrieval-boundary defense. Experimental results demonstrate substantial improvements in system robustness: under 30% knowledge poisoning on the CIC-UNSW-NB15 dataset, the approach achieves a classification performance recovery rate of 0.57; under prompt injection attacks, the label-flipping success rate is reduced to 0.6–2.4%, significantly outperforming single-document retrieval baselines, which exhibit rates of 35–55%.
📝 Abstract
Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities to knowledge poisoning and prompt-injection attacks. We present RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization, designed to recover classification quality under retrieval-layer attack. Experiments on CIC-UNSW-NB15 show recovery relative to clean undefended performance ranging from R=1.0 at 1% poisoning to R=0.57 at 30%, with negligible clean-performance overhead. Under prompt injection, multi-document retrieval limits label-flip success to 0.6-2.4%, compared with 35-55% for single-document retrieval. Ablation results show that LECC is the primary contributor to robustness, while soft trust-based demotion outperforms hard filtering. The defended RAG pipeline offers an explainable, attack-resilient foundation for intrusion detection, well suited for hybrid deployment alongside high-throughput classifiers.