RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation

2026-08-24

AI Summary

本文提出RAGSentinel，通过几何共识方法过滤恶意文档，解决检索增强生成模型中的安全漏洞问题。

Abstract

Retrieval-augmented generation (RAG) improves the factuality of large language models by grounding responses in external documents, but it also exposes a critical security vulnerability: adversarial documents injected into the knowledge database can enter the context window and steer the model toward targeted incorrect answers. Existing post-retrieval defenses rely on instruction following, parametric knowledge, or text-level consistency, all of which can be imitated or optimized against by adaptive attackers. We propose RAGSentinel, a training-free, label-free defense for black-box RAG systems. RAGSentinel uses a surrogate encoder to measure query-conditioned hidden-state shifts induced by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. We prove that, under an honest-majority assumption and a representation-level separation condition, RAGSentinel exactly recovers a poison-free majority-sized context. Experiments across three question-answering datasets, three LLM families, and multiple poisoning attacks show that RAGSentinel consistently achieves low attack success rates while preserving competitive accuracy and remaining effective against adaptive attacks with full pipeline knowledge.

Problem

• Retrieval-augmented generation
• Security vulnerability
• Adversarial documents
• Post-retrieval defenses

Innovation

• RAGSentinel
• Geometric Consensus
• Robust Retrieval-Augmented Generation
• Adversarial Document Filtering
• Black-Box Defense