Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution

2026-06-24

AI Summary

This work addresses the vulnerability of Retrieval-Augmented Generation (RAG) systems to corpus poisoning attacks, wherein adversaries inject malicious documents to manipulate model outputs. Existing detection approaches often incur high computational overhead. To overcome this limitation, the authors propose TRACE, a lightweight framework that identifies poisoned documents and recovers the attacker-specified target answers without requiring auxiliary classifiers or large-model verification. TRACE leverages token-level influence attribution to trace the critical sources contributing to generated answers, integrating high-frequency, high-impact keyword mining with a two-stage verification mechanism. Extensive experiments across three question-answering benchmarks and six large language models demonstrate that TRACE significantly outperforms current methods in both attack detection accuracy and target answer recovery capability.

Abstract

Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate model outputs through malicious retrieved documents. Existing detection methods typically rely on auxiliary classifiers or additional LLM-based verification, introducing substantial computational overhead. We present TRACE, a lightweight detection framework that identifies poisoning attacks by tracing answer-related tokens through token influence attribution. TRACE first discovers recurrent high-influence keywords across retrieved documents and then performs a secondary verification to confirm their influence on model predictions. Experiments on three QA benchmarks and six LLMs demonstrate strong detection performance while simultaneously uncovering attacker-specified target answers.

Problem

• corpus poisoning
• Retrieval-Augmented Generation
• token influence attribution
• poisoning attacks
• target answers

Innovation

• token influence attribution
• corpus poisoning detection
• Retrieval-Augmented Generation
• lightweight detection
• target answer tracing