AI 安全
RAGSieve Uses Retrieval Results as Its Own Baseline, Cutting RAG Poisoning Success from 67.4% to 14.0% with Two-Stage Filtering
RAGSieve requires neither a trusted corpus nor pre-labeled poisoned samples. Instead, it separately compares the tail of the query ranking and each document’s local semantic neighborhood. Open-source experiments cover three question-answering datasets, three retrievers, and six attacks, but a single fluent poisoned document and an already-compromised retrieval tail may still evade detection.
The newly released RAGSieve splits defenses against RAG knowledge poisoning into two layers: query-time and index-time. Rather than determining whether a document’s content is true or false, its core approach looks for local statistical anomalies left behind by attackers attempting to improve document rankings. The online RSQ module retrieves the top 20 documents for each query and compares the top five actually sent to the generator against a query-specific reference tail comprising documents ranked sixth through twentieth. It simultaneously measures answer-anchor concentration, writing-system integrity, local language-model surprisal, and abrupt changes in document-query alignment.
The offline RSG module scans the entire index without requiring queries. For each document, it finds semantically similar but lexically different neighbors, then compares increases in local density against the neighborhood’s own baseline. This avoids the need to set different global similarity thresholds for different corpora. Both modules construct their references from the system under evaluation and require no external corpus known to be clean.
In tests on NQ, HotpotQA, and MS MARCO using BGE-M3, E5-large-v2, and MiniLM-L6-v2, along with six poisoning methods, RSQ achieved a macro-average AUROC of 95.2% and detected 82.2% of poisoned documents under a budget permitting removal of no more than 5% of clean documents. RSG achieved 93.3% and 79.8%, respectively. With both layers applied sequentially, the attack success rate fell from 67.4% without defenses to 14.0%, while answer F1 on unpoisoned retrieval declined slightly from 42.1 to 41.3. The trade-off is that RSQ adds an average of about 447 milliseconds per query, while RSG takes 46.54 seconds to scan approximately 128,500 documents.
This is not a fact-checker. Legitimate documents that repeatedly converge on the same answer may also be quarantined. A single fluent poisoned document may not create the graph density required by RSG, while a large number of poisoned documents entering ranks six through twenty can contaminate RSQ’s reference group. The public repository includes an MIT-licensed implementation, tests, three corpora, and a small demonstration, but it does not provide the complete attack suite or all raw result files. As a next step, deployers should tune the online and offline thresholds according to the cost of false positives in their own indexes and add adaptive attack tests targeting the detector itself.