AI 安全
RAGSieve Uses Retrieval Results as Its Own Baseline, Cutting RAG Poisoning Success from 67.4% to 14.0% with Two-Stage Filtering
RAGSieve requires neither a trusted corpus nor pre-labeled poisoned samples. Instead, it separately compares the tail of the query ranking and each document’s local semantic neighborhood. Open-source experiments cover three question-answering datasets, three retrievers, and six attacks, but a single fluent poisoned document and an already-compromised retrieval tail may still evade detection.