Consistency Is the Attack Surface: Detecting Coordinated Retrieval Poisoning with Embedding Geometry

Summary

This research paper shows that coordinated retrieval poisoning in RAG systems leaves a detectable fingerprint: a dense, query-anchored component in the evidence embedding geometry. The authors' CoordGuard auditor flags this structure from query-weighted affinities without poison labels, answers or reader gradients. Pooling four Natural Questions retrieval seeds, e5 always-filtering cuts exposure-conditional attack success to 0.167 at a 13.6-point clean accuracy cost.

Mitigation

CoordGuard, an auditor that suppresses the selected coordinated component. It runs in an always-filter mode or a benign-calibrated gate that trades robustness against clean-accuracy utility, as described in the source.

Related items

• InfoRAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented GenerationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSAFE-Mem: Secure Agentic Memory with Fine-Grained Authority and Governance-Aware RetrievalSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoFrom knowledge retrieval to generation: a comprehensive study of RAG's architectures, evolution, and applicationsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoTop GenAI security resources — October 2026Similar attack · Adversa AI Blog
• InfoA Security Meta-Model for Retrieval-Augmented Generation SystemsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)