GuardRAG: A Post-Retrieval Defense against Poisoning Attacks in Retrieval-Augmented Generation

Summary

GuardRAG is a training-free, plug-and-play post-retrieval defense against corpus poisoning in Retrieval-Augmented Generation. It expands retrieval, removes near-duplicate candidates, clusters the retained documents with Hierarchical Agglomerative Clustering using a query-adaptive threshold, then scores and prunes suspicious clusters by query relevance, cluster size and semantic compactness. Experiments across three question-answering datasets, multiple poisoning attacks and six LLMs show it substantially reduces attack success rates while maintaining answer utility under clean retrieval.

Topics

• Retrieval-augmented generation

Related items

• InfoRanking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning DefensesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoProtection Is Not One Event: A Survey of RAG Protection Research by Measured EndpointSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPerMIT: Securing Persistent Memory for LLM Agents via Machine-Checked Integrity Theorems and Scalable Community TrustSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoContext-Aware Prompt Injection Detection via Small Language Models in RAG Pipelines: nokast-secureRAGSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoRAGLeak: Supply-Chain Privacy Backdoors in Retrieval-Augmented GenerationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)