RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning

# RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
Source: [https://arxiv.org/html/2607.26339](https://arxiv.org/html/2607.26339)
###### Abstract

Retrieval\-Augmented Generation \(RAG\) systems ground large language models \(LLMs\) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence\. We introduce RAGuard, a layered defense against*factual*corpus\-poisoning attacks on RAG pipelines\. The first layer adversarially fine\-tunes a dense retriever on synthetic poisoned documents \(fabricated facts, contradictions, and reasoning traps\), teaching it to downrank malicious passages before generation\. The second layer, the Zero\-Knowledge Inference Patch \(ZKIP\), is a label\-free, black\-box filter: for each retrieved document, it performs a leave\-one\-out decode and scores the document by the semantic shift and output\-entropy change that its removal induces\. ZKIP requires no poison labels, no ground\-truth answers, and no access to model internals; it compares the model’s own answers under counterfactual contexts\. On poisoned Natural Questions at 5–30% poison ratios, adversarial retriever training alone reduces but does not eliminate attack success, while ZKIP drives the measured attack success rate to 0\.000 in every defended configuration, keeping Recall@5 within 0\.03 of the clean\-corpus baseline\. Supervised analyses on both Natural Questions and BEIR \(NFCorpus\) confirm that the counterfactual signals ZKIP relies on carry learnable poison structure\. The defense costsk\+1k\{\+\}1generator passes per query \(6×6\\timesfork=5k\{=\}5\); we analyze batching and early\-stopping approximations that reduce this overhead\. We also show that keyword\-preserving poisons leave lexical retrievers such as BM25 essentially unaffected, an observation that delineates the boundary of the threat model\. Code, datasets, and evaluation harnesses are released for reproducibility\.

††footnotetext:An earlier version of this work was accepted to the NeurIPS 2025 Workshop on Responsible Foundation Models \(ResponsibleFM\) and AAAI 2026 Workshop on New Frontiers in Information Retrieval \(FrontierIR\)\. Code, datasets, and evaluation artifacts:[https://github\.com/RAGuard\-AI/RAGuard](https://github.com/RAGuard-AI/RAGuard)\.## 1Introduction

Retrieval\-Augmented Generation \(RAG\) has emerged as an effective method to ground Large Language Models \(LLMs\), retrieving external evidence so that responses reflect up\-to\-date, verifiable information rather than parametric memory alone\(Lewiset al\.,[2020](https://arxiv.org/html/2607.26339#bib.bib1); Asaiet al\.,[2024](https://arxiv.org/html/2607.26339#bib.bib2); Ramet al\.,[2023](https://arxiv.org/html/2607.26339#bib.bib3); Izacardet al\.,[2023](https://arxiv.org/html/2607.26339#bib.bib5)\)\. This grounding, however, creates a new attack surface: because generation trusts retrieved passages as evidence, an adversary who can write to the corpus can steer the model’s answers\. Data\-poisoning attacks inject documents that mimic relevant content yet contain false or misleading information, and only a handful of poisoned documents can mislead large models with high success rates\(Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10); Soulyet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib15); Wanget al\.,[2026](https://arxiv.org/html/2607.26339#bib.bib11); Longet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib13); Suet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib14)\)\.

Existing defenses have structural gaps\. Detection\-based filters rely on labeled poison examples or heuristic rules and fail against new attack styles\(Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10); Edemacuet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib17)\)\. Generator\-hardening approaches carry heavy inference cost and degrade when poisoned passages dominate the retrieved set\(Asaiet al\.,[2024](https://arxiv.org/html/2607.26339#bib.bib2); Shiet al\.,[2024](https://arxiv.org/html/2607.26339#bib.bib7)\)\. Adversarially trained retrievers depend on the synthetic poisons seen during training and risk overfitting to known poison types\(Lupart and Clinchant,[2023](https://arxiv.org/html/2607.26339#bib.bib8); Park and Chang,[2019](https://arxiv.org/html/2607.26339#bib.bib9)\)\. No single mechanism covers both the retrieval and generation stages\.

This work introduces RAGuard, a two\-layer defense\. The first layer adversarially fine\-tunes a dense retriever with contrastive training on synthetic poisoned documents—fabricated facts, contradictions, and reasoning traps—so that poisoned passages are downranked before they reach the generator\(Izacardet al\.,[2022](https://arxiv.org/html/2607.26339#bib.bib4); Leiet al\.,[2023](https://arxiv.org/html/2607.26339#bib.bib6); Lupart and Clinchant,[2023](https://arxiv.org/html/2607.26339#bib.bib8)\)\. The second layer, the Zero\-Knowledge Inference Patch \(ZKIP\), operates at generation time and is entirely*self\-referential*: given the top\-kkretrieved documents, it decodes a reference answer using the full context, then re\-decodes once per document with that document removed\. A document is flagged when its removal substantially shifts the answer’s semantics or lowers the model’s output uncertainty\. ZKIP never consults a ground\-truth answer, poison label, or external oracle; the only quantities it compares are the model’s own outputs under counterfactual contexts\. This makes the filter applicable to unseen attack types that bypass the trained retriever\.

We evaluate RAGuard on poisoned variants of Natural Questions \(NQ\)\(Kwiatkowskiet al\.,[2019](https://arxiv.org/html/2607.26339#bib.bib27)\)and BEIR \(NFCorpus\)\(Thakuret al\.,[2021](https://arxiv.org/html/2607.26339#bib.bib28)\)at poison ratios from 5% to 30%\. Our key contributions are:

- •A label\-free, black\-box inference\-time filter\.ZKIP scores each retrieved document by the answer instability and entropy differential its removal induces \(§[3\.4](https://arxiv.org/html/2607.26339#S3.SS4)\)\. It requires no poison labels, no gold answers, and no model internals, and it reduces the measured attack success rate \(ASR\) to 0\.000 for every retriever at every NQ poison ratio with a completed defended run \(§[4\.3](https://arxiv.org/html/2607.26339#S4.SS3)\)\.
- •A layered retrieval\-plus\-inference defense with measured layer contributions\.Adversarial retriever training alone leaves residual attack success \(ASR 0\.072 at NQ 10% poisoning\), while ZKIP alone and the combined system both eliminate it; the combination additionally preserves the adversarially trained retriever’s ranking quality \(§[4\.4](https://arxiv.org/html/2607.26339#S4.SS4)\)\.
- •A threat\-model analysis grounded in negative results\.Our keyword\-preserving poisons leave BM25\(Robertson and Zaragoza,[2009](https://arxiv.org/html/2607.26339#bib.bib29)\)essentially unaffected*without any defense*\(ASR 0\.000 at 5–20% poisoning and 0\.011 at 30%\), showing that the poisons exploit dense\-embedding semantics specifically\. We use this to delineate which attacks are in and out of scope \(§[4\.1](https://arxiv.org/html/2607.26339#S4.SS1), Appendix[B](https://arxiv.org/html/2607.26339#A2)\)\.

ZKIP carries a real cost:k\+1k\{\+\}1generator forward passes per query, a6×6\\timesinference overhead atk=5k\{=\}5\. We quantify this overhead and describe batching, early stopping, and subset\-sampling approximations \(§[5\.2](https://arxiv.org/html/2607.26339#S5.SS2)\)\. We scope our claims to factual question answering under corpus poisoning of dense retrieval; broader robustness claims would require evaluation against attack frameworks such as PoisonedRAG\(Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10)\)and FlippedRAG\(Chenet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib12)\), which we identify as the most important next step \(§[Limitations](https://arxiv.org/html/2607.26339#Sx1)\)\.

## 2Related Work

#### RAG and corpus poisoning\.

RAG\(Lewiset al\.,[2020](https://arxiv.org/html/2607.26339#bib.bib1)\)enhances LLMs by combining retrieval with generation, enabling factual grounding without retraining\. Recent studies show that RAG architectures are susceptible to data poisoning\. PoisonedRAG\(Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10)\)demonstrated that inserting adversarially crafted documents into retrieval corpora distorts ranking and generation\. Joint\-GCG\(Wanget al\.,[2026](https://arxiv.org/html/2607.26339#bib.bib11)\)extended this with unified gradient\-based attacks perturbing both retriever and generator embeddings\. Chain\-of\-thought poisoning\(Songet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib16)\)showed that reasoning\-style attacks targeting multi\-step prompts propagate errors across retrieval iterations, andSoulyet al\.\([2025](https://arxiv.org/html/2607.26339#bib.bib15)\)showed that a near\-constant number of poisoned documents suffices to compromise large models\. FlippedRAG\(Chenet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib12)\)demonstrated black\-box*opinion manipulation*attacks, a class we explicitly place outside our threat model \(Appendix[B](https://arxiv.org/html/2607.26339#A2)\)\.

#### Counterfactual and conflicting\-evidence datasets\.

Our synthetic poison construction \(§[3\.3](https://arxiv.org/html/2607.26339#S3.SS3)\) is related to a line of work that perturbs evidence to study model robustness\.Chenet al\.\([2022](https://arxiv.org/html/2607.26339#bib.bib19)\)construct conflicting\-evidence settings for open\-domain QA and recalibrate models to reflect disagreement among sources\.Panet al\.\([2023](https://arxiv.org/html/2607.26339#bib.bib20)\)study misinformation pollution of QA corpora using LLM\-generated false passages\.Honget al\.\([2024](https://arxiv.org/html/2607.26339#bib.bib21)\)build counterfactual\-noise variants of NQ and propose discriminator\-guided robustness training\. Our poisons differ in purpose rather than mechanism: instead of building a benchmark, we use LLM\-rewritten counterfactual passages as adversarial*training*signal for the retriever and as a controlled attack for evaluating the inference\-time filter\. Unlike these benchmark datasets, our poisons are parameterized by attack family \(fabrication, contradiction, reasoning trap\), letting us measure per\-family defense behavior\.

#### Defenses\.

Existing RAG poisoning defenses rely on input filtering, heuristic retriever fine\-tuning, or adversarial data augmentation\(Edemacuet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib17)\)\. These reduce known attack surfaces but often depend on labeled poison data or add heavy inference\-time cost\. Adversarial training for neural retrieval\(Lupart and Clinchant,[2023](https://arxiv.org/html/2607.26339#bib.bib8); Park and Chang,[2019](https://arxiv.org/html/2607.26339#bib.bib9)\)hardens ranking but, as we confirm empirically, does not by itself eliminate attack success\. Outside of NLP, black\-box counterfactual defenses have proven effective against backdoors in other modalities, e\.g\., zero\-shot image purification\(Shiet al\.,[2023](https://arxiv.org/html/2607.26339#bib.bib18)\); ZKIP brings a similarly black\-box, perturb\-and\-compare principle to retrieval contexts\.

#### Relation to attribution methods\.

Leave\-one\-out \(LOO\) influence estimation is an established tool in explainability and causal inference\(Johanssonet al\.,[2016](https://arxiv.org/html/2607.26339#bib.bib22); Prosperiet al\.,[2020](https://arxiv.org/html/2607.26339#bib.bib23); Molnar,[2025](https://arxiv.org/html/2607.26339#bib.bib24)\)\. Perturbation\-based attribution methods such as LIME\(Ribeiroet al\.,[2016](https://arxiv.org/html/2607.26339#bib.bib25)\)and SHAP\(Lundberg and Lee,[2017](https://arxiv.org/html/2607.26339#bib.bib26)\)likewise estimate a feature’s importance from output changes under input perturbation\. ZKIP borrows the LOO mechanism but answers a different question\. Attribution asks “which input was most*important*to the output?”; a gold passage and a poisoned passage can both be highly important\. ZKIP instead asks “which document’s*removal*makes the model’s answer more stable or less uncertain?”—a directional, security\-oriented query\. It also combines two signals \(semantic answer shift and entropy differential\) into a single anomaly score and applies the result as an online filter rather than a post\-hoc explanation\. Section[3\.4](https://arxiv.org/html/2607.26339#S3.SS4)makes this contrast precise\.

## 3Methods

### 3\.1Overall Architecture

Figure[1](https://arxiv.org/html/2607.26339#S3.F1)shows the architecture\. User queries pass through an adversarially fine\-tuned dense retriever \(Layer 1\)\. During training, the retriever is exposed to both clean and synthetically poisoned passages and learns to downrank documents whose embeddings deviate from normal semantic structure\. The top\-kkretrieved documents then pass through ZKIP \(Layer 2\), which flags and removes documents with anomalous causal influence on the generated answer before the final decode\. Components are modular: retrievers, generators, and defense layers can be swapped independently\.

![Refer to caption](https://arxiv.org/html/2607.26339v1/x1.png)Figure 1:RAGuard’s two\-layer defense\. A query passes through the adversarially trained retriever \(Layer 1\); ZKIP \(Layer 2\) runs one leave\-one\-out decode per retrieved document, scores each document’s causal influence on the answer, and removes flagged documents before the final generation\. No poison labels or gold answers are used at any stage of inference\.
### 3\.2Rationale

The dominant vulnerability of RAG systems sits in the retriever: poisoned documents that rank highly contaminate the generator’s context\. Rather than fine\-tuning the generator, RAGuard strengthens the retrieval process at its root and adds a generation\-time filter as a fail\-safe\. The two layers are complementary by design: adversarial training is*proactive*but limited to poison distributions seen during training, while ZKIP is*reactive*and attack\-agnostic because it measures the causal effect of each context element on the model’s own output\. A poison that evades the trained retriever still has to influence the answer to succeed, and that influence is exactly what ZKIP measures\.

### 3\.3Adversarial Training Data and Retriever Fine\-Tuning

#### Poison construction\.

To evaluate robustness against retrieval\-level poisoning, we construct poisoned variants of NQ and BEIR\. Starting from the original corpora, we sample 30% of query–document pairs and generate modified passages by prompting an LLM to rewrite each gold document according to an attack type\. We use three attack families: \(i\)*fabrication*poisons, which append falsified or hallucinated statements; \(ii\)*contradiction*poisons, which flip key factual tokens \(e\.g\., “true”→\\rightarrow“false”\); and \(iii\)*reasoning*poisons, which introduce misleading logical steps or corrupted intermediate claims\. Poisoned samples are distributed evenly across the three families\. The constructed datasets contain 12,344 total BEIR samples \(3,700 poisoned\) and 1,000 total NQ samples \(300 poisoned\); experiments substitute poisoned triples at controlled ratios \(5–30%\)\. Each record stores the query, the unmodified gold passage, the poisoned passage, and the attack\-family label, so every experiment is reproducible from the released JSONL files\.

#### Why synthetic poisons rather than existing counterfactual datasets\.

Prior work such asHonget al\.\([2024](https://arxiv.org/html/2607.26339#bib.bib21)\)provides counterfactual\-noise variants of NQ, andPanet al\.\([2023](https://arxiv.org/html/2607.26339#bib.bib20)\)studies LLM\-generated misinformation pollution\. We generate fresh synthetic poisons rather than reuse these corpora for three reasons\. First, our three attack families are parameterized adversarial classes not uniformly present in prior benchmarks, which primarily test model robustness to*conflicting evidence*rather than retrieval\-level poison defense\. Second, controlling the poison ratio \(5–30%\) requires generating exactly the right number of poisons per experimental condition; fixed prior datasets do not support this\. Third, generating poisons on both NQ and BEIR allows us to test transfer across domains\. The tradeoff is that our poisons are LLM rewrites rather than gradient\-optimized adversarial injections, which places a ceiling on measured ASR and may underestimate real\-world attack strength \(§[5\.3](https://arxiv.org/html/2607.26339#S5.SS3)\)\.

#### Retriever fine\-tuning\.

The dense retriever is initialized from theall\-MiniLM\-L6\-v2sentence encoder\(Reimers and Gurevych,[2019](https://arxiv.org/html/2607.26339#bib.bib31); Wanget al\.,[2020](https://arxiv.org/html/2607.26339#bib.bib30)\)and fine\-tuned with a triplet margin loss \(margin0\.20\.2\) over\{\\\{query, positive document, negative document\}\\\}triples:

ℒ=max⁡\(0,s​\(q,d−\)−s​\(q,d\+\)\+0\.2\),\\mathcal\{L\}=\\max\\\!\\bigl\(0,\\;s\(q,d^\{\-\}\)\-s\(q,d^\{\+\}\)\+0\.2\\bigr\),\(1\)wheres​\(⋅,⋅\)s\(\\cdot,\\cdot\)is the cosine similarity of Equation[2](https://arxiv.org/html/2607.26339#S3.E2),d\+d^\{\+\}is the gold passage, andd−d^\{\-\}is the negative\. We use triplet margin loss rather than InfoNCE with in\-batch negatives because in\-batch negatives would treat randomly co\-occurring passages as hard negatives indiscriminately; the explicit margin instead gives the model a clear signal for the exact semantics that distinguish each poison rewrite from its gold counterpart\.

Negative\-sampling strategy\.For*poisoned triples*the negatived−d^\{\-\}is the attack\-family\-specific LLM rewrite of that triple’s gold document—the precise passage the model must learn to rank below the gold\. This direct anti\-poison contrastive signal is the core mechanism by which the retriever becomes adversarially robust\. For*clean triples*the negative is a randomly sampled in\-corpus clean passage, providing general ranking discrimination\. We train for 3 epochs with AdamW, learning rate2×10−52\\times 10^\{\-5\}, batch size 16, max sequence length 256 tokens; 30% of training triples carry poisons, split evenly across the three attack families\. Full hyperparameters appear in Appendix[C](https://arxiv.org/html/2607.26339#A3)\. Retrieval uses cosine similarity between the query and document encoders:

s​\(q,d\)=cos⁡\(fθ​\(q\),gθ​\(d\)\)=fθ​\(q\)⋅gθ​\(d\)∥fθ​\(q\)∥​∥gθ​\(d\)∥,s\(q,d\)\\;=\\;\\cos\\big\(f\_\{\\theta\}\(q\),\\,g\_\{\\theta\}\(d\)\\big\)\\;=\\;\\frac\{f\_\{\\theta\}\(q\)\\cdot g\_\{\\theta\}\(d\)\}\{\\lVert f\_\{\\theta\}\(q\)\\rVert\\,\\lVert g\_\{\\theta\}\(d\)\\rVert\},\(2\)wherefθf\_\{\\theta\}andgθg\_\{\\theta\}map the queryqqand documentddto embeddings; Equation[2](https://arxiv.org/html/2607.26339#S3.E2)also supplies the ranking signal that ZKIP complements at generation time\.

#### Distribution\-shift caveat\.

Because the adversarially trained retriever is fine\-tuned on synthetic poisons over gold documents, it may partially memorize gold relevance for the training queries and behave less reliably on unseen query–document pairs\. Two design choices mitigate, but do not eliminate, this risk: the poison families are stylistically diverse rewrites rather than fixed templates, and ZKIP sits behind the retriever as an attack\-agnostic safety net\. We treat held\-out\-domain evaluation of the adversarially trained retriever as required future work and do not claim it generalizes beyond the evaluated distributions \(§[Limitations](https://arxiv.org/html/2607.26339#Sx1)\)\.

### 3\.4Zero\-Knowledge Inference Patch \(ZKIP\)

#### Relation to LOO attribution, and what is new\.

Leave\-one\-out probing is an established technique in explainability and counterfactual inference\(Johanssonet al\.,[2016](https://arxiv.org/html/2607.26339#bib.bib22); Prosperiet al\.,[2020](https://arxiv.org/html/2607.26339#bib.bib23); Molnar,[2025](https://arxiv.org/html/2607.26339#bib.bib24)\), and perturbation\-based attribution methods such as LIME\(Ribeiroet al\.,[2016](https://arxiv.org/html/2607.26339#bib.bib25)\)and SHAP\(Lundberg and Lee,[2017](https://arxiv.org/html/2607.26339#bib.bib26)\)similarly estimate input importance from output changes\. ZKIP differs in three ways\. First, it combines two complementary signals—semantic answer stability*and*an output\-entropy differential—into one anomaly score, rather than relying on either alone\. Second, it repurposes the counterfactual probe from model explanation to online poisoning defense: scores are computed per query at inference time and immediately drive a filtering decision\. Third, the causal question differs from attribution\. Attribution asks which document was most important; ZKIP asks which document, when removed, makes the model*more stable or less uncertain*—a gold passage and a poison are both “important,” but only the poison’s removal stabilizes the answer and reduces uncertainty\. Crucially, ZKIP requires no poison labels, no ground\-truth answers, and no access to model internals: it is black\-box and entirely self\-referential, comparing the model’s own outputs across counterfactual contexts\. This also distinguishes it from relevance reranking, which scores query–document similarity and therefore cannot flag a document that is highly relevant*and*poisoned—precisely the stealth attacker’s goal\.

#### Setup\.

Given a queryqqand top\-kkcontext𝒟=\{di\}i=1k\\mathcal\{D\}=\\\{d\_\{i\}\\\}\_\{i=1\}^\{k\}, we decode a reference answer with all passages, then run one leave\-one\-out \(LOO\) decode per removeddid\_\{i\}\. For outputsy=\(y1,…,yT\)y=\(y\_\{1\},\\dots,y\_\{T\}\)the generator defines

pϕ​\(y∣q,𝒟\)=∏t=1Tpϕ​\(yt∣y<t,q,𝒟\)\.p\_\{\\phi\}\(y\\mid q,\\mathcal\{D\}\)\\;=\\;\\prod\_\{t=1\}^\{T\}p\_\{\\phi\}\\big\(y\_\{t\}\\mid y\_\{<t\},q,\\mathcal\{D\}\\big\)\.\(3\)Letyall=arg⁡maxy⁡pϕ​\(y∣q,𝒟\)y^\{\\text\{all\}\}=\\arg\\max\_\{y\}p\_\{\\phi\}\(y\\mid q,\\mathcal\{D\}\)andy−i=arg⁡maxy⁡pϕ​\(y∣q,𝒟∖\{di\}\)y^\{\-i\}=\\arg\\max\_\{y\}p\_\{\\phi\}\(y\\mid q,\\mathcal\{D\}\\setminus\\\{d\_\{i\}\\\}\)denote the reference and LOO decodes under Equation[3](https://arxiv.org/html/2607.26339#S3.E3)\.

#### Answer stability\.

Lethψ​\(⋅\)h\_\{\\psi\}\(\\cdot\)be an answer encoder; we use theall\-MiniLM\-L6\-v2sentence\-embedding model\. The answer stability of documentdid\_\{i\}is

si=cos⁡\(hψ​\(yall\),hψ​\(y−i\)\)∈\[−1,1\],s\_\{i\}\\;=\\;\\cos\\big\(h\_\{\\psi\}\(y^\{\\text\{all\}\}\),\\,h\_\{\\psi\}\(y^\{\-i\}\)\\big\)\\in\[\-1,1\],\(4\)where largersis\_\{i\}indicates the answer is stable to removingdid\_\{i\}\. Note that Equation[4](https://arxiv.org/html/2607.26339#S3.E4)compares the model’s two answers*to each other*, never to a gold answer\.

#### Entropy differential\.

Let the sequence\-level output entropy be

H​\(q,𝒟\)=−∑ypϕ​\(y∣q,𝒟\)​log⁡pϕ​\(y∣q,𝒟\),H\(q,\\mathcal\{D\}\)\\;=\\;\-\\sum\_\{y\}p\_\{\\phi\}\(y\\mid q,\\mathcal\{D\}\)\\log p\_\{\\phi\}\(y\\mid q,\\mathcal\{D\}\),\(5\)approximated in practice from the per\-token log\-probabilities\{log⁡pϕ​\(yt∣y<t,q,𝒟\)\}t=1T\\\{\\log p\_\{\\phi\}\(y\_\{t\}\\mid y\_\{<t\},q,\\mathcal\{D\}\)\\\}\_\{t=1\}^\{T\}of the decoded sequence: we convert them to normalized pseudo\-probabilities and compute their entropy, which is tractable for a single decoded path and captures the model’s per\-step confidence\. The uncertainty shift induced bydid\_\{i\}is

Δ​Hi=H​\(q,𝒟\)−H​\(q,𝒟∖\{di\}\),\\Delta H\_\{i\}\\;=\\;H\(q,\\mathcal\{D\}\)\\;\-\\;H\\big\(q,\\mathcal\{D\}\\setminus\\\{d\_\{i\}\\\}\\big\),\(6\)so a large positiveΔ​Hi\\Delta H\_\{i\}means removingdid\_\{i\}*reduces*the model’s uncertainty—evidence thatdid\_\{i\}was injecting confusion\.

#### Anomaly scoring and filtering\.

We combine Equations[4](https://arxiv.org/html/2607.26339#S3.E4)and[6](https://arxiv.org/html/2607.26339#S3.E6)into a per\-passage score:

Ai=\(1−si\)\+λ​\[Δ​Hi\]\+,\[x\]\+=max⁡\(0,x\),λ\>0,A\_\{i\}\\;=\\;\(1\-s\_\{i\}\)\\;\+\\;\\lambda\\,\\big\[\\Delta H\_\{i\}\\big\]\_\{\+\},\\qquad\[x\]\_\{\+\}=\\max\(0,x\),\\;\\;\\lambda\>0,\(7\)and discard the passage\(s\) with the largestAiA\_\{i\}prior to the final decode\. Figure[2](https://arxiv.org/html/2607.26339#S3.F2)illustrates the decision flow on a three\-document example\. We useλ=0\.5\\lambda=0\.5and remove the single top\-scoring passage \(m=1m\{=\}1\) in the main experiments; §[4\.4](https://arxiv.org/html/2607.26339#S4.SS4)discusses the contribution of each term, and Appendix[C](https://arxiv.org/html/2607.26339#A3)lists all defaults\. With this construction, ZKIP requires no poison labels and generalizes across attack types because it relies on counterfactual sensitivity rather than attack\-specific features\.

![Refer to caption](https://arxiv.org/html/2607.26339v1/x2.png)Figure 2:ZKIP decision flow fork=3k\{=\}3\. One reference decode plus one LOO decode per document yields anomaly scoresAiA\_\{i\}\(Equation[7](https://arxiv.org/html/2607.26339#S3.E7)\); the poisoned document’s removal shifts the answer and reduces uncertainty, soA2A\_\{2\}exceeds the threshold andd2d\_\{2\}is excluded from the final decode\. All comparisons are between the model’s own outputs\.
#### Cost\.

ZKIP requires exactlyk\+1k\{\+\}1generator forward passes per query \(one reference decode pluskkLOO decodes\), a6×6\\timesoverhead atk=5k\{=\}5\. The LOO decodes are mutually independent and batch into a single padded forward pass on local models; §[5\.2](https://arxiv.org/html/2607.26339#S5.SS2)analyzes approximations that reduce the pass count further\.

## 4Experiments

### 4\.1Experimental Setup and Threat Model

#### Threat model scope\.

RAGuard targets*factual corpus poisoning*: an adversary with write access to the retrieval corpus \(but not to model weights, queries, or prompts\) injects passages containing fabricated facts, contradictions, or corrupted reasoning, aiming to change the answers of a dense\-retrieval RAG pipeline\. Both retrieval\-level effects \(the poison ranks highly\) and generation\-level effects \(the poison misleads the generator\) are in scope, since ZKIP operates after retrieval\.

The following attack classes areexplicitly out of scopefor this paper: \(i\)*opinion manipulation*\(Chenet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib12)\), which targets subjective or multi\-answer questions for which ZKIP’s stability signal is uninformative; \(ii\)*prompt hijacking / instruction injection*, which embeds instructions in documents to override system prompts; \(iii\)*retrieval jamming*, which floods the corpus with irrelevant passages to suppress relevant results; \(iv\)*backdoor triggers*\(Longet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib13)\), which require latent activations or specific token patterns not present in our threat model; \(v\)*adversarial queries*, since RAGuard assumes a clean query stream; and \(vi\)*white\-box gradient attacks*\(e\.g\., Joint\-GCG,Wanget al\.,[2026](https://arxiv.org/html/2607.26339#bib.bib11); greedy corpus poisoning,Suet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib14)\)\. Appendix[B](https://arxiv.org/html/2607.26339#A2)details each boundary and discusses the extent to which ZKIP may incidentally cover some of these classes\.

#### Datasets and pipeline\.

We evaluate on Natural Questions \(NQ\)\(Kwiatkowskiet al\.,[2019](https://arxiv.org/html/2607.26339#bib.bib27)\), chosen for broad topical coverage, and BEIR \(NFCorpus\)\(Thakuret al\.,[2021](https://arxiv.org/html/2607.26339#bib.bib28)\), a medical/scientific retrieval benchmark with much sparser relevance signal\. For each dataset, we construct clean and poisoned variants as described in §[3\.3](https://arxiv.org/html/2607.26339#S3.SS3), with binary poison flags recorded for every document so that detection metrics are computable\. We compare BM25\(Robertson and Zaragoza,[2009](https://arxiv.org/html/2607.26339#bib.bib29)\)and dense retrievers in three configurations:Dense \(clean\), trained only on clean triples;Dense \(adv\-trained\), fine\-tuned with synthetic poisons per §[3\.3](https://arxiv.org/html/2607.26339#S3.SS3); and each of these with and without ZKIP\. \(Earlier drafts labeled the adversarially trained retriever “Dense \(poisoned\)”; we rename it throughout to remove ambiguity—the retriever is*defended by training*, not attacked\.\) Generation uses GPT\-4o\-mini \(temperature 0\.2, top\-pp0\.95, max 128 tokens\) for the main pipeline and FLAN\-T5\-small\(Chunget al\.,[2024](https://arxiv.org/html/2607.26339#bib.bib32)\)for the batched feature\-extraction experiments of §[4\.6](https://arxiv.org/html/2607.26339#S4.SS6); answer embeddings useall\-MiniLM\-L6\-v2\(Reimers and Gurevych,[2019](https://arxiv.org/html/2607.26339#bib.bib31)\)\. We retrievek=5k\{=\}5passages per query\.

### 4\.2Evaluation Metrics

Recall@5: the proportion of queries for which the gold document appears in the top\-5 retrieved results\.Mean Reciprocal Rank \(MRR\): the average of1rank\\frac\{1\}\{\\text\{rank\}\}over the first relevant document\.Attack Success Rate \(ASR\): the fraction of queries for which a poisoned document ranks higher than the gold document and misleads the generator; lower is better\. We report all three metrics for clean, poisoned, and defended settings\.

### 4\.3Main Results

Table 1:NQ at 10% poisoning: ZKIP eliminates measured attack success for both retriever variants while keeping Recall@5 within 0\.005 of the corresponding undefended retriever\. “Dense \(adv\-trained\)” denotes the retriever fine\-tuned on synthetic poisons \(§[3\.3](https://arxiv.org/html/2607.26339#S3.SS3)\), not a retriever under attack\. Clean\-corpus reference: Dense \(clean\) reaches 0\.282 Recall@5 / 0\.200 MRR \(Appendix[A](https://arxiv.org/html/2607.26339#A1)\)\. Full results across poison levels and retrievers are in Appendix[A](https://arxiv.org/html/2607.26339#A1)\.Table[1](https://arxiv.org/html/2607.26339#S4.T1)summarizes NQ at 10% poisoning; Appendix[A](https://arxiv.org/html/2607.26339#A1)reports all conditions, and Figures[3](https://arxiv.org/html/2607.26339#S4.F3)and[4](https://arxiv.org/html/2607.26339#S4.F4)visualize the Recall@5 and ASR behavior across poison ratios\.

#### Impact of poisoning on retrieval quality\.

Comparing clean baselines to poisoned settings, dense retrievers degrade measurably as poisons enter the corpus: on NQ at 10% poisoning, Dense \(clean\) drops from 0\.282 to 0\.259 Recall@5 and from 0\.200 to 0\.176 MRR\. Poisoned documents disrupt retrieval even without any attack on the retriever’s weights\.

#### Attack success rate\.

For dense retrievers without adversarial training, ASR ranges from 0\.029 \(20% poisoning\) to 0\.101 \(10% poisoning\) on NQ; the non\-monotonic pattern across ratios reflects the modest number of attackable queries per condition \(33–190\) and motivates the multi\-seed runs planned in §[Limitations](https://arxiv.org/html/2607.26339#Sx1)\. BM25 shows ASR 0\.000 at 5–20% poisoning and 0\.011 at 30%: our poisons are LLM rewrites that alter semantics but largely preserve the original keywords, so lexical ranking is barely affected\. This is a threat\-model boundary, not a defense result—a keyword\-overlap retriever with 0\.070 Recall@5 is not a usable alternative, and an adversary targeting hybrid pipelines would craft poisons for both signals \(§[Limitations](https://arxiv.org/html/2607.26339#Sx1)\)\.

#### Effect of adversarial training\.

Dense \(adv\-trained\) improves Recall@5 under poisoning relative to the clean\-trained model \(0\.319 vs\. 0\.259 at NQ 10%\) and reduces—but does not eliminate—attack success \(ASR 0\.072 vs\. 0\.101\)\. At 5% poisoning the adversarially trained model’s ASR \(0\.091\) exceeds the clean model’s \(0\.061\), a reminder that training\-time hardening interacts with the poison distribution in ratio\-dependent ways\. Training\-time defense alone is insufficient against the residual attacks that slip through ranking\.

#### ZKIP effectiveness\.

ZKIP drives ASR to 0\.000 in every defended configuration on NQ—both retriever variants and BM25, at both poison ratios with completed defended runs \(10% and 30%\)\. Retrieval quality stays close to the corresponding undefended retriever: at 10% poisoning the defended Dense \(adv\-trained\) reaches 0\.314 Recall@5 vs\. 0\.319 undefended, and at 30% it reaches 0\.274 vs\. 0\.318, in exchange for eliminating all measured attack success\. Relative to the*clean\-corpus*baseline of 0\.282, defended configurations land between 0\.256 and 0\.314 \(within 0\.03\); Figure[3](https://arxiv.org/html/2607.26339#S4.F3)visualizes this against the clean\-baseline reference line\.

#### Computational cost\.

ZKIP addsk\+1k\{\+\}1generator calls per query: 6 calls atk=5k\{=\}5, a6×6\\timesworst\-case inference cost\. §[5\.2](https://arxiv.org/html/2607.26339#S5.SS2)discusses when this is acceptable and how to reduce it\.

![Refer to caption](https://arxiv.org/html/2607.26339v1/x3.png)Figure 3:Recall@5 on poisoned NQ with and without ZKIP, for the adversarially trained \(left\) and clean\-trained \(right\) dense retrievers, at the two poison ratios with completed defended runs\. Dashed line: clean\-corpus dense baseline \(0\.282\)\. The adv\-trained retriever’s bars sit*above*the clean baseline because fine\-tuning on answer\-bearing rewrites also boosts ranking of relevant passages; ZKIP removes one influential passage per flagged query, trading a small amount of Recall@5 \(largest at 30%: 0\.318→\\rightarrow0\.274\) for the elimination of all measured attack success\. All values are taken directly from the released evaluation artifacts\.![Refer to caption](https://arxiv.org/html/2607.26339v1/x4.png)Figure 4:Attack success rate on NQ across poison ratios for the three undefended retrievers, with ZKIP\-defended results \(stars\) at the ratios with completed defended runs\. ZKIP reaches ASR 0\.000 for every retriever it is applied to, including the 30% condition where even BM25 shows nonzero ASR \(0\.011\)\.

### 4\.4Ablation: Layer Contributions

Table 2:Layer ablation on NQ at 10% poisoning, using results measured in the main grid\. ZKIP is necessary and sufficient to eliminate measured ASR; the adversarially trained retriever contributes ranking quality \(\+0\.055\+0\.055Recall@5,\+0\.039\+0\.039MRR over ZKIP\-only\) but cannot reach ASR 0 alone\.#### Layer ablation\.

Table[2](https://arxiv.org/html/2607.26339#S4.T2)separates the two defense layers using results measured in our main grid\. ZKIP alone eliminates measured attack success; adversarial retriever training alone does not \(ASR 0\.072\)\. The combination preserves the adv\-trained model’s superior ranking \(0\.314/0\.215 vs\. 0\.259/0\.176 for ZKIP\-only\) while keeping ASR at 0\.000\. The layers therefore play distinct roles: the retriever protects*ranking quality*under poisoning, and ZKIP protects*answer integrity*\.

#### Signal ablation \(protocol\)\.

The anomaly score of Equation[7](https://arxiv.org/html/2607.26339#S3.E7)combines a stability term\(1−si\)\(1\-s\_\{i\}\)and an entropy termλ​\[Δ​Hi\]\+\\lambda\[\\Delta H\_\{i\}\]\_\{\+\}\. We expect*stability only*\(λ=0\\lambda\{=\}0\) to catch poisons whose removal substantially changes the decoded answer string—the primary signal for fabrication and contradiction attacks—while*entropy only*should catch poisons that inflate model uncertainty without changing the surface answer, with reasoning\-trap poisons the expected primary beneficiary\. We release the evaluation harness for this ablation \(experiments/ablation\_stability\_vs\_entropy\.py\) but report no numbers here: the runs are not yet complete, and we report only completed measurements\.

### 4\.5Multi\-Poison Attacks \(Protocol\)

The main experiments poison at most one of the top\-kkdocuments per query\. A coordinated adversary can instead place multiple mutually reinforcing poisons in the top\-kk: removing any single document then changes the answer little, muting the LOO signal that ZKIP relies on\. This is the most plausible evasion strategy against single\-document removal, and we state it as the central known weakness of single\-pass ZKIP \(§[5\.4](https://arxiv.org/html/2607.26339#S5.SS4)\)\.

Our released code implements two countermeasure variants for future measurement:single\-pass ZKIP\(remove the top\-1 anomaly\) anditerative ZKIP, which after removing the top\-scoring document re\-runs the LOO probe on the remainingk−1k\{\-\}1documents and removes the next document whose score exceeds a stricter thresholdτ2\>τ1\\tau\_\{2\}\>\\tau\_\{1\}, up to a removal budgetmm\. Iteration breaks poison coalitions one member at a time: once the first poison is gone, the remaining poisons’ influence is exposed\. The cost grows to at most∑j=0m−1\(k−j\)\+1\\sum\_\{j=0\}^\{m\-1\}\(k\-j\)\+1generator calls formmremovals\. The evaluation harness \(experiments/multi\_poison\_eval\.py\) implements the full protocol—coordinated injection of 2–4 poisons into the top\-kkand measurement of ASR and filter recall for both variants—and we leave its quantitative results to future work rather than reporting estimates\.

### 4\.6Learned Poison Classification

To assess whether ZKIP’s influence signals contain learnable poison structure, we train supervised classifiers to predict whether a retrieved document is poisoned, using a compact set of per\-document influence features \(Appendix[D](https://arxiv.org/html/2607.26339#A4)\)\. We evaluate a logistic\-regression baseline and a neural classifier over these features on labeled NQ, and separately a text\-level BERT classifier\(Devlinet al\.,[2019](https://arxiv.org/html/2607.26339#bib.bib33)\)on gold\-vs\-poison document pairs as a supervised upper bound\. Unlike ZKIP, these classifiers require poison\-labeled training data and may need retraining across attack styles; we treat them as supporting analysis, not as the primary defense\. The feature\-level BERT classifier reaches AUPRC 0\.732 versus 0\.377 for logistic regression \(Appendix Table[8](https://arxiv.org/html/2607.26339#A4.T8)\), confirming that counterfactual\-removal signals carry nonlinear, learnable poison structure—which is the property ZKIP exploits label\-free\.

## 5Discussion

### 5\.1Advantages

RAGuard’s primary strengths are modularity, model agnosticism, and label\-freedom\. The LOO patch can be used with virtually any LLM or retriever, since it only requires access to the system’s output \(text and token log\-probabilities\) for each context perturbation\. The key upshot is that the patch can catch unseen attack types—including those that evade training\-time simulation—because it evaluates the causal effect of each context element on the model’s end\-to\-end answer\. Unlike prior defenses that depend on explicit poison traces or multi\-LLM ensembles\(Edemacuet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib17); Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10)\), the patch is label\-free and feasible with a single LLM\.

### 5\.2Computational Tradeoffs

The principal cost isk\+1k\{\+\}1generator passes per query \(6×6\\timesatk=5k\{=\}5,11×11\\timesatk=10k\{=\}10\); cost scales linearly with the number of retrieved documents while robustness benefits plateau\. Table[3](https://arxiv.org/html/2607.26339#S5.T3)summarizes the measured cost–robustness tradeoff\. Three approximations reduce the pass count:\(1\) Batched LOO: thekkLOO decodes are independent and run as one padded batch on local models, reducing wall\-clock cost to roughly two batched generations per query; our implementation batches by default\.\(2\) Early stopping: when the first flagged document exceeds the threshold by a marginδ\\delta, remaining LOO passes are skipped; this trades completeness of the per\-document score vector for latency\.\(3\) Subset sampling: probing a random⌈k/2⌉\\lceil k/2\\rceilsubset of documents per query halves the LOO passes; our released code implements this mode \(\-\-approximate\), and quantifying its accuracy cost is planned work\. Practitioners can also apply ZKIP selectively—only to high\-stakes or low\-confidence queries—to amortize the cost\. Conceptually, the patch is akin to self\-consistency prompting for retrieval: rather than querying an ensemble of models, RAGuard queries multiple context subsets of one model, using stability as a proxy for trustworthiness\. For latency\-critical workloads the overhead may still be prohibitive; we state this plainly as a limitation rather than a footnote\.

Table 3:Cost–robustness tradeoff on poisoned NQ \(dense retrievers; ASR range spans the 5–30% undefended conditions\)\. Batching removes most wall\-clock overhead on local generators without changing the filtering decision\.
### 5\.3Comparison to Other Methods

Traditional filtering defenses\(Edemacuet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib17); Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10)\)rely on hand\-crafted features or learned classifiers that may not generalize to new poison types or domain shifts\. Prompt\-level robustness methods\(Asaiet al\.,[2024](https://arxiv.org/html/2607.26339#bib.bib2); Shiet al\.,[2024](https://arxiv.org/html/2607.26339#bib.bib7)\)struggle when the retrieval step is severely compromised\. Fine\-tuning retrievers on synthetic poisons risks overfitting to known poison distributions\(Lupart and Clinchant,[2023](https://arxiv.org/html/2607.26339#bib.bib8)\), as demonstrated by attacks that evolve trigger patterns or semantic camouflage\(Suet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib14)\)\. RAGuard mitigates these weaknesses by combining a proactive hardening step with an adaptive, model\-agnostic inference\-time filter\.

Two comparisons we have not yet run bound our claims\.PoisonedRAG\(Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10)\)generates adversarial passages via optimization against a target answer string, producing semantically coherent injections optimized to rank highly under a specific dense retriever\. Our synthetic poisons are LLM rewrites constructed without access to the retriever’s gradients; they are related in intent but face a weaker optimization pressure\. A comparison using PoisonedRAG’s injected\-passage format is the most direct way to establish whether ZKIP generalizes beyond distribution\-matched evaluation\.FlippedRAG\(Chenet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib12)\)targets opinion manipulation on questions without ground\-truth answers, placing it outside our factual threat model \(§[4\.1](https://arxiv.org/html/2607.26339#S4.SS1)\); it would nevertheless stress\-test whether ZKIP’s answer\-stability signal degrades on questions with legitimate answer variation\. Both are flagged as the highest\-priority evaluation extensions \(§[Limitations](https://arxiv.org/html/2607.26339#Sx1)\); our released code includes a harness \(experiments/external\_attack\_eval\.py\) that evaluates ZKIP against externally generated attack corpora in PoisonedRAG’s injected\-passage format, making these extensions straightforward to run\.

### 5\.4Failure Cases

ZKIP fails in identifiable patterns, which we report rather than smooth over\.\(1\) Coordinated multi\-poison coalitions\.When two or more poisons in the top\-kkassert the same false fact, removing any one leaves the answer unchanged; the LOO signal for each is muted and no document is flagged\. Single\-pass ZKIP is structurally blind to this; §[4\.5](https://arxiv.org/html/2607.26339#S4.SS5)describes the iterative\-removal countermeasure\.\(2\) Stable wrong answers\.A poison that shifts the answer*without*raising output entropy—for example, a confident contradiction that the generator finds fluent—produces a smallΔ​Hi\\Delta H\_\{i\}, leaving only the stability term to catch it\. If the poisoned and clean answers are also lexically close \(a date off by one year\), the cosine shift in Equation[4](https://arxiv.org/html/2607.26339#S3.E4)can fall below threshold\.\(3\) False positives on unusual benign documents\.A benign passage that is opinionated, off\-distribution, or contains a unique disambiguating fact can dominate the answer; its removal changes the output substantially and ZKIP may flag it\. This is the mechanism behind the Recall@5 reductions observed when ZKIP is applied \(Figure[3](https://arxiv.org/html/2607.26339#S4.F3)\); on ambiguous queries it can remove the most informative passage\.\(4\) Queries the generator cannot answer from any context\.When all decodes are unstable \(the model guesses\), anomaly scores are uniformly high and filtering approaches random removal\.

### 5\.5Future Work

\(1\) Combining ZKIP with active learning or human\-in\-the\-loop verification to filter subtle reasoning attacks\. \(2\) Real\-time deployments that combine self\-consistency tests with lightweight instance selection where cost is the binding constraint\. \(3\) Broader benchmarks—cross\-domain, multilingual, and standardized attack suites \(PoisonedRAG, FlippedRAG\)—to stress\-test defense layers\. \(4\) Theoretical bounds on patch efficacy, connecting LOO filtering to the geometry of poison coalitions\.

### 5\.6Broader Impact

Robust RAG matters most in high\-stakes applications such as medicine, finance, and law\(Ramet al\.,[2023](https://arxiv.org/html/2607.26339#bib.bib3)\)\. Increased robustness shifts, rather than ends, the attacker–defender dynamic; by open\-sourcing the patches and stress\-testing pipelines, the community can probe these defenses before attackers do\. Our poison\-generation code is released for reproducibility of the defense evaluation; the poisons are simple LLM rewrites with no capability beyond what current attack literature already documents\(Zouet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib10); Panet al\.,[2023](https://arxiv.org/html/2607.26339#bib.bib20)\)\.

## 6Conclusion

We introduced RAGuard, a modular two\-layer defense that strengthens RAG systems against factual corpus poisoning\. The first layer fine\-tunes dense retrievers on synthetic poisons \(fabrications, contradictions, reasoning traps\) to downrank malicious content; the second layer, ZKIP, filters retrieved passages by measuring the causal influence of each on the generated answer—without poison labels, gold answers, or model internals\. On poisoned NQ, ZKIP eliminates measured attack success in every defended configuration while keeping retrieval quality within 0\.03 of the clean\-corpus baseline, at a cost ofk\+1k\{\+\}1generator passes per query; supervised analyses on NQ and BEIR confirm that its counterfactual signals carry learnable poison structure\. The clearest open problems are coordinated multi\-poison attacks, standardized attack baselines, and reducing inference overhead; we release code, datasets, and evaluation harnesses to support that work\.

## Limitations

#### Computational overhead\.

ZKIP requiresk\+1k\{\+\}1generator passes per query \(6×6\\timesatk=5k\{=\}5\)\. Batching reduces wall\-clock cost on local models, but for API\-priced or latency\-critical deployments the overhead is substantial\. ZKIP is most practical for high\-stakes, lower\-throughput pipelines or selective application to flagged queries\.

#### Single\-document removal misses coordinated attacks\.

If multiple poisoned documents reinforce one another, removal of any single item may not restore the correct response, muting the LOO signal \(§[4\.5](https://arxiv.org/html/2607.26339#S4.SS5), §[5\.4](https://arxiv.org/html/2607.26339#S5.SS4)\)\. Iterative removal raises cost and only partially closes this gap; we have not yet measured the multi\-poison frontier\.

#### False positives\.

Filtering on output change can flag benign but opinionated or out\-of\-distribution documents, especially for ambiguous queries or factual disagreements; this is the source of the Recall@5 cost we observe\. Integrating additional heuristics or weak supervision could reduce such false positives\.

#### Evaluation scope\.

Our defended \(ZKIP\) evaluation covers NQ at 10% and 30% poisoning with a single seed per condition; the undefended grid covers 5–30%\. Metrics derive from a limited set of runs constrained by compute, and the number of attackable queries per condition is modest \(33–190\), which explains the non\-monotonic ASR pattern across ratios\. ASR 0\.000 means no successful attacks*among the attacks and samples we tested*, not a guarantee\. On BEIR we report poisoning impact and supervised detection results \(Appendices[A](https://arxiv.org/html/2607.26339#A1)and[D](https://arxiv.org/html/2607.26339#A4)\); completing the ZKIP\-defended BEIR grid, adding seeds, and comparing against standardized attacks \(PoisonedRAG, FlippedRAG\) and recent defense baselines are the highest\-priority evaluation extensions\.

#### Effectiveness is strongest for factual QA\.

The stability signal presumes a question with an \(approximately unique\) factual answer\. For subjective, multi\-hop, or generative tasks, answer variation under context removal is expected even without poisoning, and ZKIP’s signals weaken \(Appendix[B](https://arxiv.org/html/2607.26339#A2)\)\.

#### Threat model is implicitly dense\-retrieval\-only\.

Our poisons are LLM rewrites that alter semantics while largely preserving the original keywords: BM25 shows ASR 0\.000 at 5–20% poisoning \(0\.011 at 30%\) against them with no defense, because poisoned and gold documents share the query’s terms and term\-frequency ranking can rarely distinguish them\. The threat model is therefore optimized for dense embeddings and does not reflect realistic poisoning of hybrid lexical\+semantic pipelines\. A real adversary would craft poisons to evade both signals simultaneously; evaluating RAGuard against such hybrid\-targeting poisons \(our released\-\-hard\_modegenerator produces keyword\-substituted variants\) is required future work\.

#### Adversarially trained retriever may be distribution\-fragile\.

Fine\-tuning on a fixed distribution of synthetic poisons risks two failure modes: \(i\)*overfitting*to the three LLM\-rewrite families used during training, such that gradient\-optimized or domain\-shifted attack passages are not downranked; and \(ii\)*degraded generalization*to unseen query–document pairs from out\-of\-distribution domains\. On BEIR \(NFCorpus\), a medical corpus distinct from NQ, the adversarially trained retriever’s ASR is comparable to the clean model’s \(Table[5](https://arxiv.org/html/2607.26339#A1.T5)\), and BEIR’s low absolute retrieval numbers make strong conclusions impossible\. We do not claim the trained retriever generalizes to unseen domains, and we rely on ZKIP as the attack\-agnostic safety net\. Three mitigations worth exploring are: \(a\)*diverse poison generation*—including gradient\-optimized passages\(Suet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib14)\)and backdoor\-trigger rewrites\(Longet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib13)\)in training, not only LLM rewrites; \(b\)*periodic retraining*on newly discovered attack corpora as the threat landscape evolves; and \(c\)*data\-augmentation via domain mixing*, training on joint NQ\+BEIR\+open\-domain triples to reduce query\-distribution sensitivity\.

## References

- A\. Asai, Z\. Wu, Y\. Wang, A\. Sil, and H\. Hajishirzi \(2024\)Self\-RAG: learning to retrieve, generate, and critique through self\-reflection\.InThe Twelfth International Conference on Learning Representations \(ICLR\),Note:arXiv:2310\.11511Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§1](https://arxiv.org/html/2607.26339#S1.p2.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p1.1)\.
- H\. Chen, M\. J\.Q\. Zhang, and E\. Choi \(2022\)Rich knowledge sources bring complex knowledge conflicts: recalibrating models to reflect conflicting evidence\.InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing \(EMNLP\),Abu Dhabi, United Arab Emirates,pp\. 2292–2307\.External Links:[Document](https://dx.doi.org/10.18653/v1/2022.emnlp-main.146)Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px2.p1.1)\.
- Z\. Chen, Y\. Gong, J\. Liu, M\. Chen, H\. Liu, Q\. Cheng, F\. Zhang, W\. Lu, and X\. Liu \(2025\)FlippedRAG: black\-box opinion manipulation adversarial attacks to retrieval\-augmented generation models\.InProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security \(CCS\),External Links:[Document](https://dx.doi.org/10.1145/3719027.3765023)Cited by:[Appendix B](https://arxiv.org/html/2607.26339#A2.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2607.26339#S1.p6.3),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px1.p2.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p2.1)\.
- H\. W\. Chung, L\. Hou, S\. Longpre, B\. Zoph, Y\. Tay, W\. Fedus, Y\. Li, X\. Wang, M\. Dehghani, S\. Brahma, A\. Webson, S\. S\. Gu, Z\. Dai, M\. Suzgun, X\. Chen, A\. Chowdhery, A\. Castro\-Ros, M\. Pellat, K\. Robinson, D\. Valter, S\. Narang, G\. Mishra, A\. Yu, V\. Zhao, Y\. Huang, A\. Dai, H\. Yu, S\. Petrov, E\. H\. Chi, J\. Dean, J\. Devlin, A\. Roberts, D\. Zhou, Q\. V\. Le, and J\. Wei \(2024\)Scaling instruction\-finetuned language models\.Journal of Machine Learning Research25\(70\),pp\. 1–53\.Cited by:[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px2.p1.2)\.
- J\. Devlin, M\. Chang, K\. Lee, and K\. Toutanova \(2019\)BERT: pre\-training of deep bidirectional transformers for language understanding\.InProceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 \(Long and Short Papers\),Minneapolis, Minnesota,pp\. 4171–4186\.External Links:[Document](https://dx.doi.org/10.18653/v1/N19-1423)Cited by:[§4\.6](https://arxiv.org/html/2607.26339#S4.SS6.p1.1)\.
- K\. Edemacu, V\. M\. Shashidhar, M\. Tuape, D\. Abudu, B\. Jang, and J\. W\. Kim \(2025\)Defending against knowledge poisoning attacks during retrieval\-augmented generation\.Note:arXiv:2508\.02835Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p2.1),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px3.p1.1),[§5\.1](https://arxiv.org/html/2607.26339#S5.SS1.p1.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p1.1)\.
- G\. Hong, J\. Kim, J\. Kang, S\. Myaeng, and J\. J\. Whang \(2024\)Why so gullible? Enhancing the robustness of retrieval\-augmented models against counterfactual noise\.InFindings of the Association for Computational Linguistics: NAACL 2024,Mexico City, Mexico,pp\. 2474–2495\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.findings-naacl.159)Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px2.p1.1),[§3\.3](https://arxiv.org/html/2607.26339#S3.SS3.SSS0.Px2.p1.1)\.
- G\. Izacard, M\. Caron, L\. Hosseini, S\. Riedel, P\. Bojanowski, A\. Joulin, and E\. Grave \(2022\)Unsupervised dense information retrieval with contrastive learning\.Transactions on Machine Learning Research\.Note:arXiv:2112\.09118Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p3.1)\.
- G\. Izacard, P\. Lewis, M\. Lomeli, L\. Hosseini, F\. Petroni, T\. Schick, J\. Dwivedi\-Yu, A\. Joulin, S\. Riedel, and E\. Grave \(2023\)Atlas: few\-shot learning with retrieval augmented language models\.Journal of Machine Learning Research24\(251\),pp\. 1–43\.Note:arXiv:2208\.03299Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p1.1)\.
- F\. Johansson, U\. Shalit, and D\. Sontag \(2016\)Learning representations for counterfactual inference\.InProceedings of the 33rd International Conference on Machine Learning \(ICML\),Proceedings of Machine Learning Research, Vol\.48,pp\. 3020–3029\.Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px4.p1.1),[§3\.4](https://arxiv.org/html/2607.26339#S3.SS4.SSS0.Px1.p1.1)\.
- T\. Kwiatkowski, J\. Palomaki, O\. Redfield, M\. Collins, A\. Parikh, C\. Alberti, D\. Epstein, I\. Polosukhin, J\. Devlin, K\. Lee, K\. Toutanova, L\. Jones, M\. Kelcey, M\. Chang, A\. M\. Dai, J\. Uszkoreit, Q\. Le, and S\. Petrov \(2019\)Natural questions: a benchmark for question answering research\.Transactions of the Association for Computational Linguistics7,pp\. 452–466\.External Links:[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00276)Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p4.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px2.p1.2)\.
- Y\. Lei, L\. Ding, Y\. Cao, C\. Zan, A\. Yates, and D\. Tao \(2023\)Unsupervised dense retrieval with relevance\-aware contrastive pre\-training\.InFindings of the Association for Computational Linguistics: ACL 2023,pp\. 10932–10940\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.findings-acl.695)Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p3.1)\.
- P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. Kiela \(2020\)Retrieval\-augmented generation for knowledge\-intensive NLP tasks\.InAdvances in Neural Information Processing Systems 33 \(NeurIPS 2020\),pp\. 9459–9474\.Note:arXiv:2005\.11401Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px1.p1.1)\.
- Q\. Long, Y\. Deng, L\. Gan, W\. Wang, and S\. J\. Pan \(2025\)Backdoor attacks on dense retrieval via public and unintentional triggers\.InConference on Language Modeling \(COLM\),Note:arXiv:2402\.13532Cited by:[Appendix B](https://arxiv.org/html/2607.26339#A2.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px1.p2.1),[Adversarially trained retriever may be distribution\-fragile\.](https://arxiv.org/html/2607.26339#Sx1.SS0.SSS0.Px7.p1.1)\.
- S\. M\. Lundberg and S\. Lee \(2017\)A unified approach to interpreting model predictions\.InAdvances in Neural Information Processing Systems 30 \(NeurIPS 2017\),pp\. 4765–4774\.Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px4.p1.1),[§3\.4](https://arxiv.org/html/2607.26339#S3.SS4.SSS0.Px1.p1.1)\.
- S\. Lupart and S\. Clinchant \(2023\)A study on FGSM adversarial training for neural retrieval\.InAdvances in Information Retrieval: 45th European Conference on Information Retrieval \(ECIR 2023\), Part II,Lecture Notes in Computer Science, Vol\.13981,pp\. 484–492\.External Links:[Document](https://dx.doi.org/10.1007/978-3-031-28238-6%5F39)Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p2.1),[§1](https://arxiv.org/html/2607.26339#S1.p3.1),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px3.p1.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p1.1)\.
- C\. Molnar \(2025\)Interpretable machine learning: a guide for making black box models explainable\.3 edition,Self\-published\.External Links:ISBN 978\-3\-911578\-03\-5,[Link](https://christophm.github.io/interpretable-ml-book)Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px4.p1.1),[§3\.4](https://arxiv.org/html/2607.26339#S3.SS4.SSS0.Px1.p1.1)\.
- Y\. Pan, L\. Pan, W\. Chen, P\. Nakov, M\. Kan, and W\. Y\. Wang \(2023\)On the risk of misinformation pollution with large language models\.InFindings of the Association for Computational Linguistics: EMNLP 2023,Singapore,pp\. 1389–1403\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.findings-emnlp.97)Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px2.p1.1),[§3\.3](https://arxiv.org/html/2607.26339#S3.SS3.SSS0.Px2.p1.1),[§5\.6](https://arxiv.org/html/2607.26339#S5.SS6.p1.1)\.
- D\. H\. Park and Y\. Chang \(2019\)Adversarial sampling and training for semi\-supervised information retrieval\.InThe World Wide Web Conference \(WWW ’19\),pp\. 1443–1453\.External Links:[Document](https://dx.doi.org/10.1145/3308558.3313416)Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p2.1),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px3.p1.1)\.
- M\. Prosperi, Y\. Guo, M\. Sperrin, J\. S\. Koopman, J\. S\. Min, X\. He, S\. Rich, M\. Wang, I\. E\. Buchan, and J\. Bian \(2020\)Causal inference and counterfactual prediction in machine learning for actionable healthcare\.Nature Machine Intelligence2,pp\. 369–375\.External Links:[Document](https://dx.doi.org/10.1038/s42256-020-0197-y)Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px4.p1.1),[§3\.4](https://arxiv.org/html/2607.26339#S3.SS4.SSS0.Px1.p1.1)\.
- O\. Ram, Y\. Levine, I\. Dalmedigos, D\. Muhlgay, A\. Shashua, K\. Leyton\-Brown, and Y\. Shoham \(2023\)In\-context retrieval\-augmented language models\.Transactions of the Association for Computational Linguistics11,pp\. 1316–1331\.External Links:[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00605)Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§5\.6](https://arxiv.org/html/2607.26339#S5.SS6.p1.1)\.
- N\. Reimers and I\. Gurevych \(2019\)Sentence\-BERT: sentence embeddings using Siamese BERT\-networks\.InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing \(EMNLP\-IJCNLP\),Hong Kong, China,pp\. 3982–3992\.External Links:[Document](https://dx.doi.org/10.18653/v1/D19-1410)Cited by:[§3\.3](https://arxiv.org/html/2607.26339#S3.SS3.SSS0.Px3.p1.3),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px2.p1.2)\.
- M\. T\. Ribeiro, S\. Singh, and C\. Guestrin \(2016\)“Why Should I Trust You?”: Explaining the Predictions of Any Classifier\.InProceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining,pp\. 1135–1144\.External Links:[Document](https://dx.doi.org/10.1145/2939672.2939778)Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px4.p1.1),[§3\.4](https://arxiv.org/html/2607.26339#S3.SS4.SSS0.Px1.p1.1)\.
- S\. Robertson and H\. Zaragoza \(2009\)The probabilistic relevance framework: BM25 and beyond\.Foundations and Trends in Information Retrieval3\(4\),pp\. 333–389\.External Links:[Document](https://dx.doi.org/10.1561/1500000019)Cited by:[3rd item](https://arxiv.org/html/2607.26339#S1.I1.i3.p1.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px2.p1.2)\.
- W\. Shi, S\. Min, M\. Yasunaga, M\. Seo, R\. James, M\. Lewis, L\. Zettlemoyer, and W\. Yih \(2024\)REPLUG: retrieval\-augmented black\-box language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 8371–8384\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.naacl-long.463)Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p2.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p1.1)\.
- Y\. Shi, M\. Du, X\. Wu, Z\. Guan, J\. Sun, and N\. Liu \(2023\)Black\-box backdoor defense via zero\-shot image purification\.InAdvances in Neural Information Processing Systems 36 \(NeurIPS 2023\),Note:arXiv:2303\.12175Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px3.p1.1)\.
- H\. Song, Y\. Liu, R\. Zhang, J\. Guo, and Y\. Fan \(2025\)Chain\-of\-thought poisoning attacks against R1\-based retrieval\-augmented generation systems\.Note:arXiv:2505\.16367Cited by:[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px1.p1.1)\.
- A\. Souly, J\. Rando, E\. Chapman, X\. Davies, B\. Hasircioglu, E\. Shereen, C\. Mougan, V\. Mavroudis, E\. Jones, C\. Hicks, N\. Carlini, Y\. Gal, and R\. Kirk \(2025\)Poisoning attacks on LLMs require a near\-constant number of poison samples\.Note:arXiv:2510\.07192Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px1.p1.1)\.
- J\. Su, P\. Nakov, and C\. Cardie \(2025\)Corpus poisoning via approximate greedy gradient descent\.InFindings of the Association for Computational Linguistics: ACL 2025,pp\. 4274–4294\.Note:arXiv:2406\.05087Cited by:[Appendix B](https://arxiv.org/html/2607.26339#A2.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px1.p2.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p1.1),[Adversarially trained retriever may be distribution\-fragile\.](https://arxiv.org/html/2607.26339#Sx1.SS0.SSS0.Px7.p1.1)\.
- N\. Thakur, N\. Reimers, A\. Rücklé, A\. Srivastava, and I\. Gurevych \(2021\)BEIR: a heterogeneous benchmark for zero\-shot evaluation of information retrieval models\.InProceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks,Vol\.1\.Note:arXiv:2104\.08663Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p4.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px2.p1.2)\.
- H\. Wang, R\. Zhang, J\. Wang, M\. Li, Y\. Huang, D\. Wang, and Q\. Wang \(2026\)Joint\-GCG: unified gradient\-based poisoning attacks on retrieval\-augmented generation systems\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 35793–35801\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i42.40893)Cited by:[Appendix B](https://arxiv.org/html/2607.26339#A2.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2607.26339#S4.SS1.SSS0.Px1.p2.1)\.
- W\. Wang, F\. Wei, L\. Dong, H\. Bao, N\. Yang, and M\. Zhou \(2020\)MiniLM: deep self\-attention distillation for task\-agnostic compression of pre\-trained transformers\.InAdvances in Neural Information Processing Systems 33 \(NeurIPS 2020\),pp\. 5776–5788\.Note:arXiv:2002\.10957Cited by:[§3\.3](https://arxiv.org/html/2607.26339#S3.SS3.SSS0.Px3.p1.3)\.
- W\. Zou, R\. Geng, B\. Wang, and J\. Jia \(2025\)PoisonedRAG: knowledge corruption attacks to retrieval\-augmented generation of large language models\.In34th USENIX Security Symposium \(USENIX Security 25\),Note:arXiv:2402\.07867Cited by:[§1](https://arxiv.org/html/2607.26339#S1.p1.1),[§1](https://arxiv.org/html/2607.26339#S1.p2.1),[§1](https://arxiv.org/html/2607.26339#S1.p6.3),[§2](https://arxiv.org/html/2607.26339#S2.SS0.SSS0.Px1.p1.1),[§5\.1](https://arxiv.org/html/2607.26339#S5.SS1.p1.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p1.1),[§5\.3](https://arxiv.org/html/2607.26339#S5.SS3.p2.1),[§5\.6](https://arxiv.org/html/2607.26339#S5.SS6.p1.1)\.

## Appendix AFull Baseline and ZKIP Evaluation Results

We report full retrieval/defense results across clean, poisoned, and ZKIP\-defended settings in Tables[4](https://arxiv.org/html/2607.26339#A1.T4)and[5](https://arxiv.org/html/2607.26339#A1.T5)\. Labels follow §[4\.1](https://arxiv.org/html/2607.26339#S4.SS1): “Dense \(adv\-trained\)” is the retriever fine\-tuned on synthetic poisons; “Dense \(clean\)” is trained on clean triples only\. Every value is taken directly from the released evaluation artifacts in the code repository; conditions without a completed run are omitted rather than estimated\.

Table 4:Natural Questions retrieval/defense results across clean, poisoned, and ZKIP\-defended settings\. ZKIP eliminates measured ASR in every defended configuration\. Recall@5 and MRR are computed over the full 1,000\-query set; ASR is computed over the queries where a poisoned document is present in the retrieved candidates \(33, 69, 139, and 190 queries at 5%, 10%, 20%, and 30% poisoning respectively\)\. Defended runs exist at 10% and 30%; the 20% defended condition has not been run and is omitted rather than estimated\.Table 5:BEIR \(NFCorpus\) retrieval results on the clean and 30%\-poisoned corpora \(2,481 ASR\-eligible queries\)\. Absolute retrieval numbers are low for all systems on NFCorpus; the relevant observations are relative: dense ASR is an order of magnitude above BM25’s \(which stays at 0\.000\), and adversarial training does not meaningfully reduce ASR on this out\-of\-domain corpus\. ZKIP\-defended BEIR runs are not yet complete and are deliberately not reported \(§[Limitations](https://arxiv.org/html/2607.26339#Sx1)\); supervised detection results on BEIR appear in Appendix[D](https://arxiv.org/html/2607.26339#A4)\.
## Appendix BThreat Model Scope

#### Attack classes in scope\.

RAGuard is designed and evaluated against*factual poisoning*: an adversary injects passages containing false factual claims—fabricated facts, contradictions of the gold evidence, and corrupted reasoning chains—into the retrieval corpus, with the goal of changing the answers a RAG pipeline produces\. The adversary is assumed to have write access to the corpus \(e\.g\., via user\-generated content, wiki edits, or web crawl injection\) but*no*access to model weights, query inputs, or the generation prompt\. Within this class, both retrieval\-level attacks \(the poisoned passage ranks above the gold passage\) and generation\-level attacks \(the poisoned passage is retrieved alongside gold evidence and confuses the generator\) are in scope: Layer 1 \(adversarial retriever training\) targets the former, and ZKIP operates at the generation stage after retrieval, so it applies to both\. All experiments in this paper instantiate this threat model with three poison families \(fabrication, contradiction, reasoning trap\) at corpus poison ratios of 5–30%\.

#### Attack classes out of scope\.

Several attack classes documented in the literature are explicitly*not*covered by our evaluation\.*Prompt hijacking / instruction injection*—embedding instructions in documents to override system prompts—may be partially caught by ZKIP, since injected instructions tend to destabilize the decoded answer, but we do not evaluate this and make no claim\.*Opinion manipulation*\(Chenet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib12)\)shifts model outputs on subjective questions with no single factual answer; ZKIP’s answer\-stability signal is less meaningful without a factual reference point, and we expect degraded performance\.*Retrieval jamming / denial\-of\-service*—flooding the corpus with irrelevant documents to suppress relevant results—is not addressed; ZKIP can only filter what is retrieved\.*Backdoor\-style attacks with trigger tokens*\(Longet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib13)\)may be detected when the trigger causes answer instability, but a targeted backdoor engineered to produce a*stable*wrong answer could evade detection \(§[5\.4](https://arxiv.org/html/2607.26339#S5.SS4)\)\.*Adversarial queries*are excluded: RAGuard assumes the query stream is clean\.*White\-box gradient attacks*on the retriever or generator \(e\.g\., Joint\-GCG,Wanget al\.,[2026](https://arxiv.org/html/2607.26339#bib.bib11); greedy corpus poisoning,Suet al\.,[2025](https://arxiv.org/html/2607.26339#bib.bib14)\) are not the primary target; adversarial retriever training provides at most partial defense against them\.

#### Corpus and query assumptions\.

RAGuard assumes \(i\) the query stream is clean \(no adversarially crafted queries\); \(ii\) the retrieval corpus is partially poisoned, with poison ratios of 5–30% in our experiments; and \(iii\) the gold \(correct\) document exists somewhere in the corpus, even if not always retrieved\. Assumption \(iii\) matters for ZKIP: if no correct evidence is retrievable, removing a poison cannot restore a correct answer, and the stability signal degrades toward the failure mode described in §[5\.4](https://arxiv.org/html/2607.26339#S5.SS4)\.

## Appendix CRetriever Training Details

Table 6:Full retriever fine\-tuning configuration\. “Dense \(clean\)” uses the clean triples file; “Dense \(adv\-trained\)” uses the poisoned triples file with the same hyperparameters\.Each training triple is\{\\\{query, gold document, negative document\}\\\}\. For triples carrying a poison label, the negative is the attack\-family\-specific rewrite of that triple’s gold document, making the contrastive signal directly anti\-poison; clean triples use in\-corpus random negatives\. The released training script \(retrievers/train\.py\) additionally supports contrastive and in\-batch\-negative losses, hard\-negative selection, a configurable training poison ratio, and per\-epoch loss logging for reproducibility; the configuration in Table[6](https://arxiv.org/html/2607.26339#A3.T6)reproduces the checkpoints used in this paper\. ZKIP defaults:λ=0\.5\\lambda=0\.5, removal budgetm=1m=1,k=5k=5, answer encoderall\-MiniLM\-L6\-v2, generator GPT\-4o\-mini \(temperature 0\.2, top\-pp0\.95, max 128 tokens\)\.

## Appendix DSupervised Poison Classification Ablations

This appendix reports supervised poison\-classification ablations that complement ZKIP\. Whereas ZKIP is label\-free and operates by counterfactual sensitivity, these ablations test whether \(i\) poisoned passages are distinguishable from gold passages directly from text, and \(ii\) ZKIP\-derived influence signals are sufficiently informative for a supervised model to predict poison labels\. These results are a supervised upper bound: they require labeled poison data during training, while ZKIP does not\.

### D\.1Experimental Setup

We extract eight features per retrieved document:rank\_pos\(normalized retrieval rank\),sim\_q\(query–document cosine\),sim\_ans\(similarity between baseline and counterfactual answers\),entropy\_delta\(Δ​Hi\\Delta H\_\{i\}per Equation[6](https://arxiv.org/html/2607.26339#S3.E6)\),f1\_deltaandem\_delta\(answer\-score change on removal; gold\-dependent, used only in this supervised analysis\),flip\_wrong\_to\_right\(indicator that removal corrects a wrong answer; gold\-dependent, supervised analysis only\), andsim\_z\(embedding outlier z\-score within the retrieved set\)\. The released feature extractor exposes anoracle\_freemode that drops the gold\-dependent features for inference\-time use\.

### D\.2Text\-Level Classification on Gold vs\. Poison Pairs

Table 7:BERT poison\-classifier performance on gold vs\. poison document pairs: high precision but low recall on NQ indicates many poisons are lexically subtle rewrites that text alone cannot flag without over\-triggering\.Across NQ, AUPRC remains stable at≈\\approx0\.717–0\.720 over poisoning ratios from 5% to 30%, with ROC\-AUC≈\\approx0\.685–0\.690 \(Table[7](https://arxiv.org/html/2607.26339#A4.T7)\)\. Precision is high \(≈\\approx0\.84–0\.85\) but recall is low \(≈\\approx0\.22–0\.23\): the classifier is conservative, flagging only a limited subset of poisons\. Many poisons are semantically subtle rewrites that remain lexically and stylistically similar to gold documents\. On BEIR, the profile is more balanced \(precision≈\\approx0\.65, recall≈\\approx0\.47–0\.49\), suggesting poisoned passages are comparatively easier to separate at the document\-text level there, potentially due to greater topical diversity or larger stylistic shifts\.

### D\.3Feature\-Level Classification Using ZKIP Influence Signals

Table 8:Classifier performance on labeled NQ using ZKIP\-derived influence features: nonlinear models nearly double AUPRC over a linear baseline, indicating exploitable interactions among counterfactual signals\.A logistic\-regression baseline achieves AUPRC 0\.377 and ROC\-AUC 0\.571, while the BERT\-based classifier improves substantially to AUPRC 0\.732 and ROC\-AUC 0\.814, with F1 increasing from 0\.514 to 0\.636 \(Table[8](https://arxiv.org/html/2607.26339#A4.T8)\)\. The AUPRC gain matters under class imbalance and indicates that nonlinear models exploit interactions among influence features \(e\.g\., combining answer destabilization with retrieval rank and similarity cues\) that a linear model cannot capture\. In the logistic\-regression feature\-importance analysis, retrieval rank \(rank\_pos\) dominates, followed by query similarity \(sim\_q\) and answer stability \(sim\_ans\), with the entropy differential contributing a smaller but nonzero share\.

### D\.4Takeaway and Relationship to ZKIP

These supervised results support the central motivation of ZKIP: poisoned passages induce measurable, systematic changes in generation under counterfactual removal, and these changes contain learnable signal\. However, unlike ZKIP, supervised classifiers require poison labels for training and may not generalize to unseen attack styles without continual relabeling and retraining\. We therefore treat the learned classifiers as ablations that validate the informativeness of ZKIP’s influence signals, while maintaining ZKIP as the primary, label\-free defense\.