PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption

# PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
Source: [https://arxiv.org/html/2607.00012](https://arxiv.org/html/2607.00012)
Xue Tan1,3,Yi Zheng1,Chang Huo1,Yunruo Zhang3,Yu Liu1,3,Hao Luan1,3, Zhuyang Yu1,3,Xiaoyan Sun2🖂\{\}^\{\\textrm\{\\Letter\}\},Ping Chen3🖂\{\}^\{\\textrm\{\\Letter\}\},Jun Dai2🖂\{\}^\{\\textrm\{\\Letter\}\} 1School of Computer Science, Fudan University, Shanghai, China, 2Department of Computer Science, Worcester Polytechnic Institute, MA, USA, 3Institute of Big Data, Fudan University, Shanghai, China, Corresponding authors:[pchen@fudan\.edu\.cn,](https://arxiv.org/html/2607.00012v1/mailto:[email protected])[xsun7@wpi\.edu,](https://arxiv.org/html/2607.00012v1/mailto:[email protected])[jdai@wpi\.edu](https://arxiv.org/html/2607.00012v1/mailto:[email protected])

###### Abstract

Retrieval\-Augmented Generation \(RAG\) enhances Large Language Models \(LLMs\) by incorporating external knowledge, effectively mitigating their inherent knowledge limitations\. However, RAG remains vulnerable to poisoning attacks that manipulate retrieved texts to mislead model outputs\. Existing defense mechanisms often lack theoretical robustness guarantees and perform unreliably when the LLM has limited knowledge of the retrieved content\. In this work, we propose PRA\-RAG, a provably robust retrieval aggregation algorithm designed to defend against poisoning attacks on retrieved texts\. PRA\-RAG samples multiple combinations of retrieved texts and utilizes geometric structures in the embedding space to identify a robust subset, from which a stable aggregated representation is derived\. We provide theoretical bounds on the maximum impact of poisoned retrieved content and establish a quantitative measure of RAG’s robustness\. Experiments across multiple benchmarks and RAG architectures demonstrate that PRA\-RAG reduces the attack success rate to as low as1%while maintaining an accuracy of71%, significantly outperforming representative state\-of\-the\-art \(SOTA\) methods\.

PRA\-RAG: Provably Robust Aggregation in Retrieval\-Augmented Generation against Retrieval Corruption

Xue Tan1,3, Yi Zheng1, Chang Huo1, Yunruo Zhang3, Yu Liu1,3, Hao Luan1,3,Zhuyang Yu1,3,Xiaoyan Sun2🖂\{\}^\{\\textrm\{\\Letter\}\},Ping Chen3🖂\{\}^\{\\textrm\{\\Letter\}\},Jun Dai2🖂\{\}^\{\\textrm\{\\Letter\}\}1School of Computer Science, Fudan University, Shanghai, China,2Department of Computer Science, Worcester Polytechnic Institute, MA, USA,3Institute of Big Data, Fudan University, Shanghai, China,Corresponding authors:[pchen@fudan\.edu\.cn,](https://arxiv.org/html/2607.00012v1/mailto:[email protected])[xsun7@wpi\.edu,](https://arxiv.org/html/2607.00012v1/mailto:[email protected])[jdai@wpi\.edu](https://arxiv.org/html/2607.00012v1/mailto:[email protected])

## 1Introduction

Retrieval\-Augmented Generation \(RAG\)Lewis et al\. \([2020](https://arxiv.org/html/2607.00012#bib.bib20)\)is an advanced generative paradigm that integrates external knowledge databases to effectively address the limitations of LLMs in domain\-specific knowledge coverage and access to up\-to\-date information\. In a typical RAG pipeline, when a user submits a query \(e\.g\., “What is the name of the highest mountain?"\), the retriever first encodes it into an embedding vector using a text encoder \(e\.g\., BERTKenton and Toutanova \([2019](https://arxiv.org/html/2607.00012#bib.bib17)\)\) and then retrieves the most similar texts from an external knowledge database\. These retrieved texts are subsequently provided as context to the LLM to guide and enhance the response generation process\. RAG has been widely adopted in various real\-world applications due to its strengths in knowledge augmentation and high\-quality generation, with prominent examples including ChatGPTAchiam et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib1)\), Microsoft Bing ChatMicrosoft \([2024](https://arxiv.org/html/2607.00012#bib.bib21)\), and Google Search AIGoogle \([2024](https://arxiv.org/html/2607.00012#bib.bib10)\)\. However, the integration of external knowledge databases further exacerbates concerns regarding the security of LLMsrocky \([2024](https://arxiv.org/html/2607.00012#bib.bib23)\); BBC \([2024](https://arxiv.org/html/2607.00012#bib.bib5)\)\.

Recent studies have shown that injecting malicious content into retrieved texts can steer the LLM to generate responses aligned with the attacker’s intent \(e\.g\., the target answer could be “Fuji" when the target question is “What is the name of the highest mountain?"\), thereby posing a serious threat to the reliability and security of RAG systemsZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\); Greshake et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib11)\); Tan et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib25)\)\. To counter attacks induced by poisoned texts, AstuteRAGWang et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib27)\)and TrustRAGZhou et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib38)\)introduce detection\-based defenses that leverage the internal knowledge of LLMs to identify and filter maliciously retrieved content\. However, their effectiveness is limited in scenarios where the LLM lacks sufficient knowledge to recognize the poisoned inputs\. Moreover, existing methodsWang et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib27)\); Zhou et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib38)\); Wei et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib28)\); Asai et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib2)\)lack a theoretical framework for certifying or quantifying the robustness of RAG systems, leaving their reliability under adversarial conditions largely unverified\. RobustRAGXiang et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib29)\)guarantees robustness for LLM outputs but incurs high computational overhead by requiring multiple LLM generations\.

In this work, we propose PRA\-RAG, aProvablyRobust retrievalAggregation algorithm forRAGsystems, designed to mitigate the risk of poisoning attacks at the retrieval stage\. During retrieval, we intentionally expand the candidate set to increase informational diversity, which enhances the system’s resilience to poisoned content by reducing the influence of any single malicious text\. The aggregation process consists of three key steps\.First, multiple subsets of the retrieved texts are sampled to form diverse candidate combinations, thereby constraining the influence of poisoned content within a controllable range\.Second, Each combination is encoded into an embedding vector\. In this geometric space, we identify aminimum\-radius ballthat encloses more than half of the combinations and take its center as the selected robust subset\.Finally, a weighted average of the selected subset’s embeddings yields a robust representation that captures consensus and reduces outlier influence\.

Benefiting from the proposed concept of the minimum radius ball, we model the semantic shift in retrieved texts caused by poisoning attacks\. We show that this shift is bounded by a theoretical upper limit, as mathematically proved in Section[5](https://arxiv.org/html/2607.00012#S5)\. The semantic shift quantifies how poisoning influences retrieval, while the upper bound offers a theoretical basis for constraining this effect\. The key contributions of our work are:

- •Theory:We theoretically characterize and certify the maximum semantic deviation caused by poisoned retrievals, providing a principled metric to evaluate system robustness and attack effectiveness\.
- •Algorithm:We propose PRA\-RAG, a provably robust aggregation algorithm for RAG systems that effectively mitigates the influence of poisoned retrievals and preserves the accuracy of generated outputs\.
- •Evaluation:We conduct extensive experiments to validate the effectiveness of PRA\-RAG\. For example, on the MSMARCO dataset with 20% of the retrievals poisoned, our method achieves an accuracy of 71% while reducing the attack success rate to just 1%\. Our approach also surpasses state\-of\-the\-art methods in efficiency\.

## 2Background and Related Work

Retrieval\-Augmented Generation\.RAG comprises three components:knowledge database,retriever, andLLM\. The knowledge database contains newly added or updated information beyond the LLM’s training data, often sourced from WikipediaThakur et al\. \([2021](https://arxiv.org/html/2607.00012#bib.bib26)\)and similar platforms\. The retriever selects the Top\-KKtexts most similar to the queryqqas external context, which the LLM uses alongsideqqto generate an answer\. RAG involves two key stages: retrieval and generation\. In the retrieval step, a retriever selects the Top\-KKrelevant knowledge pieces for a queryqq\. This is done using two encoders:EqE\_\{q\}for the query andEpE\_\{p\}for knowledge passages\. Each passage embeddingEp​\(pi\)E\_\{p\}\(p\_\{i\}\)is compared withEq​\(q\)E\_\{q\}\(q\)using a similarity metric \(e\.g\., cosine or dot product\), and the Top\-KKresults form the context𝒳q\\mathcal\{X\}\_\{q\}\. In the generation step, the queryqqand context𝒳q\\mathcal\{X\}\_\{q\}are combined as a prompt for the LLM to generate a response\. Retrieval Corruption Attack\.The use of external knowledge databases in RAG introduces security vulnerabilities\. PoisonedRAGZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\)generates adversarially crafted texts through an optimization\-based approach and injects them into the knowledge database, thereby inducing the LLM to produce attacker\-specified target responses\. The Denial\-of\-Service AttackShafran et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib24)\)involves inserting a single “blocker" document into the knowledge database, which is retrieved in response to a specific query and causes the RAG system to refuse to answer that query\. Adversarial DecodingZhang et al\. \([2025c](https://arxiv.org/html/2607.00012#bib.bib37)\)performs RAG poisoning and LLM guard evasion by generating readable adversarial texts through adversarial decoding\. BadRAGXue et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib31)\)employs white\-box optimization to attack the retriever and uses handcrafted documents to target the generator\.PR\-AttackJiao et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib16)\)jointly optimizes a trigger and a small set of poisoned texts to stealthily induce the RAG system to generate a target response\. CorruptRAGZhang et al\. \([2025a](https://arxiv.org/html/2607.00012#bib.bib35)\)misleads the model into producing targeted false content by prompting the LLM to label the correct answer as outdated and to generate a fabricated latest but incorrect answer\.The aforementioned attack methods are highly effective\. To assess our defense, we select representative attacks to simulate realistic RAG poisoning scenarios\. The Robustness of RAG\.In order to defend against the aforementioned retrieval\-targeted poisoning attacks, TrustRAGZhou et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib38)\)introduces a two\-stage defense mechanism that leverages the semantic characteristics of poisoned texts and the inherent knowledge of the LLM, effectively mitigating both single\-point and multi\-corpus injection attacks\. INSTRUCTRAGWei et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib28)\)is designed to explicitly learn how to denoise retrieved content, thereby addressing the presence of poisoned or irrelevant information\. SELF\-RAGAsai et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib2)\)proposes a framework that enhances generation quality and factual accuracy through self\-reflection mechanisms within the LLM\.RAGForensicsZhang et al\. \([2025b](https://arxiv.org/html/2607.00012#bib.bib36)\)employs an iterative retrieval mechanism that combines an LLM with carefully designed chain\-of\-thought prompts to perform round\-by\-round judgment and filtering of candidate retrieved texts\. RAGuardCheng et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib7)\)integrates a two\-stage filtering mechanism based on chunk\-level perplexity and text similarity, which can effectively identify and remove malicious poisoned content from the retrieved results\.Other strategies include carefully crafted promptsCho et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib9)\); Press et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib22)\), plug\-in model architecturesBaek et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib3)\), and purpose\-built specialized modelsYoran et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib34)\)\. However, these defense strategies lack quantitative robustness evaluations and theoretical guarantees for RAG systems\. RobustRAGXiang et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib29)\)enhances RAG robustness by using multiple LLMs and a voting mechanism to filter poisoned content, providing theoretical guarantees but at the cost of significant computational overhead and challenging output aggregation\. We propose a provably robust RAG algorithm that quantitatively evaluates robustness and provides strong empirical defense against poisoning attacks\.

![Refer to caption](https://arxiv.org/html/2607.00012v1/x1.png)Figure 1:The PRA\-RAG pipeline against poisoned retrieval\.
## 3Preliminary

### 3\.1Threat Model

We study*retrieval\-corruption*attacks on RAG systems, where an adversary poisons the external corpus so that the retrieved context steers the generator to produce attacker\-chosen outputs\. We first specify the system and notation, then state the attacker’s objectives and capabilities\.

#### System and notation\.

Let𝒟\\mathcal\{D\}denote the corpus, and letℛ\\mathcal\{R\}be the retriever that returns the Top\-KKpassages for a queryqq, denoted as𝒳K​\(q;𝒟\)=\{p1,…,pK\}\\mathcal\{X\}\_\{K\}\(q;\\mathcal\{D\}\)=\\\{p\_\{1\},\\ldots,p\_\{K\}\\\}\. Under poisoning, the adversary injects a set of passagesΓ\\Gammainto the corpus, yielding𝒟′=𝒟∪Γ\\mathcal\{D\}^\{\\prime\}=\\mathcal\{D\}\\cup\\Gamma\. The corresponding retrieved set is𝒳K′​\(q\)=𝒳K​\(q;𝒟′\)\\mathcal\{X\}^\{\\prime\}\_\{K\}\(q\)=\\mathcal\{X\}\_\{K\}\(q;\\mathcal\{D\}^\{\\prime\}\)withε=𝒳K′​\(q\)∩Γ\\varepsilon\\;=\\;\\mathcal\{X\}^\{\\prime\}\_\{K\}\(q\)\\cap\\Gammaand𝒳K′​\(q\)=\{p~1,…,p~ε\}∪\{p1,…,pK−ε\}\\mathcal\{X\}^\{\\prime\}\_\{K\}\(q\)=\\\{\\tilde\{p\}\_\{1\},\\ldots,\\tilde\{p\}\_\{\\varepsilon\}\\\}\\cup\\\{p\_\{1\},\\ldots,p\_\{K\-\\varepsilon\}\\\}\. We usennto denote the subset size in our mechanism\.

#### Attacker’s objectives\.

The attacker selects a set of target queriesQ=\{q1,…,qM\}Q=\\\{q\_\{1\},\\ldots,q\_\{M\}\\\}along with corresponding target answersA=\{a1,…,aM\}A=\\\{a\_\{1\},\\ldots,a\_\{M\}\\\}\. The goal is to poison the corpus so that, for eachqi∈Qq\_\{i\}\\in Q, the RAG system generates the attacker\-specified answeraia\_\{i\}when using retrieved context from the contaminated corpus𝒟′\\mathcal\{D\}^\{\\prime\}\. For instance, given the queryqiq\_\{i\}:*“What is the name of the highest mountain?”*, the attacker attempts to make the system output the incorrect response*“Mount Fuji”*\.

#### Attacker’s capabilities\.

We consider an adversary who can inject a set of malicious passagesΓ=\{p~ji∣i=1,…,M;j=1,…,N\}\\Gamma=\\\{\\tilde\{p\}\_\{j\}^\{i\}\\mid i=1,\\ldots,M;\\;j=1,\\ldots,N\\\}into the external corpus \(e\.g\., via content published on open platforms such as Wikipedia or via data vendors that aggregate third\-party content\)\. The attacker has no knowledge of the LLM parameters or decoding, but is assumed to have white\-box knowledge of the retriever because many retrievers \(e\.g\., ContrieverIzacard et al\. \([2021](https://arxiv.org/html/2607.00012#bib.bib13)\), ANCEXiong et al\. \([2020](https://arxiv.org/html/2607.00012#bib.bib30)\)\) are publicly available\. We do not assume strict geometric separability between clean and poisoned passages\. Our method’s robustness is distribution\-free and relies solely on a*combinatorial majority*: among the Top\-KKitems with at mostε\\varepsilonpoisons, the\(K−εn\)\\binom\{K\-\\varepsilon\}\{n\}clean size\-nnsubsets exceed half of all\(Kn\)\\binom\{K\}\{n\}subsets whenever\(K−εn\)\>12​\(Kn\)\\binom\{K\-\\varepsilon\}\{n\}\>\\tfrac\{1\}\{2\}\\binom\{K\}\{n\}\. Our aggregation targets this majority, so certification holds even when embeddings are very close\. This assumption is valid in real\-world scenarios, as achieving an excessively largeε\\varepsilonto heavily poison a RAG database incurs prohibitive costs and is inherently challenging for attackers\.

### 3\.2Defense Objective

In this work, our defense primarily focuses on mitigating attacks launched through the injection of poisoned textsZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\); Xue et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib31)\); Jiao et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib15)\)rather than prompt injectionGreshake et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib11)\)\. Our approach aims to limit the impact of poisoned passages while maintaining the retrieval and generation quality in RAG\.

#### Quantifying the effect of poisoning\.

Heuristic defenses often lack a precise characterization of how poisoned content perturbs the system\. Our robustness operatorℱ\\mathcal\{F\}aggregates the retrieved set𝒳′\\mathcal\{X\}^\{\\prime\}and provides a certified upper bound on the induced semantic deviation \(PAD\), enabling quantitative evaluation of RAG robustness\.

#### Low ASR with high ACC\.

Mitigating poisoning while maintaining usability is essential\. A low Attack Success Rate \(ASR\) indicates effective defense, whereas a high Accuracy \(ACC\) reflects preserved generation quality\. We formalize the robustness–utility trade\-off as

minℱ\\displaystyle\\min\_\{\\mathcal\{F\}\}ASR\(LLM\(qi;ℱ\(𝒳K′\(qi\)\)\)\\displaystyle\\quad\\mathrm\{ASR\}\(\\mathrm\{LLM\}\(q\_\{i\};\{\\mathcal\{F\}\}\(\\mathcal\{X\}^\{\\prime\}\_\{K\}\(q\_\{i\}\)\)\)\(1\)s\.t\.\\displaystyle\\mathrm\{s\.t\.\}ACC\(LLM\(qi;ℱ\(𝒳K′\(qi\)\)\)≥θ\.\\displaystyle\\quad\\mathrm\{ACC\}\(\\mathrm\{LLM\}\(q\_\{i\};\{\\mathcal\{F\}\}\(\\mathcal\{X\}^\{\\prime\}\_\{K\}\(q\_\{i\}\)\)\)\\geq\\theta\.whereθ\\thetais a user\-specified minimum acceptable accuracy\. Overly conservative behavior \(e\.g\., blanket refusals\) may trivially reduce ASR but harms usability; our objective explicitly discourages such solutions by enforcing the ACC constraint\.

## 4Our Provable PRA\-RAG

In RAG, we cast retrieval corruption as a*set perturbation*problem, where an adversary alters at mostε\\varepsilonitems in the Top\-KKset, and propose a geometric, model\-agnostic retrieval aggregation that operates on*combination embeddings*\. As illustrated in Fig\.[1](https://arxiv.org/html/2607.00012#S2.F1), given a queryqq, we retrieve the Top\-KKmost relevant documents from a knowledge database, denoted as the set𝒳=\{p1,…,pK\}\\mathcal\{X\}=\\\{p\_\{1\},\\ldots,p\_\{K\}\\\}\. In our approach, we set the number of retrieved textsKKslightly higher than the actual requirement to introduce diversity, thereby mitigating the impact of poisoned content\. Next, we sample multiple subsets from the retrieved texts\. Let𝒮𝒳,n=\{s1,s2,…,sL\}\\mathcal\{S\}\_\{\\mathcal\{X\},n\}=\\\{s\_\{1\},s\_\{2\},\\ldots,s\_\{L\}\\\}denote the set of all possible subsets of sizenndrawn from theKKretrieved documents, whereL=\(Kn\)L=\\binom\{K\}\{n\}\. Each documentpip\_\{i\}in the subset is encoded as an embedding vector𝐞i←E​m​b​e​d​\(pi\),𝐞i∈ℝd\\mathbf\{e\}\_\{i\}\\leftarrow Embed\(p\_\{i\}\),\\mathbf\{e\}\_\{i\}\\in\\mathbb\{R\}^\{d\}, yielding a set of embeddings in thedd\-dimensional vector space\. We construct the corresponding vector set𝒱𝒳,n=\{v1,v2,…,vL\}\\mathcal\{V\}\_\{\\mathcal\{X\},n\}=\\\{v\_\{1\},v\_\{2\},\\ldots,v\_\{L\}\\\}from the set𝒮\\mathcal\{S\}, where each vectorviv\_\{i\}is formed by concatenating the embedding vectors𝐞i\\mathbf\{e\}\_\{i\}of all texts insis\_\{i\}\. The concatenation order of𝐞i\\mathbf\{e\}\_\{i\}withinsis\_\{i\}strictly follows the relative order of their corresponding textspip\_\{i\}\.

Algorithm 1Inference Procedure for Selecting Robust Retrieval Text1:Input: A set of Top\-

KKretrieved texts

𝒳=\{p1,p2,…,pK\}\\mathcal\{X\}=\\\{p\_\{1\},p\_\{2\},\\dots,p\_\{K\}\\\}; subset size

nn\(with constraint

2​n<K2n<K\)\.

2:Output: A robustly aggregated retrieval text

x∗x^\{\*\}for LLMs\.

3:

𝒮𝒳,n=\{s1,s2,…,sL\}←Comb​\(𝒳,n\)\\mathcal\{S\}\_\{\\mathcal\{X\},n\}=\\\{s\_\{1\},s\_\{2\},\\ldots,s\_\{L\}\\\}\\leftarrow\\mathrm\{Comb\}\(\\mathcal\{X\},n\),

L=\(Kn\)L=\\binom\{K\}\{n\}
4:for

i=1i=1to

LLdo

5:

embeddings←\[E​m​b​e​d​\(p\)∣p∈si\]\\text\{embeddings\}\\leftarrow\[\\,Embed\(p\)\\mid p\\in s\_\{i\}\\,\]
6:

vi←Concat​\(embeddings\)v\_\{i\}\\leftarrow\\mathrm\{Concat\}\(\\text\{embeddings\}\)
7:

𝒱𝒳,n←𝒱𝒳,n∪\{vi\}\\mathcal\{V\}\_\{\\mathcal\{X\},n\}\\leftarrow\\mathcal\{V\}\_\{\\mathcal\{X\},n\}\\cup\\\{v\_\{i\}\\\}
8:endfor

9:for

i=1i=1to

LLdo

10:Initialize similarity vector𝐬𝐢𝐦i∈RL−1\\mathbf\{sim\}\_\{i\}\\in\{R\}^\{L\-1\}

11:for

j=1j=1to

LLand

j≠ij\\neq ido

12:

di​j←arccos⁡\(cos⁡\(vi,vj\)\)d\_\{ij\}\\leftarrow\\arccos\(\\cos\(v\_\{i\},v\_\{j\}\)\)
13:Store

di​jd\_\{ij\}in

𝐬𝐢𝐦i\\mathbf\{sim\}\_\{i\}
14:endfor

15:Sort

𝐬𝐢𝐦i\\mathbf\{sim\}\_\{i\}in ascending order

16:Letmi←m\_\{i\}\\leftarrowthekk\-th smallest value in𝐬𝐢𝐦i\\mathbf\{sim\}\_\{i\},k=⌊L2⌋k=\\left\\lfloor\\frac\{L\}\{2\}\\right\\rfloor

17:endfor

18:Identify

i∗=arg⁡mini⁡mii^\{\*\}=\\arg\\min\_\{i\}m\_\{i\},

R=mi∗R=m\_\{i^\{\*\}\}
19:Compute

xi∗=Aggregate​\(\[E​m​b​e​d​\(p\)∣p∈si∗\]\)x\_\{i^\{\*\}\}=\\mathrm\{Aggregate\}\(\[\\,Embed\(p\)\\mid p\\in s\_\{i^\{\*\}\}\\,\]\)
20:return

xi∗x\_\{i^\{\\ast\}\}as input to the LLMs

We define the distance between two vectorsu,v∈𝒱𝒳,nu,v\\in\\mathcal\{V\}\_\{\\mathcal\{X\},n\}as the angular distance:d​\(u,v\)=arccos⁡\(cos⁡\(u,v\)\)∈\[0,π\]d\(u,v\)=\\arccos\(\\cos\(u,v\)\)\\in\[0,\\pi\], wherecos⁡\(u,v\)=u⋅v‖u‖​‖v‖\\cos\(u,v\)=\\frac\{u\\cdot v\}\{\\\|u\\\|\\\|v\\\|\}denotes the cosine similarity\.For a pointv∈𝒱𝒳,nv\\in\\mathcal\{V\}\_\{\\mathcal\{X\},n\}and radiusR\>0R\>0, define the ball:

B​\(v,R\)=\{u∈𝒱𝒳,n:d​\(u,v\)≤R\}\.B\(v,R\)=\\\{u\\in\\mathcal\{V\}\_\{\\mathcal\{X\},n\}:d\(u,v\)\\leq R\\\}\.\(2\)Our methodℱ\\mathcal\{F\}aims to identify the center of a minimum\-radius ball that contains more than half of the points, representing the desired output of the robust aggregation process\. Formally, the objective is defined as:

ℱ​\(𝒳\)=arg⁡minz⁡Rs\.t\.\\displaystyle\\mathcal\{F\}\(\\mathcal\{X\}\)=\\arg\\min\_\{z\}\\;R\\quad\\text\{s\.t\.\}∑w∈V𝒳,n𝟏ℬ​\(z,R\)​\(w\)\\displaystyle\\sum\_\{w\\in V\_\{\\mathcal\{X\},n\}\}\\mathbf\{1\}\_\{\\mathcal\{B\}\(z,R\)\}\(w\)\(3\)≥⌊\(Kn\)2⌋\+1,\\displaystyle\\geq\\left\\lfloor\\frac\{\\binom\{K\}\{n\}\}\{2\}\\right\\rfloor\+1,where𝒳\\mathcal\{X\}denotes the input set,V𝒳,nV\_\{\\mathcal\{X\},n\}is the vector collection of allnn\-element subsets of𝒳\\mathcal\{X\},ℬ​\(z,R\)\\mathcal\{B\}\(z,R\)denotes a ball of radiusRRcentered atzz\. The indicator function𝟏ℬ​\(z,R\)​\(w\)\\mathbf\{1\}\_\{\\mathcal\{B\}\(z,R\)\}\(w\)is defined to be11ifw∈ℬ​\(z,R\)w\\in\\mathcal\{B\}\(z,R\), and0otherwise\. This formulation ensures that the selected centerzzlies within a ball that encompasses the majority of the subsets\. SinceS𝒳,nS\_\{\\mathcal\{X\},n\}includes all possible combinations of the retrieved texts, the centroidzzcorresponding to the selected subsetsseffectively captures the meaning of the majority of texts in𝒳\\mathcal\{X\}, thereby filtering out a small number of poisoned texts\.

Finally, we compute a weighted average of the embedding vectors of the texts in the selected subsetsi∗s\_\{i^\{\*\}\}, where the weights are determined by the similarity \(e\.g\., cosine similarity\) between each textp∈si∗p\\in s\_\{i^\{\*\}\}and the queryqq:

xi∗=∑p∈si∗sim​\(p,q\)⋅Embed​\(p\)∑p∈si∗sim​\(p,q\),x\_\{i^\{\*\}\}=\\frac\{\\sum\\limits\_\{p\\in s\_\{i^\{\*\}\}\}\\mathrm\{sim\}\(p,q\)\\cdot\\mathrm\{Embed\}\(p\)\}\{\\sum\\limits\_\{p\\in s\_\{i^\{\*\}\}\}\\mathrm\{sim\}\(p,q\)\},\(4\)which helps prevent poisoned texts from evading filtration due to semantic similarity with clean texts, yielding the final robust aggregation result\. More details are provided in Algorithm[1](https://arxiv.org/html/2607.00012#alg1)\.

## 5Computing the Certified Maximum Deviation

In the context of retrieval\-based text poisoning attacks on RAG systems, we assume that the attacker successfully injectsε\\varepsilonmalicious documents into the final retrieved set𝒳\\mathcal\{X\}, resulting in a perturbed set𝒳′=\[p~1,p~2,…,p~ε\]∪\[p1,p2,…,pK−ε\]\\mathcal\{X^\{\{\}^\{\\prime\}\}\}=\\left\[\\tilde\{p\}\_\{1\},\\tilde\{p\}\_\{2\},\\dots,\\tilde\{p\}\_\{\\varepsilon\}\\right\]\\cup\\left\[\{p\_\{1\},p\_\{2\},\\dots,p\_\{K\-\\varepsilon\}\}\\right\], where eachp~i\\tilde\{p\}\_\{i\}represents a poisoned document inserted by the attacker, and eachpip\_\{i\}denotes a clean document\. In the absence of poisoning attacks, the center of the minimum\-radius ball computed by Algorithm[1](https://arxiv.org/html/2607.00012#alg1)is used as the robust output\. Under poisoning attacks, the radiusR^\\hat\{R\}is enlarged to counter the shift caused by theε\\varepsilonpoisoned texts, ensuring that over half of the embeddings remain within the ball\. Accordingly, the radius is approximately set toR^←𝒟​\[k\]\\hat\{R\}\\leftarrow\\mathcal\{D\}\[k\], wherek=⌊\(Kn\)2⌋\+\(\(Kn\)−\(K−εn\)\),k=\\left\\lfloor\\frac\{\\binom\{K\}\{n\}\}\{2\}\\right\\rfloor\+\\left\(\\binom\{K\}\{n\}\-\\binom\{K\-\\varepsilon\}\{n\}\\right\),as shown in Algorithm[2](https://arxiv.org/html/2607.00012#alg2)\.To ensure that the empirical radiusR^\\hat\{R\}satisfies the theoretical majority condition, Lemma 1 \(Section[A\.4](https://arxiv.org/html/2607.00012#A1.SS4)\) guarantees that the majority ball contains a strict majority of clean combinations\. Combined with the geometric separability assumption \(Section[A\.5](https://arxiv.org/html/2607.00012#A1.SS5)\), this ensures the center is anchored to the clean subset\.We denote the embedding shift of the final aggregated text caused by poisoned samples asdd, whered=\(1\+β\)​R^d=\(1\+\\beta\)\\hat\{R\}\. The proposed metricddeffectively quantifies the impact of poisoned texts on the retrieval results\. A smallerddindicates lower sensitivity to perturbations, implying stronger robustness and greater resistance to successful attacks\. Certifying the Upper Bound of Deviationdd\.Let𝒳′\\mathcal\{X^\{\\prime\}\}be any corrupted version of𝒳\\mathcal\{X\}obtained by changing at mostε\\varepsilonpassages, that is‖𝒳′−𝒳‖0≤ε\\\|\\mathcal\{X^\{\\prime\}\}\-\\mathcal\{X\}\\\|\_\{0\}\\leq\\varepsilon\. Define the robustness radiusRRas the smallest value satisfying

∀𝒳′​s\.t\.​‖𝒳′−𝒳‖0≤ε,\\displaystyle\\forall\\,\\mathcal\{X^\{\\prime\}\}\\text\{ s\.t\. \}\\\|\\mathcal\{X^\{\\prime\}\}\-\\mathcal\{X\}\\\|\_\{0\}\\leq\\varepsilon,∑w∈𝒱𝒳′,n𝟏ℬ​\(ℱ​\(𝒳\),R\)​\(w\)\\displaystyle\\sum\_\{w\\in\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}\}\\mathbf\{1\}\_\{\\mathcal\{B\}\(\\mathcal\{F\}\(\\mathcal\{X\}\),R\)\}\(w\)\(5\)≥⌊\(Kn\)2⌋\+1\.\\displaystyle\\geq\\left\\lfloor\\frac\{\\binom\{K\}\{n\}\}\{2\}\\right\\rfloor\+1\.We present the following theorem: Theorem 1\.For𝒳′\\mathcal\{X^\{\\prime\}\}satisfying‖𝒳′−𝒳‖0≤ε\\\|\\mathcal\{X^\{\\prime\}\}\-\\mathcal\{X\}\\\|\_\{0\}\\leq\\varepsilon,

d​\(ℱ​\(𝒳\),ℱ​\(𝒳′\)\)≤2​R,d\\bigl\(\\mathcal\{F\}\(\\mathcal\{X\}\),\\,\\mathcal\{F\}\(\\mathcal\{X^\{\\prime\}\}\)\\bigr\)\\;\\leq\\;2R,\(6\)where the proof is provided in Section[A\.1](https://arxiv.org/html/2607.00012#A1.SS1)\. However, computingℱ​\(𝒳\)\\mathcal\{F\}\(\\mathcal\{X\}\)exactly is computationally expensive in practice\. Therefore, we use an approximation method from Center SmoothingKumar and Goldstein \([2021](https://arxiv.org/html/2607.00012#bib.bib18)\)to compute aβ\\beta\-MEB \(Minimum Enclosing Ball\) that contains the majority of elements in𝒱𝒳,n\\mathcal\{V\}\_\{\\mathcal\{X\},n\}, denoted as:

ℱ^​\(𝒳\)=arg⁡minz∈𝒱𝒳,n⁡Rs\.t\.∑w∈𝒱𝒳,n𝟏ℬ​\(z,R\)​\(w\)≥⌊\(Kn\)2⌋\+1\.\\widehat\{\\mathcal\{F\}\}\(\\mathcal\{X\}\)=\\begin\{aligned\} \\arg\\min\_\{z\\in\\mathcal\{V\}\_\{\\mathcal\{X\},n\}\}\\;R\\quad\\text\{s\.t\.\}\\quad&\\sum\_\{w\\in\\mathcal\{V\}\_\{\\mathcal\{X\},n\}\}\\mathbf\{1\}\_\{\\mathcal\{B\}\(z,R\)\}\(w\)\\\\ &\\geq\\left\\lfloor\\frac\{\\binom\{K\}\{n\}\}\{2\}\\right\\rfloor\+1\.\\end\{aligned\}\(7\)The radius of this approximation differs from the optimal radius by a multiplicative factorβ\\beta\. Similarly, the approximation ofRR, denoted asR^\\widehat\{R\}, is defined to satisfy:

∀𝒳′​s\.t\.​‖𝒳′−𝒳‖0≤ε,\\displaystyle\\forall\\,\\mathcal\{X\}^\{\\prime\}\\text\{ s\.t\. \}\\\|\\mathcal\{X\}^\{\\prime\}\-\\mathcal\{X\}\\\|\_\{0\}\\leq\\varepsilon,∑w∈𝒱𝒳′,n𝟏ℬ​\(ℱ​\(𝒳\),R^\)​\(w\)\\displaystyle\\sum\_\{w\\in\\mathcal\{V\}\_\{\\mathcal\{X\}^\{\\prime\},n\}\}\\mathbf\{1\}\_\{\\mathcal\{B\}\(\\mathcal\{F\}\(\\mathcal\{X\}\),\\widehat\{R\}\)\}\(w\)\(8\)≥⌊\(Kn\)2⌋\+1\.\\displaystyle\\geq\\left\\lfloor\\frac\{\\binom\{K\}\{n\}\}\{2\}\\right\\rfloor\+1\.Then, we have the following theorem: Theorem 2\.For any𝒳′\\mathcal\{X\}^\{\\prime\}satisfying‖𝒳′−𝒳‖0≤ε\\\|\\mathcal\{X\}^\{\\prime\}\-\\mathcal\{X\}\\\|\_\{0\}\\leq\\varepsilon, we have:

d​\(ℱ​\(𝒳\),ℱ​\(𝒳′\)\)≤\(1\+β\)​R^,d\(\\mathcal\{F\}\(\\mathcal\{X\}\),\\mathcal\{F\}\(\\mathcal\{X\}^\{\\prime\}\)\)\\leq\(1\+\\beta\)\\widehat\{R\},\(9\)where the proof is provided in Section[A\.2](https://arxiv.org/html/2607.00012#A1.SS2)\. We follow the practice in the workKumar and Goldstein \([2021](https://arxiv.org/html/2607.00012#bib.bib18)\)to useβ=2\\beta=2as an approximation when computing the minimum enclosing ball:

d​\(ℱ​\(𝒳\),ℱ​\(𝒳′\)\)≤3​R^\.d\(\\mathcal\{F\}\(\\mathcal\{X\}\),\\mathcal\{F\}\(\\mathcal\{X\}^\{\\prime\}\)\)\\leq 3\\widehat\{R\}\.\(10\)
Algorithm 2Certify Robustness under Poisoning1:Input: A set of Top\-

KKretrieved texts

𝒳\\mathcal\{X\}; subset size

nn\(with

2​n<K2n<K\); maximum number of poisoned texts

ε\\varepsilon\(with

\(Kn\)<2​\(K−εn\)\\binom\{K\}\{n\}<2\\binom\{K\-\\varepsilon\}\{n\}\)\.

2:Output: Certified maximum deviation

dd\.

3:Let

𝒮𝒳′,n=Comb​\(𝒳′,n\)\\mathcal\{S\}\_\{\\mathcal\{X^\{\\prime\}\},n\}=\\mathrm\{Comb\}\(\\mathcal\{X^\{\\prime\}\},n\)
4:Initialize

𝒱𝒳′,n←∅\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}\\leftarrow\\emptyset
5:foreach subset

si∈𝒮𝒳′,ns\_\{i\}\\in\\mathcal\{S\}\_\{\\mathcal\{X^\{\\prime\}\},n\}do

6:

vi←Concat​\(\[E​m​b​e​d​\(p\)∣p∈si\]\)v\_\{i\}\\leftarrow\\mathrm\{Concat\}\(\[\\,Embed\(p\)\\mid p\\in s\_\{i\}\\,\]\)
7:

𝒱𝒳′,n←𝒱𝒳′,n∪\{vi\}\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}\\leftarrow\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}\\cup\\\{v\_\{i\}\\\}
8:endfor

9:Let

vorigv\_\{\\text\{orig\}\}be the embedding vector of the subset selected by the Algorithm[1](https://arxiv.org/html/2607.00012#alg1)\.

10:Initialize an empty list of distances

𝒟←∅\\mathcal\{D\}\\leftarrow\\emptyset
11:foreach embedding

vi∈𝒱𝒳′,nv\_\{i\}\\in\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}do

12:

di←arccos\(cos\(vorig,vi\)\)\)\\color\[rgb\]\{0,0,0\}d\_\{i\}\\leftarrow\\arccos\(\{\\cos\(v\_\{\\text\{orig\}\},v\_\{i\}\)\}\)\)
13:Append

did\_\{i\}to

𝒟\\mathcal\{D\}
14:endfor

15:Sort

𝒟\\mathcal\{D\}in ascending order

16:Let

R^←𝒟​\[k\],k=⌊\(Kn\)2⌋\+\(\(Kn\)−\(K−εn\)\)\\hat\{R\}\\leftarrow\\mathcal\{D\}\[k\],k=\\left\\lfloor\\frac\{\\binom\{K\}\{n\}\}\{2\}\\right\\rfloor\+\\left\(\\binom\{K\}\{n\}\-\\binom\{K\-\\varepsilon\}\{n\}\\right\)
17:Let

d=\(1\+β\)​R^d=\\left\(1\+\\beta\\right\)\\hat\{R\}
18:return

ddas the certified maximum deviation

Note that while the theoretical formulation is based on the full set ofL=\(Kn\)L=\\binom\{K\}\{n\}combinations, our framework naturally generalizes to a Monte Carlo sampling approach for larger values ofKKandnn\. In such cases, we samplem≪Lm\\ll Lsubsets, which provides a statistically bounded approximation of the optimal robustness \(see Section[A\.3](https://arxiv.org/html/2607.00012#A1.SS3)\) and our experimental results further corroborate its effectiveness \(see Section[C\.3](https://arxiv.org/html/2607.00012#A3.SS3)\)\.

Table 1:Performance of PRA\-RAG across different attack strategies and datasets under various LLMs \(Top\-K=8K=8, subset sizen=3n=3, poisoning rate = 20%\)\. Attack abbreviations: PR = PoisonedRAG, DoS = DoS Attack, AD = AdvDec, CR = CorruptRAG, Cln = Clean\.
## 6Evaluation

### 6\.1Experimental Setup

In this section, we provide a detailed description of the experimental setup, with additional information and default configurations presented in Section[B\.1](https://arxiv.org/html/2607.00012#A2.SS1)\. Datasets\.To evaluate the effectiveness of the proposed method, we utilize three question\-answering datasets: Natural Questions \(NQ\)Kwiatkowski et al\. \([2019](https://arxiv.org/html/2607.00012#bib.bib19)\), MS\-MARCOBajaj et al\. \([2016](https://arxiv.org/html/2607.00012#bib.bib4)\), and HotpotQAYang et al\. \([2018](https://arxiv.org/html/2607.00012#bib.bib33)\)\. LLM\.We evaluate PRA\-RAG with different LLMs, including Mistral\-7BJiang et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib14)\), Llama3\-8B, Vicuna\-7BChiang et al\. \([2023](https://arxiv.org/html/2607.00012#bib.bib8)\), Qwen3\-8BYang et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib32)\), GPT\-3\.5\-TurboBrown et al\. \([2020](https://arxiv.org/html/2607.00012#bib.bib6)\), and GPT\-5\-mini\. Attackers\.We conduct a systematic evaluation of PRA\-RAG’s defense effectiveness against different types of poisoning attacks targeting the retrieved texts, following prior worksXiang et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib29)\); Zhou et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib38)\):\(1\) Corpus Poisoning Attack: PoisonedRAGZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\), \(2\) Adversarial Decoding: AdvDecZhang et al\. \([2025c](https://arxiv.org/html/2607.00012#bib.bib37)\), \(3\) Denial\-Of\-Service Attack: DoS AttackShafran et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib24)\),and \(4\) CorruptRAGZhang et al\. \([2025a](https://arxiv.org/html/2607.00012#bib.bib35)\)\.Further details of these attack methods are provided in Section[B\.3](https://arxiv.org/html/2607.00012#A2.SS3)\. Defenders\.We demonstrate the advantages of our approach by comparing it with representative state\-of\-the\-art baselines, including RobustRAGXiang et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib29)\), InstructRAGWei et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib28)\), AstuteRAGWang et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib27)\),TrustRAGZhou et al\. \([2025](https://arxiv.org/html/2607.00012#bib.bib38)\), and RAGForensicsZhang et al\. \([2025b](https://arxiv.org/html/2607.00012#bib.bib36)\)with their default configurations\. Evaluation Metrics\.We conduct a comprehensive evaluation of the proposed method using three metrics: \(1\) Adversarial Accuracy \(ACC\) assesses the system’s ability to produce correct answers when subjected to poisoning attacks; \(2\) Attack Success Rate \(ASR\) represents the proportion of incorrect answers generated due to poisoning attacks\. We use GPT\-4o to determine whether the LLM’s responses are correct or influenced by poisoning, using prompts are provided in the Section[B\.2](https://arxiv.org/html/2607.00012#A2.SS2); \(3\) Provable Average Deviation \(PAD\) provides a certified upper bound on semantic shifts in the aggregated retrieval representation\. Lower PAD values indicate successful mitigation and preserved semantics, while higher values signal greater semantic corruption, making PAD a key metric for attack strength and robustness\.

![Refer to caption](https://arxiv.org/html/2607.00012v1/x2.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.00012v1/x3.png)\(b\)
![Refer to caption](https://arxiv.org/html/2607.00012v1/x4.png)\(c\)

Figure 2:Impact of Retrieval Passages, Corruption Size and Subset Size on PAD scores for Mistral\-7B\.
### 6\.2Overall Results

Main results of PRA\-RAG\.Table[1](https://arxiv.org/html/2607.00012#S5.T1)summarizes the performance of PRA\-RAG under various poisoning attacks across multiple datasets and LLMs\. The results demonstrate that PRA\-RAG consistently achieves low ASR while maintaining high ACC, indicating strong robustness across all settings\. For instance, on the MS\-MARCO dataset with Mistral\-7B, PRA\-RAG attains an ACC of 62% under PoisonedRAG, with an ASR as low as 1%\. Additionally, PAD effectively quantifies the semantic impact of adversarial retrievals, lower PAD values correspond to lower ASR and higher ACC, supporting its utility as a reliable indicator of both robustness and attack severity\. PRA\-RAG outperforms baselines\.Table[2](https://arxiv.org/html/2607.00012#S6.T2)presents a comparative evaluation of PRA\-RAG against several representative baselines under poisoning attacks and clean settings\. Across all datasets and attack settings, PRA\-RAG consistently achieves the best overall performance, attaining higher ACC while significantly lowering the ASR\. For instance, on the MSMARCO dataset with 20% poisoned retrievals, PRA\-RAG maintains an ACC of 68% and suppresses ASR to just 1% with Vicuna\-7B, outperforming RobustRAG and InstructRAG\. Meanwhile, we observe that in the absence of poisoning attacks, theACCclean\\text\{ACC\}\_\{\\text\{clean\}\}of our method remains largely unaffected\. These results demonstrate that PRA\-RAG not only offers stronger defense against poisoning attacks on retrieved texts but also preserves utility under normal conditions\. Overall, existing methods either lack formal certification, trade usability for safety \(over\-refusal or over\-filtering\), or incur high cost with tight coupling to the LLM\. PRA\-RAG models retrieval poisoning as a set perturbation and performs robust aggregation on*combination embeddings*by selecting a majority\-covering MEB center, yielding a certified PAD bound\. Under the common regime, it consistently lowers ASR with low overhead, maintains competitive ACC, and withstands semantically\-near poisoning\.

Table 2:Performance of PRA\-RAG and baselines under PoisonedRAG attacks \(ACC, ASR\) and clean settings \(ACCclean\\text\{ACC\}\_\{\\text\{clean\}\}\)\. Results are based on the same experimental setup here for consistency and may differ from the original reports \(Top\-K=8K=8, poisoning rate = 20%\)\. Best results are inbold\.
### 6\.3Ablation Study

Impact of retrieved passages Top\-KK, corruption sizeε\\varepsilonand subset sizenn\.The number of retrieved texts Top\-KKand poisoned textsε\\varepsilonsignificantly affect both attack effectiveness and defense performance\. Figure[2\(a\)](https://arxiv.org/html/2607.00012#S6.F2.sf1)illustrates the effect of varying the number of retrieved texts \(Top\-K=8,12,16K=8,12,16\) on the PAD score of PRA\-RAG, withε=1\\varepsilon=1fixed\. As Top\-KKincreases, the PAD score gradually declines, indicating enhanced robustness due to increased retrieval diversity\. Figure[2\(b\)](https://arxiv.org/html/2607.00012#S6.F2.sf2)presents the opposite setting: with the number of retrieved texts fixed at Top\-K=12K=12, the PAD score increases as the number of poisoned texts rises fromε=1\\varepsilon=1toε=3\\varepsilon=3\. This trend indicates that injecting more poisoned texts into the retrieval results strengthens the attack, thereby diminishing the robustness of PRA\-RAG\. Figure[2\(c\)](https://arxiv.org/html/2607.00012#S6.F2.sf3)illustrates the impact of different subset sizes on the performance of PRA\-RAG under the setting where the number of retrieved texts is Top\-K=12K=12and the number of poisoned texts isε=1\\varepsilon=1\. We evaluate cases where each combination contains 3, 4, or 5 texts\. The results show a clear downward trend in PAD scores as the number of texts per subset increases\. This indicates that incorporating more clean texts within each combination helps dilute the influence of poisoned content\. Comparison of aggregation strategies\.We compare two aggregation methods for the selected subset: a baseline that concatenates texts as input to the LLM \(PRA\-RAGcat\{\}\_\{\\text\{cat\}\}\), and our method \(PRA\-RAG\), which computes a weighted average of embeddings\. As shown in Table[2](https://arxiv.org/html/2607.00012#S6.T2), our approach achieves higher ACC and significantly reduces ASR by better mitigating the impact of poisoned texts\.

### 6\.4Efficiency

In real\-world applications, response time is critical to the user experience of RAG systems\. However, most existing defense strategies often incur varying levels of inference overhead\. In our experiments, we evaluated the average response latency over 100 query examples to compare different defense methods\. As shown in Table[3](https://arxiv.org/html/2607.00012#S6.T3), our proposed PRA\-RAG achieves the lowest inference latency, demonstrating its practical efficiency while preserving strong robustness\. In our framework, both the number of retrieved texts \(Top\-KK\) and the subset size have a significant impact on system efficiency\. Therefore, we conduct a more in\-depth analysis and empirical evaluation of the computational overhead in Section[C\.2](https://arxiv.org/html/2607.00012#A3.SS2)\.Additionally, Section[C\.3](https://arxiv.org/html/2607.00012#A3.SS3)presents the computational overhead and analysis under Monte Carlo sampling\.

Table 3:The table presents the average response latency of different RAG methods across datasets\.

## 7Conclusion

This paper presents PRA\-RAG, a provably robust aggregation method for defending against retrieval\-level poisoning attacks in RAG systems\. We theoretically derive an upper bound on the semantic deviation introduced by poisoned retrievals and propose Provable Average Deviation \(PAD\) as a unified metric for evaluating both robustness and attack strength\. Unlike traditional defenses that depend on model outputs, PRA\-RAG ensures semantic stability directly in the embedding space, providing a principled, model\-agnostic robustness guarantee\. Extensive experiments show that PRA\-RAG significantly enhances robustness against poisoning attacks across diverse datasets and language models, consistently lowering attack success rates while preserving high answer accuracy\.

Limitations\.

Our work has the following limitations:

- •This work selects the most robust subset of the retrieved texts as the final input to the LLM for answer generation\. Although the selected subset may not always produce the optimal response from the LLM, as shown in our experiments, the impact on model utility remains limited while significantly enhancing robustness against poisoning attacks\.
- •Our approach enhances robustness by constructing subsets, which increases computational and response\-time overhead\. However, experiments show that as the number and size of subsets grow, the defense against poisoning attacks significantly improves\. In practice, users can flexibly balance efficiency and security based on their needs\.
- •The effectiveness of our approach relies on the number of poisoned texts remaining below a certain threshold\. Although an attacker could potentially bypass the defense through large\-scale poisoning, this incurs substantial costs and significantly reduces the quality of the context, making it difficult for even humans to provide correct answers\.

Ethics Statement

The goal of this work is to defend against retrieval\-based poisoning attacks in RAG systems\. All data used in this study is publicly available, ensuring no additional privacy concerns\. The source code and software will be released as open\-source\. While this openness may expose the system to adaptive attacks, our approach can be further strengthened by incorporating additional internal and external information\.

Acknowledgment\.

Xue Tan, Yi Zheng, Chang Huo, Yunruo Zhang, Yu Liu, Hao Luan, Zhuyang Yu, and Ping Chen were funded in part by the National Key R&D Program of China 2023YFB3107404\.

## References

- Achiam et al\. \(2023\)Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others\. 2023\.Gpt\-4 technical report\.*arXiv preprint arXiv:2303\.08774*\.
- Asai et al\. \(2024\)Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi\. 2024\.Self\-rag: Learning to retrieve, generate, and critique through self\-reflection\.
- Baek et al\. \(2023\)Jinheon Baek, Soyeong Jeong, Minki Kang, Jong C Park, and Sung Hwang\. 2023\.Knowledge\-augmented language model verification\.In*Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, pages 1720–1736\.
- Bajaj et al\. \(2016\)Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, and 1 others\. 2016\.Ms marco: A human generated machine reading comprehension dataset\.*arXiv preprint arXiv:1611\.09268*\.
- BBC \(2024\)BBC\. 2024\.Glue pizza and eat rocks: Google ai search errors go viral\.[https://www\.bbc\.co\.uk/news/articles/cd11gzejgz4o](https://www.bbc.co.uk/news/articles/cd11gzejgz4o)\.
- Brown et al\. \(2020\)Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others\. 2020\.Language models are few\-shot learners\.*Advances in neural information processing systems*, 33:1877–1901\.
- Cheng et al\. \(2025\)Zirui Cheng, Jikai Sun, Anjun Gao, Yueyang Quan, Zhuqing Liu, Xiaohua Hu, and Minghong Fang\. 2025\.Secure retrieval\-augmented generation against poisoning attacks\.*arXiv preprint arXiv:2510\.25025*\.
- Chiang et al\. \(2023\)Wei\-Lin Chiang, Zhuohan Li, Ziqing Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, and 1 others\. 2023\.Vicuna: An open\-source chatbot impressing gpt\-4 with 90%\* chatgpt quality\.*See https://vicuna\. lmsys\. org \(accessed 14 April 2023\)*, 2\(3\):6\.
- Cho et al\. \(2023\)Sukmin Cho, Jeongyeon Seo, Soyeong Jeong, and Jong C Park\. 2023\.Improving zero\-shot reader by reducing distractions from irrelevant documents in open\-domain question answering\.In*Findings of the Association for Computational Linguistics: EMNLP 2023*, pages 3145–3157\.
- Google \(2024\)Google\. 2024\.Generative ai in search: Let google do the searching for you\.[https://blog\.google/products/search/generative\-ai\-google\-search\-may\-2024/](https://blog.google/products/search/generative-ai-google-search-may-2024/)\.
- Greshake et al\. \(2023\)Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz\. 2023\.Not what you’ve signed up for: Compromising real\-world llm\-integrated applications with indirect prompt injection\.In*Proceedings of the 16th ACM workshop on artificial intelligence and security*, pages 79–90\.
- Hoeffding \(1963\)Wassily Hoeffding\. 1963\.Probability inequalities for sums of bounded random variables\.*Journal of the American statistical association*, 58\(301\):13–30\.
- Izacard et al\. \(2021\)Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave\. 2021\.Unsupervised dense information retrieval with contrastive learning\.*arXiv preprint arXiv:2112\.09118*\.
- Jiang et al\. \(2023\)Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, and 1 others\. 2023\.Mistral 7b\.*arXiv preprint arXiv:2310\.06825*\.
- Jiao et al\. \(2024\)Ruochen Jiao, Shaoyuan Xie, Justin Yue, Takami Sato, Lixu Wang, Yixuan Wang, Qi Alfred Chen, and Qi Zhu\. 2024\.Exploring backdoor attacks against large language model\-based decision making\.*arXiv preprint arXiv:2405\.20774*\.
- Jiao et al\. \(2025\)Yang Jiao, Xiaodong Wang, and Kai Yang\. 2025\.Pr\-attack: Coordinated prompt\-rag attacks on retrieval\-augmented generation in large language models via bilevel optimization\.*arXiv preprint arXiv:2504\.07717*\.
- Kenton and Toutanova \(2019\)Jacob Devlin Ming\-Wei Chang Kenton and Lee Kristina Toutanova\. 2019\.Bert: Pre\-training of deep bidirectional transformers for language understanding\.In*Proceedings of naacL\-HLT*, volume 1, page 2\. Minneapolis, Minnesota\.
- Kumar and Goldstein \(2021\)Aounon Kumar and Tom Goldstein\. 2021\.Center smoothing: Certified robustness for networks with structured outputs\.*Advances in Neural Information Processing Systems*, 34:5560–5575\.
- Kwiatkowski et al\. \(2019\)Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, and 1 others\. 2019\.Natural questions: a benchmark for question answering research\.*Transactions of the Association for Computational Linguistics*, 7:453–466\.
- Lewis et al\. \(2020\)Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen\-tau Yih, Tim Rocktäschel, and 1 others\. 2020\.Retrieval\-augmented generation for knowledge\-intensive nlp tasks\.*Advances in Neural Information Processing Systems*, 33:9459–9474\.
- Microsoft \(2024\)Microsoft\. 2024\.Bing chat\.[https://www\.microsoft\.com/en\-us/edge/features/bing\-chat](https://www.microsoft.com/en-us/edge/features/bing-chat)\.
- Press et al\. \(2023\)Ofir Press, Muru Zhang, Sewon Min, Ludwig Schmidt, Noah A Smith, and Mike Lewis\. 2023\.Measuring and narrowing the compositionality gap in language models\.In*Findings of the Association for Computational Linguistics: EMNLP 2023*, pages 5687–5711\.
- rocky \(2024\)rocky\. 2024\.A retrieval corruption attack\.[https://x\.com/r\_cky0/status/1859656430888026524?s=46&t=p9\-0aPCrd\_0h9\-yuSXpN8g](https://x.com/r_cky0/status/1859656430888026524?s=46&t=p9-0aPCrd_0h9-yuSXpN8g)\.
- Shafran et al\. \(2024\)Avital Shafran, Roei Schuster, and Vitaly Shmatikov\. 2024\.Machine against the rag: Jamming retrieval\-augmented generation with blocker documents\.*arXiv preprint arXiv:2406\.05870*\.
- Tan et al\. \(2024\)Zhen Tan, Chengshuai Zhao, Raha Moraffah, Yifan Li, Song Wang, Jundong Li, Tianlong Chen, and Huan Liu\. 2024\.Glue pizza and eat rocks\-exploiting vulnerabilities in retrieval\-augmented generative models\.In*Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing*, pages 1610–1626\.
- Thakur et al\. \(2021\)Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych\. 2021\.Beir: A heterogenous benchmark for zero\-shot evaluation of information retrieval models\.*arXiv preprint arXiv:2104\.08663*\.
- Wang et al\. \(2025\)Fei Wang, Xingchen Wan, Ruoxi Sun, Jiefeng Chen, and Sercan Ö\. Arık\. 2025\.[Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models](https://arxiv.org/abs/2410.07176)\.*Preprint*, arXiv:2410\.07176\.
- Wei et al\. \(2024\)Zhepei Wei, Wei\-Lin Chen, and Yu Meng\. 2024\.Instructrag: Instructing retrieval\-augmented generation with explicit denoising\.*arXiv e\-prints*, pages arXiv–2406\.
- Xiang et al\. \(2024\)Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal\. 2024\.Certifiably robust rag against retrieval corruption\.*arXiv preprint arXiv:2405\.15556*\.
- Xiong et al\. \(2020\)Lee Xiong, Chenyan Xiong, Ye Li, Kwok\-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk\. 2020\.Approximate nearest neighbor negative contrastive learning for dense text retrieval\.*arXiv preprint arXiv:2007\.00808*\.
- Xue et al\. \(2024\)Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou\. 2024\.Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models\.*arXiv preprint arXiv:2406\.00083*\.
- Yang et al\. \(2025\)An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others\. 2025\.Qwen3 technical report\.*arXiv preprint arXiv:2505\.09388*\.
- Yang et al\. \(2018\)Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D Manning\. 2018\.Hotpotqa: A dataset for diverse, explainable multi\-hop question answering\.In*Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing*, pages 2369–2380\.
- Yoran et al\. \(2023\)Ori Yoran, Tomer Wolfson, Ori Ram, and Jonathan Berant\. 2023\.Making retrieval\-augmented language models robust to irrelevant context\.*arXiv preprint arXiv:2310\.01558*\.
- Zhang et al\. \(2025a\)Baolei Zhang, Yuxi Chen, Minghong Fang, Zhuqing Liu, Lihai Nie, Tong Li, and Zheli Liu\. 2025a\.Practical poisoning attacks against retrieval\-augmented generation\.*arXiv preprint arXiv:2504\.03957*\.
- Zhang et al\. \(2025b\)Baolei Zhang, Haoran Xin, Minghong Fang, Zhuqing Liu, Biao Yi, Tong Li, and Zheli Liu\. 2025b\.Traceback of poisoning attacks to retrieval\-augmented generation\.In*Proceedings of the ACM on Web Conference 2025*, pages 2085–2097\.
- Zhang et al\. \(2025c\)Collin Zhang, Tingwei Zhang, and Vitaly Shmatikov\. 2025c\.[Adversarial decoding: Generating readable documents for adversarial objectives](https://arxiv.org/abs/2410.02163)\.*Preprint*, arXiv:2410\.02163\.
- Zhou et al\. \(2025\)Huichi Zhou, Kin\-Hei Lee, Zhonghao Zhan, Yue Chen, Zhenhao Li, Zhaoyang Wang, Hamed Haddadi, and Emine Yilmaz\. 2025\.Trustrag: Enhancing robustness and trustworthiness in retrieval\-augmented generation\.*arXiv preprint arXiv:2501\.00879*\.
- Zou et al\. \(2024\)Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia\. 2024\.Poisonedrag: Knowledge corruption attacks to retrieval\-augmented generation of large language models\.*arXiv preprint arXiv:2402\.07867*\.

## Appendix ATheoretical Analysis and Proofs

### A\.1Proof of Theorem 1

Consider two ballsℬ​\(ℱ​\(𝒳′\),r∗​\(𝒳′\)\)\\mathcal\{B\}\(\\mathcal\{F\}\(\\mathcal\{X^\{\\prime\}\}\),r^\{\*\}\(\\mathcal\{X^\{\\prime\}\}\)\)andℬ​\(ℱ​\(𝒳\),R\)\\mathcal\{B\}\(\\mathcal\{F\}\(\\mathcal\{X\}\),R\)\. According to the definitions ofRRandr∗​\(𝒳′\)r^\{\*\}\(\\mathcal\{X^\{\\prime\}\}\), these two balls must share at least one common element, denoted asw∗w^\{\*\}\. Since the defined distance based on vector angles satisfies the triangle inequality, we have:

d​\(ℱ​\(𝒳\),ℱ​\(𝒳′\)\)\\displaystyle d\(\\mathcal\{F\}\(\\mathcal\{X\}\),\\mathcal\{F\}\(\\mathcal\{X^\{\\prime\}\}\)\)≤d​\(ℱ​\(𝒳\),w∗\)\+d​\(ℱ​\(𝒳′\),w∗\)\\displaystyle\\leq d\(\\mathcal\{F\}\(\\mathcal\{X\}\),w^\{\*\}\)\+d\(\\mathcal\{F\}\(\\mathcal\{X^\{\\prime\}\}\),w^\{\*\}\)\(11\)≤R\+r∗​\(𝒳′\)\.\\displaystyle\\leq R\+r^\{\*\}\(\\mathcal\{X^\{\\prime\}\}\)\.Since the ballℬ​\(ℱ​\(𝒳\),R\)\\mathcal\{B\}\(\\mathcal\{F\}\(\\mathcal\{X\}\),R\)contains at least a majority of elements in𝒱𝒳′,n\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}, the smallest radiusr∗​\(𝒳′\)r^\{\*\}\(\\mathcal\{X^\{\\prime\}\}\)of a ball that contains a majority of elements in𝒱𝒳′,n\\mathcal\{V\}\_\{\\mathcal\{X^\{\\prime\}\},n\}must not be greater thanRR, i\.e\.,r∗​\(𝒳′\)≤Rr^\{\*\}\(\\mathcal\{X^\{\\prime\}\}\)\\leq R\. Therefore,

d​\(ℱ​\(𝒳\),ℱ​\(𝒳′\)\)≤2​R\.d\(\\mathcal\{F\}\(\\mathcal\{X\}\),\\mathcal\{F\}\(\\mathcal\{X^\{\\prime\}\}\)\)\\leq 2R\.\(12\)

### A\.2Proof of Theorem 2

Since the radius of theβ\\beta\-MEB differs from the optimal radius by a factorβ\\beta, i\.e\., the radius of theβ\\beta\-MEB over𝒱𝒳,n\\mathcal\{V\}\_\{\\mathcal\{X\},n\}isβ​r∗​\(𝒳′\)\\beta r^\{\*\}\(\\mathcal\{X\}^\{\\prime\}\), by the same reasoning as in Theorem 1, we have:

d​\(ℱ^​\(𝒳\),ℱ^​\(𝒳′\)\)\\displaystyle d\(\\widehat\{\\mathcal\{F\}\}\(\\mathcal\{X\}\),\\widehat\{\\mathcal\{F\}\}\(\\mathcal\{X\}^\{\\prime\}\)\)≤d​\(ℱ^​\(𝒳\),w∗\)\+d​\(ℱ^​\(𝒳′\),w∗\)\\displaystyle\\leq d\(\\widehat\{\\mathcal\{F\}\}\(\\mathcal\{X\}\),w^\{\*\}\)\+d\(\\widehat\{\\mathcal\{F\}\}\(\\mathcal\{X\}^\{\\prime\}\),w^\{\*\}\)\(13\)≤R^\+β​r∗​\(𝒳′\)≤\(1\+β\)​R^\.\\displaystyle\\leq\\widehat\{R\}\+\\beta r^\{\*\}\(\\mathcal\{X\}^\{\\prime\}\)\\leq\(1\+\\beta\)\\widehat\{R\}\.

### A\.3Scalability and Approximation via Monte\-Carlo Sampling

While the theoretical formulation in Section[5](https://arxiv.org/html/2607.00012#S5)relies on the full set ofL=\(Kn\)L=\\binom\{K\}\{n\}combinations, the computational cost grows combinatorially asKKandnnincrease\. To address this bottleneck, we introduce a Monte\-Carlo sampling strategy: instead of enumerating allLLcombinations, we uniformly samplem≪Lm\\ll Lsubsets to estimate the robust aggregation\. Below, we establish a strict theoretical lower bound on the sampling approximation and provide an empirically supported upper bound, demonstrating how this strategy effectively approximates the optimal robustness radius\.

###### Proposition 1\.

Lower Bound of Monte\-Carlo Approximation\.Let𝒱𝒳,n\\mathcal\{V\}\_\{\\mathcal\{X\},n\}be the full set of embedding vectors generated from\(Kn\)\\binom\{K\}\{n\}combinations, and letRRbe the radius of the Minimum Enclosing Ball \(MEB\) covering the majority \(\>50%\>50\\%\) of𝒱𝒳,n\\mathcal\{V\}\_\{\\mathcal\{X\},n\}\. Let𝒮⊂𝒱𝒳,n\\mathcal\{S\}\\subset\\mathcal\{V\}\_\{\\mathcal\{X\},n\}be a uniformly random sample of sizemm, and letR∗R^\{\*\}be the radius of the MEB covering the majority of𝒮\\mathcal\{S\}\. For anyτ∈\(0,0\.5\)\\tau\\in\(0,\\,0\.5\)and failure probabilityη\>0\\eta\>0, if the sample size satisfiesm≥12​τ2​ln⁡2ηm\\geq\\frac\{1\}\{2\\tau^\{2\}\}\\ln\\frac\{2\}\{\\eta\}and the majority coverage fractionq\>0\.5\+τq\>0\.5\+\\tau, then with probability at least1−η1\-\\eta:

###### Proof\.

Proof of Lower Bound\.For any fixed ballℬ\\mathcal\{B\}in the embedding space, letqqdenote the fraction of𝒱𝒳,n\\mathcal\{V\}\_\{\\mathcal\{X\},n\}withinℬ\\mathcal\{B\}, andq^\\hat\{q\}the fraction in𝒮\\mathcal\{S\}\. By Hoeffding’s InequalityHoeffding \([1963](https://arxiv.org/html/2607.00012#bib.bib12)\):

ℙ​\(\|q^−q\|≥τ\)≤2​exp⁡\(−2​m​τ2\)\.\\mathbb\{P\}\(\|\\hat\{q\}\-q\|\\geq\\tau\)\\leq 2\\exp\(\-2m\\tau^\{2\}\)\.\(15\)Under the conditionm≥12​τ2​ln⁡2ηm\\geq\\frac\{1\}\{2\\tau^\{2\}\}\\ln\\frac\{2\}\{\\eta\}, we have2​exp⁡\(−2​m​τ2\)≤η2\\exp\(\-2m\\tau^\{2\}\)\\leq\\eta\. For instance, withm=200m=200andτ=0\.1\\tau=0\.1, the failure probability is below0\.040\.04\.

Lower Bound Derivation\.Letℬ∗\\mathcal\{B\}^\{\*\}be the optimal ball with radiusRRcovering a fractionq\>0\.5\+τq\>0\.5\+\\tauof𝒱𝒳,n\\mathcal\{V\}\_\{\\mathcal\{X\},n\}\. By the coverage concentration above,ℬ∗\\mathcal\{B\}^\{\*\}covers a fraction at leastq−τ\>0\.5q\-\\tau\>0\.5of𝒮\\mathcal\{S\}with high probability\. ThusRRis a feasible majority\-covering radius for𝒮\\mathcal\{S\}\. SinceR∗R^\{\*\}is the minimum such radius over𝒮\\mathcal\{S\}:

∎

Combining the strict lower bound with the empirically validated tightness, Monte\-Carlo sampling withm≈200m\\approx 200yields an effective approximation of the true robustness metric, decoupling the computational complexity from the combinatorial growth of\(Kn\)\\binom\{K\}\{n\}and reducing it to a constant factor determined by the sample sizemm\.

### A\.4Guarantee of Clean Majority in the Certified Ball

Lemma 1\.Let𝒱\\mathcal\{V\}be the set of allL=\(Kn\)L=\\binom\{K\}\{n\}subset embeddings derived from the retrieved documents\. Let𝒞⊂𝒱\\mathcal\{C\}\\subset\\mathcal\{V\}denote the set of clean embeddings and𝒫⊂𝒱\\mathcal\{P\}\\subset\\mathcal\{V\}denote the set of poisoned embeddings, such that\|𝒫\|≤La​d​v=\(Kn\)−\(K−εn\)\|\\mathcal\{P\}\|\\leq L\_\{adv\}=\\binom\{K\}\{n\}\-\\binom\{K\-\\varepsilon\}\{n\}\. If the certified radiusR^\\hat\{R\}is determined by the distance value at thekk\-th index \(0\-based\) of the sorted distance vector to the geometric center, withk=⌊L/2⌋\+La​d​vk=\\lfloor L/2\\rfloor\+L\_\{adv\}, then the ballℬ​\(z,R^\)\\mathcal\{B\}\(z,\\hat\{R\}\)is guaranteed to strictly contain a majority of clean embeddings, i\.e\.,\|ℬ​\(z,R^\)∩𝒞\|≥⌊L/2⌋\+1\|\\mathcal\{B\}\(z,\\hat\{R\}\)\\cap\\mathcal\{C\}\|\\geq\\lfloor L/2\\rfloor\+1\. Proof\.Let𝒮\\mathcal\{S\}denote the set of embeddings enclosed by the ballℬ​\(z,R^\)\\mathcal\{B\}\(z,\\hat\{R\}\)\. Since the radiusR^\\hat\{R\}corresponds to the distance at thekk\-th index \(where index 0 represents the center itself\), the set𝒮\\mathcal\{S\}includes the firstk\+1k\+1smallest distance embeddings\. Thus, by definition,\|𝒮\|=k\+1\|\\mathcal\{S\}\|=k\+1\. The set𝒮\\mathcal\{S\}is composed of disjoint clean and poisoned subsets:𝒮=\(𝒮∩𝒞\)∪\(𝒮∩𝒫\)\\mathcal\{S\}=\(\\mathcal\{S\}\\cap\\mathcal\{C\}\)\\cup\(\\mathcal\{S\}\\cap\\mathcal\{P\}\)\. We seek a lower bound on the number of clean samples\|𝒮∩𝒞\|\|\\mathcal\{S\}\\cap\\mathcal\{C\}\|\. According to set theory:

\|𝒮∩𝒞\|=\|𝒮\|−\|𝒮∩𝒫\|\|\\mathcal\{S\}\\cap\\mathcal\{C\}\|=\|\\mathcal\{S\}\|\-\|\\mathcal\{S\}\\cap\\mathcal\{P\}\|\(17\)In the worst\-case adversarial scenario, the adversary optimizes the poisoned embeddings to be geometrically closest to the center to occupy the top ranks\. However, the total number of poisoned embeddings is strictly bounded byLa​d​vL\_\{adv\}\. Thus, for any selected subset,\|𝒮∩𝒫\|≤La​d​v\|\\mathcal\{S\}\\cap\\mathcal\{P\}\|\\leq L\_\{adv\}always holds\. Substituting the cardinality\|𝒮\|=k\+1\|\\mathcal\{S\}\|=k\+1and the value ofkk:

\|𝒮∩𝒞\|\\displaystyle\|\\mathcal\{S\}\\cap\\mathcal\{C\}\|≥\(k\+1\)−La​d​v\\displaystyle\\geq\(k\+1\)\-L\_\{adv\}=\(⌊L/2⌋\+La​d​v\+1\)−La​d​v\\displaystyle=\(\\lfloor L/2\\rfloor\+L\_\{adv\}\+1\)\-L\_\{adv\}=⌊L/2⌋\+1\\displaystyle=\\lfloor L/2\\rfloor\+1\(18\)Therefore, the ballℬ​\(z,R^\)\\mathcal\{B\}\(z,\\hat\{R\}\)necessarily contains at least⌊L/2⌋\+1\\lfloor L/2\\rfloor\+1clean embeddings\. SinceL=\|𝒱\|L=\|\\mathcal\{V\}\|, this count represents a strict majority of the total universe of combinations\.

### A\.5Geometric Separability Assumption

We assume a mild geometric separability condition to connect majority coverage over combination embeddings to clean subset selection\. Specifically, there exists a centerz∗z^\{\*\}and a radiusRcR\_\{c\}such that a strict majority of fully clean combination embeddings lie within the ballℬ​\(z∗,Rc\)\\mathcal\{B\}\(z^\{\*\},R\_\{c\}\), while any combination containing at least one poisoned passage lies outsideℬ​\(z∗,Rc\+Δ\)\\mathcal\{B\}\(z^\{\*\},R\_\{c\}\+\\Delta\)for someΔ\>0\\Delta\>0\.

The separability condition is necessary to ensure that a ball containing a strict majority of clean embeddings is geometrically anchored to the clean subset, thereby enabling the selection of clean contexts through geometric aggregation\. When the marginΔ=0\\Delta=0, clean and poisoned combination embeddings become geometrically indistinguishable\. In such cases, no geometry\-based majority certification method can guarantee the selection of a fully clean subset, as the observed information no longer provides distinguishable features\.

## Appendix BDetails

### B\.1Details of Experiment Setup

Dataset\.Detailed statistics are shown in Table[4](https://arxiv.org/html/2607.00012#A2.T4)\.

Table 4:Statistics of datasets\.Default Setting\.Unless otherwise specified, our experiments use the following default settings: the ContrieverIzacard et al\. \([2021](https://arxiv.org/html/2607.00012#bib.bib13)\)retriever is employed to select the Top\-K=8K=8texts most similar to the query from the MS\-MARCO dataset, with poisoned texts generated according to the PoisonedRAGZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\)method constituting 20% \(rounded down\) of the retrieval results\. Subsequently, multiple subsets are sampled from the retrieved texts, each containingn=3n=3texts\. Open\-source LLMs can directly obtain embeddings through their embedding layers and generate the final robust aggregated representation\. For black\-box models \(e\.g\., GPT\-3\.5\-turbo and GPT\-5\-mini\), we use Llama3\-8B in our experiments to extract embeddings and decode the robust aggregation results into text to serve as context\. Finally, the Mistral\-7B language model generates responses based on these retrieved texts\. Each result is averaged over 10 runs under a consistent setup\. Implementation and Resources\.We conduct experiments on a server with 64 AMD EPYC 9654 CPUs at 2\.40–3\.70 GHz, 512 GB of DDR5 RAM, and four NVIDIA RTX A100 GPUs, each with 80 GB HBM2e memory\.

### B\.2Prompt

![Refer to caption](https://arxiv.org/html/2607.00012v1/x5.png)Figure 3:The prompt used in RAG to make an LLM generate an answer based on the retrieved texts\.![Refer to caption](https://arxiv.org/html/2607.00012v1/x6.png)Figure 4:The prompt used in RAG to determine whether the LLM’s response is correct or corresponds to the attacker’s target response\.
### B\.3Poisoned Texts Generation

To comprehensively evaluate the robustness of our approach against different poisoned text generation strategies, we adopt three representative strategies, including PoisonedRAGZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\), Adversarial DecodingZhang et al\. \([2025c](https://arxiv.org/html/2607.00012#bib.bib37)\), Denial\-Of\-Service AttackShafran et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib24)\),and CorruptRAGZhang et al\. \([2025a](https://arxiv.org/html/2607.00012#bib.bib35)\)\. In PoisonedRAGZou et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib39)\)method, the attacker begins by selecting a target question and its corresponding incorrect answer, then crafts poisoned texts to satisfy two key requirements: \(1\) being retrievable by the retriever and \(2\) successfully misleading the language model into producing the incorrect answer\. Adversarial DecodingZhang et al\. \([2025c](https://arxiv.org/html/2607.00012#bib.bib37)\)is a token\-level beam search framework that integrates continuous, task\-specific scorers into standard decoding, enabling the generation of fluent, low\-detectability texts that jointly optimize retrieval similarity and adversarial generation objectives\. Denial\-Of\-Service AttackShafran et al\. \([2024](https://arxiv.org/html/2607.00012#bib.bib24)\)inserts a single blocker document consisting of a retrieval component to ensure retrieval and a jamming component to trigger refusal responses, crafted through instruction injection, oracle generation, or black\-box optimization\.CorruptRAGZhang et al\. \([2025a](https://arxiv.org/html/2607.00012#bib.bib35)\)can efficiently mislead the model into generating targeted false content by injecting only a single poisoned text that simultaneously includes the target query, which ensures it is preferentially retrieved, and an adversarial prompting template, which exploits the LLM’s generation bias to label the correct answer as outdated and to fabricate a supposedly latest but incorrect answer\.In our experiments, we adopt the default parameters of these methods to generate the corresponding poisoned texts, ensuring effective poisoning\.

![Refer to caption](https://arxiv.org/html/2607.00012v1/x7.png)\(a\)
![Refer to caption](https://arxiv.org/html/2607.00012v1/x8.png)\(b\)

Figure 5:Embedding Distribution of Retrieved Text Combinations \(Red: With Poisoned Texts; Blue: Without Poisoned Texts\)

## Appendix CAdditional Experimental Results

### C\.1Distribution of Different Combinations

Figure[5](https://arxiv.org/html/2607.00012#A2.F5)illustrates the distributional differences between combinations containing poisoned texts and clean combinations\. It is evident that the poisoned texts, intentionally crafted to induce attacker\-desired responses, exhibit a significant shift in their embedding vectors compared to clean texts\.

Table 5:Computational overhead of PRA\-RAG under different Top\-KKretrieval settings, with subset size fixed at 3 and a poisoning rate of 20%\.Table 6:Computational overhead of PRA\-RAG with Top\-K=12K=12retrieval under a poisoning rate of 10%, evaluated across different subset sizes\.
### C\.2Analysis of Computational Overhead

Table[5](https://arxiv.org/html/2607.00012#A3.T5)compares the computational overhead under different numbers of retrieved texts, with the subset sizen=3n=3\. The results show that as Top\-KKincreases, the number of combinations grows rapidly, leading to a near\-linear increase in computation time\. Specifically, when Top\-KKis set to 8, 12, and 16, the average generation times are 5\.98 s, 18\.47 s, and 68\.05 s, respectively\. Table[6](https://arxiv.org/html/2607.00012#A3.T6)compares the computational overhead under a fixed Top\-KKretrieval size of 12 with varying subset sizes\. The results show that the computation time no longer correlates linearly with the number of combinations, as changes in subset size also affect the overall time required for the final RAG response generation\. Both the number of retrieved texts \(Top\-KK\) and the subset size \(nn\) have a significant impact on the response time of our approach\. Nevertheless, as shown in Table[3](https://arxiv.org/html/2607.00012#S6.T3), our method still outperforms existing baselines in terms of efficiency under certain settings \(e\.g\., Top\-K=8K=8,n=3n=3\), which represent typical real\-world scenarios\. Although increasing Top\-KKandnnleads to higher computational overhead, it also enhances system security\. As shown in Figure[2](https://arxiv.org/html/2607.00012#S6.F2), the PAD value decreases as Top\-KKandnnincrease, indicating higher security\. Overall, users can flexibly balance efficiency and security by selecting appropriate values of Top\-KKandnnbased on practical needs\.

Table 7:Performance of PRA\-RAG using Monte Carlo sampling under varying Top\-KK\(subset size = 3, poisoning rate = 10%\)\.Table 8:Performance of PRA\-RAG using Monte Carlo sampling with Top\-K=12K=12retrieval under a poisoning rate of 10%, evaluated across different subset sizes\.Table 9:Performance of PRA\-RAG using Monte Carlo sampling with Top\-K=20K=20retrieval under a poisoning rate of 20%, evaluated across different sampling numbers and subset sizes under Mistral\-7B\.
### C\.3Evaluation of the Impact of Monte Carlo Sampling

As the number of retrieved documents \(Top\-KK\) and the subset size \(nn\) increase, the number of candidate combinations grows rapidly, incurring significant computational overhead\. To reduce costs and enhance the practicality of our method, we introduce Monte Carlo sampling when the combination size reaches a certain level\. Based on the analysis in Section[A\.3](https://arxiv.org/html/2607.00012#A1.SS3), we set the sampling count tom=200m=200, which also serves as the threshold for triggering the sampling process\. Specifically, when the number of candidate combinations does not exceedmm, we employ the original full enumeration strategy; when the number exceedsmm, we utilize Monte Carlo sampling to approximate the combinatorial space\. This strategy effectively controls computational overhead while minimizing the impact on performance\.

Table 10:Computational overhead of PRA\-RAG using Monte Carlo sampling under varying Top\-KK\(subset sizen=3n=3, poisoning rate = 20%\)\.Table 11:Computational overhead of PRA\-RAG using Monte Carlo sampling with Top\-K=12K=12under a poisoning rate of 10%\.Tables[7](https://arxiv.org/html/2607.00012#A3.T7)and[8](https://arxiv.org/html/2607.00012#A3.T8)present the performance of our method using Monte Carlo sampling approximation across various settings of retrieved document counts \(Top\-KK\) and subset sizes \(nn\), specifically when the number of candidate combinations exceeds the threshold \(m=200m=200\)\. By comparing these results with those obtained via full enumeration in Figure[2](https://arxiv.org/html/2607.00012#S6.F2), it is evident that the introduction of Monte Carlo sampling causes no significant degradation in performance\. Furthermore, the overall trends remain consistent, indicating that the impact of poisoned texts is further attenuated as Top\-KKandnnincrease, while PAD exhibits a continuous downward trend\. To further strengthen this finding, we additionally conduct experiments withK=20K=20and subset sizesn∈3,4,5n\\in\{3,4,5\}under sampling countsm∈200,400,600m\\in\{200,400,600\}\. The results, reported in Table[9](https://arxiv.org/html/2607.00012#A3.T9), further confirm that the approximation quality remains stable asKKandnnscale\.

Tables[10](https://arxiv.org/html/2607.00012#A3.T10)and[11](https://arxiv.org/html/2607.00012#A3.T11)present the computational overhead of the algorithm with Monte Carlo sampling under different Top\-KKandnnsettings\. In Table[10](https://arxiv.org/html/2607.00012#A3.T10), with Top\-K=8K=8andn=3n=3, the number of candidate combinations is 56, which remains below the threshold \(m=200m=200\), implying that sampling is not triggered and the computational cost remains consistent with the results in Table[5](https://arxiv.org/html/2607.00012#A3.T5)\. In other scenarios, compared to the full enumeration results in Tables[5](https://arxiv.org/html/2607.00012#A3.T5)and[6](https://arxiv.org/html/2607.00012#A3.T6), the sampling strategy significantly reduces computational overhead\. For instance, on the Vicuna\-7B model using the NQ dataset, the cost drops from 64\.93s to 9\.23s when Top\-K=16K=16andn=3n=3, and from 116\.09s to 7\.17s when Top\-K=12K=12andn=5n=5\.