RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems

KrishnaSaiReddy Patil

cs.CRApr 1, 2026

RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems

Authors: KrishnaSaiReddy Patil

Abstract

Retrieval-Augmented Generation (RAG) systems are deployed across federal agencies for citizen-facing tax guidance, benefits eligibility, and legal information, where a single incorrect number causes direct financial harm. This paper proves that all embedding-based RAG defenses share a fundamental blind spot: changing a tax deduction by $50,000 produces cosine similarity 0.9998, invisible to every known detection threshold. Across 174 manipulation pairs and two embedding models, the mean sensitivity gap is 1,459x. The blind spot is confirmed on real IRS documents.The root cause is that embeddings encode topic, not numerical precision. RAGShield sidesteps this by operating on extracted values directly: a pattern-based engine identifies dollar amounts and percentages in government text, links each value to its governing entity through two-pass context propagation (99.8% entity detection on 2,742 real IRS passages), and verifies every claim against a cross-source registry built from the corpus itself. A temporal tracker flags value changes that fall outside known government update schedules. On 430 attacks generated from real IRS document content, RAGShield detects every one (0.0% ASR, 95% CI [0%, 1%]) while embedding-based defenses miss 79-90% of the same attacks.

Figures & tables

Attack	Venue	Key Result	Vector
PoisonedRAG [ 2 ]	USENIX’25	5 texts $\rightarrow$ 90% ASR	Injection
Phantom [ 1 ]	NeurIPS’24	98.2% retrieval	Injection
CPA-RAG [ 8 ]	arXiv’25	Black-box, fluent	Injection
CorruptRAG [ 9 ]	arXiv’25	Single-doc attack	Injection
PhantomText [ 10 ]	arXiv’25	74.4% via hidden text	Loader
This paper	—	Numerical manip.	Insider

TABLE I : RAG Poisoning Attack Landscape

	Embed-Level	Claim-Level	Temporal	Insider Det.
RobustRAG [ 3 ]	✓	✗	✗	✗
TrustRAG [ 5 ]	✓	✗	✗	✗
RAGPart [ 6 ]	✓	✗	✗	✗
RAGDefender [ 4 ]	✓	✗	✗	✗
RAGForensics [ 7 ]	✓	✗	✗	Partial
RAGShield	✓	✓	✓	✓

TABLE II : RAG Defense Comparison

Metric	MiniLM	BGE
Manipulation pairs tested	174	174
Mean cosine similarity	0.9989	0.9979
Max embedding perturbation	0.0229	0.0243
Mean sensitivity gap	1,459 $\times$	911 $\times$
Max numerical change	$50,000	$50,000
Detected at $\delta=0.08$	0/174	0/174

TABLE III : Embedding Blind Spot: Aggregate Results

$\Delta v$ Range	Count	Mean CosSim	Mean Perturb	Max Perturb
$<1\%$	54	0.9989	0.0011	0.0042
$1$ – $5\%$	31	0.9983	0.0017	0.0229
$5$ – $10\%$	15	0.9990	0.0010	0.0025
$10$ – $50\%$	34	0.9990	0.0010	0.0073
$50$ – $100\%$	14	0.9993	0.0007	0.0020
$>100\%$	26	0.9989	0.0011	0.0083

TABLE IV : Sensitivity Gap by Numerical Change Magnitude (MiniLM)

Panel of Figure 5 — Fig. 1 : RAGShield architecture. The provenance layer (blue) blocks external injection. The claim-level layers (green/yellow) detect numerical manipulation that embedding-based defenses miss.

Component	Library	Notes
Claim extraction	regex + two-pass NER	120 entity, 16 attribute patterns
Claim registry	SQLite	Indexed by claim key
Temporal tracking	datetime + calendar	4 agency schedules
Embeddings	sentence-transformers	all-MiniLM-L6-v2 (384-dim)
Provenance	PyNaCl (Ed25519)	Real signatures, not HMAC
Vector search	NumPy	Cosine similarity

TABLE V : Implementation Components

Configuration	Patterns	Detection	Unknown
Base patterns, single-pass	45	40.5%	1,312
+ Filing/IRA/SS/adoption patterns	75	85.4%	323
+ Worksheet/railroad/misc patterns	100	87.1%	285
+ Two-pass resolution (fwd+bwd)	100	98.5%	34
+ Final catch-all patterns	120	99.8%	5

TABLE VI : Entity Detection Rate Progression on Real IRS Corpus (2,205 claims)

Defense	T3-H	T6	T-TEMP	Overall
No Defense	100	100	100	100 [99,100]
Embed-only	81.8	81.4	81.4	81.6 [79,83]
RAGShield	0.0	0.0	0.0	0.0 [0,1]

TABLE VII : Attack Success Rate (%) on Real IRS Corpus (2,742 passages, 430 attacks). Lower is better. 95% Wilson CIs in brackets.

Defense	Unblocked	Total Harm	Mean/Attack
No Defense	430	$243,309	$566
Embed-only	351	$213,739	$609
RAGShield	0	$0	$0

TABLE VIII : Citizen Financial Harm on Real IRS Corpus (sum of

|\Delta v|

for unblocked attacks)

Defense	T3-H	T6	T-TEMP	Overall
No Defense	100	100	100	100
RobustRAG †	98.0 [93,99]	100 [90,100]	54.2 [39,69]	88.0 [82,92]
TrustRAG †	90.2 [82,95]	84.0 [69,93]	91.7 [79,97]	89.0 [83,93]
RAGPart †	100 [95,100]	100 [90,100]	58.3 [42,73]	90.0 [84,94]
Embed-only	96.1 [90,99]	100 [90,100]	20.8 [11,36]	79.0 [72,85]
RAGShield	0.0 [0,5]	0.0 [0,10]	0.0 [0,10]	0.0 [0,3]

TABLE IX : Attack Success Rate (%) on Synthetic Corpus (1,012 passages, 100 attacks). Lower is better. 95% Wilson CIs in brackets.

\dagger

= reimplemented from paper description.

Defense	Unblocked	Total Harm	Mean/Attack
No Defense	100	$461,624	$4,616
RobustRAG †	88	$41,751	$474
TrustRAG †	89	$457,078	$5,136
RAGPart †	90	$453,655	$5,041
Embed-only	79	$38,309	$485
RAGShield	0	$0	$0

TABLE X : Citizen Financial Harm on Synthetic Corpus (sum of

|\Delta v|

for unblocked attacks)

Configuration	ASR	Blocked	Harm
Full (embed + claim + temporal)	0.0%	100/100	$0
Claim verification only	0.0%	100/100	$0
Embedding only	79.0%	21/100	$38,309
Temporal only	78.0%	22/100	$41,338
No defense	100.0%	0/100	$461,624

TABLE XI : Ablation Study

Query Topic	Correct	Poisoned	No Def	v2
Std. deduction (single)	$15,000	$15,500	✗	✓
SSI monthly rate	$943/mo	$993/mo	✗	✓
401(k) limit	$23,500	$24,500	✗	✓
EITC max (3+ children)	$7,430	$7,630	✗	✓
Child tax credit	$2,000	$2,100	✗	✓
Medicare B premium	$185/mo	$195/mo	✗	✗ ∗

TABLE XII : End-to-End LLM Evaluation (TinyLlama-1.1B-Chat)

Format Type	Value	Entity
Table format (tab-separated)	✓	✓
Conditional claims (if/then)	✓	✓
Mixed non-claim numbers (phone, pub#)	✓	✓
Footnote markers near numbers	✓	✓
Historical comparison (2024 vs 2025)	✓	✓
Heavy abbreviations (SSI fed. benefit)	✓	✓

TABLE XIII : Claim Extraction on Adversarial Formatting

Strategy	Tests	Evasion	Type
E1: Unicode lookalike digits	24	0.0%	Extract
E2: Spelled-out numbers	3	100%	Extract
E3: Relative claims (“increased by”)	24	0.0%	Extract
E4: Split across sentences	24	0.0%	Extract
E5: Footnote override	24	0.0%	Extract
E6: Percentage reframe (“103.3%”)	16	100%	Extract

TABLE XIV : Adaptive Adversary Evasion Strategies Against RAGShield

Pre-poison	Correct Src	Poisoned Src	Detection
0%	3	0	83.3%
33%	2	1	83.3%
50%	1	2	87.5%
67%	1	2	87.5%
100%	0	3	45.8%

TABLE XV : Detection Rate Under Pre-Poisoned Registry

RAG Security

Retrieval-augmented generation security studies how to protect retrieval-based language systems from attacks, data leakage, and unsafe outputs.

See all 104 papers

Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint
Oct 21, 2026Peiyang Liu, Xi Wang, Di Liang +3RAG Security RAG Evaluation
National Engineering Research Center for Software Engineering, Peking University, Beijing, China · School of Software and Microelectronics, Peking University, Beijing, China · Tencent Technology, Shenzhen, China +1
RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems
Oct 6, 2026Niveen O. Jaffal, Ahmet Yuksel, David MohaisenRAG Security Prompt Injection Attacks on LLMs
Birzeit University, Birzeit, Palestine · Independent Researcher · University of Central Florida, Orlando, FL, USA
Salience Induction against Multi-Hop RAG Agents: Threat and Defense
Jul 20, 2026Xingfu Zhou, Pengfei Wang, Yuan Zhou +2Multi-Hop QA Adversarial Attacks
National University of Defense Technology China

Oct 21, 2026J/K move · Enter open · S save

Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

Peiyang Liu, Xi Wang, Di Liang, Youru Li+2

National Engineering Research Center for Software Engineering, Peking University, Beijing, China · School of Software and Microelectronics, Peking University, Beijing, China · Tencent Technology, Shenzhen, China+1

RAG Security RAG Evaluation

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) systems face security, privacy, and copyright risks including content leakage, source reconstruction, unauthorized access, data poisoning, and prompt injection. Yet RAG protection studies use incompatible evaluation metrics, datasets, and threat models. We present a systematic survey and human-coded evidence map of 118 full-text-confirmed RAG defense papers, organized by measured endpoint rather than claimed goal or defense mechanism. Our seven-family taxonomy covers content disclosure, formal privacy proxies, access control and suppression, corpus-use detection, and pipeline integrity and attribution. Thirty-two annotators double-coded the papers kappa=0.867. The survey identifies three gaps. First, retrieval reranking and context rewriting each span five or six endpoint families, so mechanisms do not identify protection outcomes. Second, only 17.8% of studies use content disclosure or reconstruction as their primary endpoint; under the frozen copyright/ownership relation label, 73.3% of records have corpus-use detection as their primary endpoint, and none have an emitted-expression primary endpoint. Third, most evaluations use general-purpose question-answering datasets and non-adaptive attacks rather than sensitive data and adaptive, multi-turn extraction. Our controlled RAG testbed shows that preventing verbatim copying does not prevent private-fact recovery: a normalized 8-gram guard reduces 20-token copying to 0.0%, but a three-query adaptive attacker recovers 48.3% of hidden facts on Qwen3-8B. We release the taxonomy, dataset, coding protocols, and testbed to enable comparable, claim-aligned RAG security evaluation.

Abstract

RAG Security

Explore similar work

Protection Is Not One Event: A Survey of RAG Protection Research by Measured Endpoint

RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems

Salience Induction against Multi-Hop RAG Agents: Threat and Defense