RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation

Yueyang Quan; Anjun Gao; Yufei Xia; Minghong Fang; Zhuqing Liu

cs.CRAug 25, 2026

RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation

Authors: Yueyang Quan, Anjun Gao, Yufei Xia, Minghong Fang, Zhuqing Liu

Organizations: University of North Texas · University of Louisville

Abstract

Retrieval-augmented generation (RAG) improves the factuality of large language models by grounding responses in external documents, but it also exposes a critical security vulnerability: adversarial documents injected into the knowledge database can enter the context window and steer the model toward targeted incorrect answers. Existing post-retrieval defenses rely on instruction following, parametric knowledge, or text-level consistency, all of which can be imitated or optimized against by adaptive attackers. We propose RAGSentinel, a training-free, label-free defense for black-box RAG systems. RAGSentinel uses a surrogate encoder to measure query-conditioned hidden-state shifts induced by retrieved documents, removes shared topic directions, and filters poisoned documents as geometric outliers from a robust majority consensus. We prove that, under an honest-majority assumption and a representation-level separation condition, RAGSentinel exactly recovers a poison-free majority-sized context. Experiments across three question-answering datasets, three LLM families, and multiple poisoning attacks show that RAGSentinel consistently achieves low attack success rates while preserving competitive accuracy and remaining effective against adaptive attacks with full pipeline knowledge.

Figures & tables

Figure 1: Poisoned documents are geometric outliers in the topic-removed residual space on the MS-MARCO query “what group sang stairway to heaven?” with ten retrieved documents including two injected poisoned documents. Each marker represents one document: ⚫ benign, ◆ poisoned, ★ geometric median anchor

c

. Benign documents cluster near a common direction while the two poisoned documents are clear outliers.

		NQ				HotpotQA				MS-MARCO
Model	Method	No attack	PoisonedRAG	PIA	AD	No attack	PoisonedRAG	PIA	AD	No attack	PoisonedRAG	PIA	AD
		ACC	ACC/ASR	ACC/ASR	ACC/ASR	ACC	ACC/ASR	ACC/ASR	ACC/ASR	ACC	ACC/ASR	ACC/ASR	ACC/ASR
Mistral-7B	Vanilla RAG	0.71	0.53/0.40	0.58/0.29	0.49/0.45	0.73	0.38/0.60	0.42/0.51	0.40/0.52	0.82	0.59/0.34	0.66/0.24	0.66/0.29
	RobustRAG	0.64	0.69/0.11	0.68/0.09	0.69/0.11	0.57	0.57/0.30	0.56/0.31	0.59/0.26	0.87	0.87/0.03	0.85/0.03	0.86/0.04
	InstructRAG	0.72	0.54/0.40	0.57/0.29	0.62/0.29	0.71	0.43/0.52	0.42/0.52	0.56/0.30	0.82	0.61/0.32	0.70/0.23	0.70/0.21
	AstuteRAG	0.69	0.70/0.10	0.69/0.03	0.67/0.12	0.68	0.67/0.17	0.64/0.15	0.63/0.24	0.85	0.81/0.12	0.85/0.08	0.83/0.11

Table 1: ACC(

\uparrow

) and ASR(

\downarrow

) of all defense methods under PoisonedRAG, PIA, and AD attacks across three datasets and three LLMs.

$k$	NQ	HotpotQA	MS-MARCO
	ACC/ASR	ACC/ASR	ACC/ASR
8	0.60/0.05	0.60/0.08	0.69/0.10
10	0.63/0.04	0.63/0.09	0.77/0.05
12	0.61/0.03	0.66/0.07	0.74/0.05
14	0.66/0.02	0.61/0.06	0.73/0.07
16	0.68/0.01	0.60/0.05	0.75/0.07

Table 2: Impact of the number of retrieved documents

k

on RAGSentinel under PoisonedRAG.

Figure 2: Impact of the number of poisoned documents on RAGSentinel under PoisonedRAG.

Method	NQ	HotpotQA	MS-MARCO
Vanilla RAG	0.49	0.49	0.48
RobustRAG	3.15	3.62	2.44
InstructRAG	0.89	0.77	0.96
AstuteRAG	2.29	2.13	2.96
TrustRAG	2.80	2.60	2.54
CrAM	1.22	1.22	1.06

Table 3: Average inference time per query (seconds/query).

Surrogate	Pooling	NQ	HotpotQA	MS-MARCO
BGE-M3	CLS	0.61/0.04	0.62/0.11	0.75/0.08
	Mean	0.60/0.09	0.58/0.14	0.73/0.10
	Last token	0.63/0.04	0.63/0.09	0.77/0.05
E5-Mistral-7B	Mean	0.61/0.06	0.60/0.08	0.75/0.07
E5-Mistral-7B	Last token	0.64/0.03	0.64/0.04	0.78/0.04
Phi-3.5-mini	Mean	0.58/0.08	0.57/0.09	0.70/0.12

Table 4: Impact of pooling strategy across surrogate encoders under PoisonedRAG.

Notation	Definition
$q$	User query
$\{p_{i}\}_{i=1}^{k}$	Set of $k$ retrieved documents
$k,\,k^{\prime}$	Number of retrieved documents; number of injected poisoned documents
$f_{\varphi},\,f_{\theta}$	Surrogate encoder for hidden-state extraction; deployed black-box LLM
$\delta_{i}$	Hidden-state shift induced by document $p_{i}$
$z_{i}$	Residual vector after adaptive norm clipping and topic-direction removal

Table 5: Key notation used in the paper.

Panel of Figure 8 — Algorithm 1 RAGSentinel

Panel of Figure 3 — Figure 3: Poisoned documents are geometric outliers in the topic-removed residual space with ten retrieved documents including two injected poisoned documents. NQ query: “who played miss wheeler in carry on teacher”; HotpotQA query: “The mass killing that took place at Oakland, California on April 2, 2012 was less deadly than the one that took place on October 1, 2015 in which state?” ⚫ benign, ◆ poisoned, ★ geometric median anchor $c$ .

Figure 4: Overview of the RAGSentinel pipeline. An attacker injects poisoned documents into the knowledge database (left). The surrogate encoder encodes each query-document pair and extracts hidden-state shifts (Phase 1). Consensus scoring identifies poisoned documents as geometric outliers via the global anchor (Phase 2). Adaptive filtering keeps a trusted context $\mathcal{C}^{\star}$ (Phase 3), which is passed to the black-box LLM for answer generation.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 5 — Figure 5: Case Study 1: NQ under PoisonedRAG with $k^{\prime}=2$ poisoned documents. Both injected documents falsely attribute the cardiac and vasomotor centers to the cerebellum. RAGSentinel assigns them consensus distances ${\approx}2.6\times$ beyond $R_{\mathrm{adp}}$ and removes both, while the five kept benign documents directly support the correct answer.

Panel of Figure 6 — Figure 6: Case Study 2: HotpotQA under PoisonedRAG with $k^{\prime}=2$ poisoned documents. Both injected documents falsely attribute the episode to FOX. RAGSentinel assigns them consensus distances ${\approx}1.4\times$ beyond $R_{\mathrm{adp}}$ and removes both. Three benign documents whose content is irrelevant to the query (docs 4, 7, 8) are further excluded by the top- $\lceil k/2\rceil$ selection step, leaving a focused context that correctly identifies NBC.

Panel of Figure 7 — Figure 7: Case Study 3: MS-MARCO under PoisonedRAG with $k^{\prime}=2$ poisoned documents. Both injected documents falsely claim the IRA withdrawal age is 45. The benign cluster is unusually tight ( $d_{i}\leq 0.69$ ), amplifying the separation of the two poisoned documents ( $1.7\times$ - $2.2\times$ beyond $R_{\mathrm{adp}}$ ). All five documents in $\mathcal{C}^{\star}$ explicitly cite the 59 ½ rule, directly grounding the correct answer.

Attack	NQ			HotpotQA			MS-MARCO
Attack	DACC $\uparrow$	FPR $\downarrow$	FNR $\downarrow$	DACC $\uparrow$	FPR $\downarrow$	FNR $\downarrow$	DACC $\uparrow$	FPR $\downarrow$	FNR $\downarrow$
PoisonedRAG	0.941	0.06	0.05	0.963	0.03	0.10	0.940	0.06	0.06
PIA	0.957	0.04	0.07	0.975	0.02	0.07	0.968	0.03	0.05
AD	0.968	0.03	0.05	0.981	0.01	0.10	0.977	0.02	0.05

Appendix

Table 6: Document filtering performance of RAGSentinel (DACC

\uparrow

, FPR

\downarrow

, FNR

\downarrow

) under three poisoning attacks across three datasets on Mistral-7B.

Method	NQ			HotpotQA			MS-MARCO
	Anchor mimicry	Norm boundary	Subspace camouflage	Anchor mimicry	Norm boundary	Subspace camouflage	Anchor mimicry	Norm boundary	Subspace camouflage
	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR
Vanilla RAG	0.54/0.38	0.56/0.37	0.49/0.43	0.45/0.52	0.48/0.52	0.44/0.53	0.59/0.34	0.58/0.33	0.60/0.31
RobustRAG	0.66/0.15	0.68/0.12	0.69/0.12	0.57/0.30	0.58/0.28	0.56/0.30	0.87/0.03	0.86/0.04	0.87/0.03
InstructRAG	0.55/0.39	0.56/0.36	0.54/0.38	0.44/0.49	0.45/0.49	0.42/0.50	0.59/0.35	0.56/0.36	0.59/0.32
AstuteRAG	0.70/0.08	0.69/0.09	0.70/0.12	0.66/0.17	0.67/0.16	0.67/0.16	0.80/0.12	0.80/0.12	0.80/0.11

Appendix

Table 7: Performance comparison under three adaptive attacks on NQ, HotpotQA, and MS-MARCO.

	NQ				HotpotQA				MS-MARCO
Variant	No attack	PoisonedRAG	PIA	AD	No attack	PoisonedRAG	PIA	AD	No attack	PoisonedRAG	PIA	AD
	ACC	ACC/ASR	ACC/ASR	ACC/ASR	ACC	ACC/ASR	ACC/ASR	ACC/ASR	ACC	ACC/ASR	ACC/ASR	ACC/ASR
w/ Arithmetic Mean	0.68	0.55/0.08	0.52/0.13	0.58/0.09	0.63	0.57/0.09	0.59/0.13	0.66/0.12	0.80	0.82/0.13	0.69/0.11	0.77/0.13
w/o Topic-Direction Removal	0.62	0.58/0.09	0.63/0.11	0.58/0.09	0.61	0.55/0.12	0.57/0.12	0.60/0.09	0.80	0.79/0.09	0.68/0.11	0.77/0.09
w/o Active Subspace Selection	0.63	0.53/0.12	0.54/0.09	0.52/0.10	0.63	0.63/0.09	0.53/0.12	0.54/0.15	0.80	0.74/0.08	0.70/0.15	0.74/0.08
w/o Adaptive Norm Clipping	0.65	0.61/0.07	0.63/0.10	0.58/0.07	0.67	0.54/0.17	0.56/0.09	0.57/0.11	0.82	0.76/0.10	0.70/0.14	0.72/0.14

Appendix

Table 8: Ablation study of RAGSentinel components across three datasets.

Centering method	$k^{\prime}=1$	$k^{\prime}=2$	$k^{\prime}=3$	$k^{\prime}=4$
No topic removal	0.64/0.10	0.56/0.19	0.46/0.31	0.37/0.47
Coordinate-wise median	0.67/0.06	0.61/0.11	0.53/0.21	0.44/0.35
Geometric median	0.67/0.05	0.62/0.11	0.54/0.20	0.45/0.34
Arithmetic mean	0.68/0.06	0.61/0.12	0.53/0.22	0.44/0.36
Oracle benign mean	0.69/0.05	0.62/0.10	0.55/0.19	0.46/0.33

Appendix

Table 9: Impact of topic-centering estimators under PoisonedRAG as the number of poisoned documents increases. Results are averaged across NQ, HotpotQA, and MS-MARCO.

Retriever	Backbone LLM	NQ	HotpotQA	MS-MARCO
		ACC/ASR	ACC/ASR	ACC/ASR
Contriever	Mistral-7B	0.63/0.04	0.63/0.09	0.77/0.05
	Llama-3.1-8B	0.68/0.03	0.60/0.06	0.71/0.05
	Qwen-2.5-7B	0.65/0.06	0.64/0.11	0.73/0.09
Contriever-MS	Mistral-7B	0.65/0.05	0.66/0.07	0.76/0.07
	Llama-3.1-8B	0.73/0.06	0.61/0.05	0.76/0.08

Appendix

Table 10: Effect of retrieval model on RAGSentinel across three datasets under PoisonedRAG.

	NQ				HotpotQA				MS-MARCO
Surrogate Model	No attack	PoisonedRAG	PIA	AD	No attack	PoisonedRAG	PIA	AD	No attack	PoisonedRAG	PIA	AD
	ACC	ACC/ASR	ACC/ASR	ACC/ASR	ACC	ACC/ASR	ACC/ASR	ACC/ASR	ACC	ACC/ASR	ACC/ASR	ACC/ASR
BGE-M3	0.69	0.63/0.04	0.63/0.05	0.61/0.04	0.68	0.63/0.09	0.64/0.06	0.63/0.09	0.82	0.77/0.05	0.71/0.04	0.78/0.04
E5-mistral-7b	0.66	0.64/0.03	0.66/0.03	0.67/0.03	0.64	0.64/0.04	0.64/0.07	0.63/0.05	0.78	0.78/0.04	0.74/0.05	0.76/0.05
Phi-3.5-mini	0.64	0.61/0.05	0.64/0.06	0.64/0.03	0.65	0.60/0.05	0.57/0.05	0.59/0.05	0.81	0.73/0.09	0.80/0.09	0.76/0.08
Mistral-7B	0.67	0.64/0.01	0.63/0.01	0.64/0.02	0.65	0.61/0.08	0.63/0.06	0.65/0.09	0.73	0.72/0.03	0.73/0.04	0.72/0.06

Appendix

Table 11: Impact of surrogate encoder choice on RAGSentinel across three datasets.

		NQ			HotpotQA			MS-MARCO
Model	Method	PoisonedRAG+PIA	PoisonedRAG+AD	PIA+AD	PoisonedRAG+PIA	PoisonedRAG+AD	PIA+AD	PoisonedRAG+PIA	PoisonedRAG+AD	PIA+AD
		ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR	ACC/ASR
Mistral-7B	Vanilla RAG	0.49/0.46	0.37/0.60	0.35/0.62	0.35/0.65	0.18/0.80	0.24/0.75	0.43/0.47	0.42/0.53	0.43/0.52
	RobustRAG	0.59/0.25	0.60/0.26	0.60/0.27	0.46/0.44	0.50/0.42	0.53/0.38	0.82/0.09	0.83/0.09	0.81/0.10
	InstructRAG	0.47/0.48	0.44/0.50	0.43/0.52	0.40/0.55	0.37/0.60	0.36/0.62	0.56/0.38	0.46/0.49	0.56/0.39
	AstuteRAG	0.71/0.15	0.65/0.25	0.65/0.20	0.61/0.27	0.52/0.42	0.53/0.40	0.78/0.15	0.68/0.29	0.71/0.19

Appendix

Table 12: Defense performance under mixed attack settings (PoisonedRAG+PIA, PoisonedRAG+AD, PIA+AD) across three datasets and three models (

k^{\prime}=2

Explore similar work

TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation
Jul 26, 2026Susil Kumar Mohanty, Rohit Patel, Kosuru Yuvaraj +2Retrieval-Augmented Generation RAG Poisoning Attacks
Department of Computer Science and Engineering, Indian Institute of Technology Jodhpur, Jodhpur, India
PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption
May 8, 2026Xue Tan, Yi Zheng, Chang Huo +7Retrieval-Augmented Generation RAG Poisoning Attacks
School of Computer Science, Fudan University, Shanghai, China · Institute of Big Data, Fudan University, Shanghai, China · Department of Computer Science, Worcester Polytechnic Institute, MA, USA
RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
Jul 28, 2026Pushkal Kumar, Tucker Nielson, Tanish Kolhe +2RAG Poisoning Attacks RAG Security

Jul 26, 2026J/K move · Enter open · S save

TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

Susil Kumar Mohanty, Rohit Patel, Kosuru Yuvaraj, Jeenal Chaudhary+1

Department of Computer Science and Engineering, Indian Institute of Technology Jodhpur, Jodhpur, India

Retrieval-Augmented Generation RAG Poisoning Attacks Retrieval Robustness RAG Security RAG Robustness

Open paper AskPDF arXiv

Retrieval-Augmented Generation (RAG) lets a large language model answer questions using documents retrieved from an external knowledge base at query time. This makes RAG useful for private data, fast-changing information, and reducing hallucination, but it also means the model's answer is only as trustworthy as whatever the retriever hands it. If the knowledge base accepts writes from more than one party, an attacker needs only a handful of adversarial documents to steer the model toward a chosen wrong answer. PoisonedRAG demonstrated this: as few as five crafted documents flip an undefended system's answer roughly 90% of the time, and three natural single-stage defenses (perplexity filtering, query paraphrasing, knowledge-base expansion) leave attack success at 30% or higher. We built TriShieldRAG to close that gap. Rather than relying on one checkpoint, we place three independent, formally specified rings across the pipeline: an Ingest Guard that screens documents for lexical and statistical poisoning signatures; a Retrieval Scorer that re-ranks the retrieved set by a provenance and consistency-weighted trust score; and a Cross-LLM Consensus stage that polls three architecturally diverse language models (Claude, Mistral Small, Llama 3.2) and allows one bounded re-retrieval on disagreement. We derive the conditions under which Rings 2 and 3 are expected to work: a minority-poison assumption and an explicit provenance-tag assumption. Our reported configuration is consistent with this analysis, though we have not yet run the controlled poison-fraction sweep needed to confirm it independently. Evaluated against the non-adaptive attacker from the original PoisonedRAG, over a 5,000-document Wikipedia knowledge base with 10 target questions, the full pipeline reduces attack success rate from roughly 91% to roughly 13% while preserving accuracy on benign queries.

Abstract

Explore similar work

TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption

RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning