RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems

Niveen O. Jaffal; Ahmet Yuksel; David Mohaisen

cs.CROct 6, 2026

RAG-PIBench: A Leakage-Aware Benchmark for Prompt-Injection Detection in Trustworthy RAG Systems

Authors: Niveen O. Jaffal, Ahmet Yuksel, David Mohaisen

Organizations: Birzeit University, Birzeit, Palestine · Independent Researcher · University of Central Florida, Orlando, FL, USA

Abstract

Retrieval-Augmented Generation (RAG) systems are vulnerable to prompt-injection attacks embedded in retrieved content. We introduce RAG-PIBench, a benchmark for RAG-style prompt-injection detection containing 4,876 contextual examples across frozen train, validation, and protected-test splits. Using a leakage-aware construction pipeline and strict evaluation protocol, we compare keyword-based, semantic-reference, TF-IDF, and transformer-based detectors. DistilBERT achieves the best protected-test performance (F1 = 0.896, PR-AUC = 0.968), while TF-IDF SVM and logistic regression remain competitive. Our results demonstrate the value of leakage-aware benchmark design and strong sparse baselines for reliable prompt-injection detection in RAG systems.

Figures & tables

Work	Yr.	Setting	IPI	RAG	Modality		Goal	Attributes
					T	I		L	B	F
Palisade [ 11 ]	2024	PI detection	$\circ$	–	✓	–	Filter/classifier defense	–	$\circ$	$\circ$
INJECAGENT [ 23 ]	2024	Tool-agent PI	✓	–	✓	–	Agent vulnerability	–	–	$\circ$
PromptShield [ 8 ]	2025	PI detection	✓	–	✓	–	PI detection	–	✓	$\circ$
PromptSleuth [ 20 ]	2025	Semantic PI det.	✓	–	✓	–	Semantic detection	$\circ$	✓	$\circ$
BIPIA [ 22 ]	2025	External-content PI	✓	✓	✓	–	Vulnerability and defense	$\circ$	$\circ$	$\circ$

Table 1: Comparison of representative prompt-injection benchmarks, detection frameworks, and trustworthy-RAG defenses. Columns indicate whether the work explicitly addresses indirect prompt injection (IPI), retrieval-augmented generation (RAG), text and image modalities, leakage-aware or protected evaluation protocols, detector baseline comparisons, and failure-mode analysis. Modalities are text (T) or image (I). The attributes of the work are leakage (L), baselines (B), and failures (F)

Figure 1: RAG-PIBench construction and evaluation pipeline. Candidate host passages and payload parents are registered, filtered, and reviewed before being rendered into RAG-style contextual examples. The benchmark is frozen into train, validation, and protected-test splits with balanced benign and malicious labels.

Panel of Figure 2 — Figure 2: Source composition of RAG-PIBench. (a) Host-document sources used for contextual passages. (b) Payload-parent sources used to generate benign and malicious embedded content. Percentages are computed over 3,500 host documents in (a) and separately over the benign and malicious payload-parent pools (192 sources each) in (b).

Split	Total	Benign	Mal.
Train	2936	1468	1468
Valid.	962	481	481
Prot. Test	978	489	489
Total	4876	2438	2438

Table 2: Data split statistics.

Class	Model	Prec.	Rec.	$\boldsymbol{F_{1}}$	PR-AUC	ROC-AUC	Acc.
FT-Enc.	DistilBERT	0.924	0.869	0.896	0.968	0.967	0.899
Sparse	TF-IDF SVM	0.853	0.890	0.871	0.950	0.949	0.868
Sparse	TF-IDF LR	0.822	0.916	0.867	0.950	0.949	0.859
Sparse	TF-IDF RF	0.822	0.879	0.850	0.933	0.931	0.845
SemSim	MiniLM Ref.	0.508	0.969	0.667	0.576	0.571	0.515
FT-Enc.	DeBERTa-v3	0.500	1.000	0.667	0.488	0.487	0.500

Table 3: Primary protected-test performance across all evaluated detectors.

Panel of Figure 3 — Figure 3: Primary protected-test performance summary. Panel (a) reports the fixed operating-point $F_{1}$ score, where DistilBERT achieves the strongest overall result and TF-IDF SVM provides the strongest sparse lexical baseline. Panel (b) reports PR-AUC, showing that strong TF-IDF baselines remain competitive for ranking malicious prompt-injection examples.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Stage	Reproducibility control	Protocol ID
Data freeze	Fixed the train, validation, and protected-test rows before model development.	0R
Sparse/rule baselines	Registered the final protected-test results for sparse and rule-based baselines.	0AA.2G/0AA.2H
Transformer training	Restricted training to the train split and checkpoint selection to validation only.	0AA.2L.1-R4
Validation gate	Prevented validation-only transformer results from entering the final test table.	0AA.2M-LITE
Protected-test transfer	Opened the protected-test split only for final transformer inference.	0AA.2N.0
Transformer evaluation	Produced the final transformer protected-test metrics.	0AA.2N.1

Appendix

Table 4: Reproducibility controls for the final RAG-PIBench results.

Audit	Check	Registered outcome
Rendered-text duplicates	Exact and hash-level duplicates were checked across train, validation, and protected-test splits.	No cross-split rendered-text duplicate leakage was registered.
Host-context isolation	Host documents and segmented passages were assigned before final rendering to reduce cross-split overlap.	Host overlap was controlled through split isolation and audit checks.
Payload-parent tracking	Payload-parent sources and semantic families were tracked during candidate selection and rendering.	Payload-parent usage was registered and controlled during benchmark construction.
Schema and provenance validation	Required fields, labels, split metadata, row identifiers, and provenance fields were validated.	Invalid, unsupported, or inconsistent rows were excluded, quarantined, or sent for further confirmation.
Shortcut and residual-cue review	Formatting artifacts, source-specific cues, repeated templates, and residual shortcut indicators were reviewed.	Problematic rows or patterns were corrected, excluded, quarantined, or explicitly registered.
Protected-test access boundary	Exposure of protected-test text during train/validation model development was checked.	Protected-test text was withheld during train/validation phases and opened only for final evaluation.

Appendix

Table 5: Leakage and shortcut-control audits used in RAG-PIBench.

Model	TN	FP	FN	TP
DistilBERT	454	35	64	425
TF-IDF SVM	414	75	54	435
TF-IDF LR	392	97	41	448
TF-IDF RF	396	93	59	430
MiniLM Ref.	30	459	15	474
DeBERTa-v3	0	489	0	489

Appendix

Table 6: Protected-test confusion matrices for all evaluated detectors.

Suite	Purpose	Boundary
Contextual diagnostic	Rendered-distribution behavior.	Reporting only; not used for final ranking.
Hard benign diagnostic	Stress test for benign false positives.	Reporting only; not used for threshold tuning.
External transfer audit	Distribution-sensitivity analysis.	Reporting only; not merged into the primary evaluation.

Appendix

Table 7: Diagnostic suites and evaluation boundaries.

Detector	Configuration	Evaluation boundary
Keyword	Deterministic lexical-pattern heuristic.	No train-time tuning.
MiniLM Ref.	Maximum similarity to the malicious-reference bank.	Decision threshold selected on validation only.
TF-IDF LR	Word- and character-level TF-IDF features.	Hyperparameters selected on validation only.
TF-IDF SVM	Word- and character-level TF-IDF features.	Hyperparameters selected on validation only.
TF-IDF RF	Word-level TF-IDF features.	Hyperparameters selected on validation only.
DistilBERT	Transformer encoder classifier with maximum sequence length 256.	Trained on the train split, selected on validation, and evaluated once on the protected-test split.

Appendix

Table 8: Model configuration and evaluation boundaries.

Explore similar work

CleanBase: Detecting Malicious Documents in RAG Knowledge Databases
May 1, 2026Weifei Jin, Xilong Wang, Wei Zou +2Indirect Prompt Injection Question-Answering Benchmarks
Duke University · The Pennsylvania State University
Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
Aug 8, 2026Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon +2Intrusion Detection Hievi-Rag
Laurentian University Ontario, Canada · Centennial College Ontario, Canada · The University of Osaka Osaka, Japan
A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots
Jun 17, 2026Gulshan Saleem, Nisar Ahmed, Muhammad Imran Zaman +1Indirect Prompt Injection Poisoning
Sparkverse AI Ltd, Bradford, 100190, West Yorkshire, England, UK

May 1, 2026, cs.CRJ/K move · Enter open · S save

CleanBase: Detecting Malicious Documents in RAG Knowledge Databases

Weifei Jin, Xilong Wang, Wei Zou, Jinyuan Jia+1

Duke University · The Pennsylvania State University

Indirect Prompt Injection Question-Answering Benchmarks Malicious Agents Large Language Model Baselines Document

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) is vulnerable to prompt injection attacks, in which an adversary inserts malicious documents containing carefully crafted injected prompts into the knowledge database. When a user issues a question targeted by the attack, the RAG system may retrieve these malicious documents, whose injected prompts mislead it into generating attacker-specified answers, thereby compromising the integrity of the RAG system. In this work, we propose CleanBase, a method to detect malicious documents within a knowledge database. Our key insight is that malicious documents crafted for the same attack-targeted questions often exhibit high semantic similarity, as attackers deliberately make them consistent to improve attack success rates. Accordingly, CleanBase constructs a similarity graph over the knowledge database, where each node represents a document and an edge connects two nodes if their semantic similarity--computed using an embedding model--exceeds a statistically determined threshold. Due to their inherent similarity, malicious documents tend to form cliques within this graph. CleanBase detects such cliques and flags the corresponding documents as malicious. We theoretically derive upper bounds on CleanBase's false positive and false negative rates and empirically validate its effectiveness. Experimental results across multiple datasets and prompt injection attacks demonstrate that CleanBase accurately detects malicious documents and effectively safeguards RAG systems. Our source code is available at https://github.com/WeifeiJin/CleanBase.

Abstract

Explore similar work

CleanBase: Detecting Malicious Documents in RAG Knowledge Databases

Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection

A Layered Security Framework Against Prompt Injection in RAG-Based Chatbots