Ranking Is Not Judgment: Benchmark Shortcuts and Working-Point Collapse in Query-Time RAG Poisoning Defenses

Core problem: the near-perfect detection reported on benchmarks by query-time RAG poisoning filters may reflect only how the poisoning set was constructed, not that the filter understood the content.

• Setting and importance: RAG's corpus is an attack surface; an attacker inserting text can manipulate outputs without touching model weights; query-time filters are the mainstream route in published defenses and report near-perfect detection on domain benchmarks (Section I).
• Shortcomings of existing evaluations: Of the 21 published defense evaluations the authors surveyed, 8 verifiably used PoisonedRAG poisonings with the target question prefix, 5 substituted length or repetition cues, and 12 did not report the false positive rate at the deployment point (Table II).
• Core observation: The code released with PoisonedRAG concatenates the target question before each inserted text, and containment is 1.00 under all its template conditions; the authors argue that this construction choice, rather than defense capability, predicts detection scores (Section I, V-A).
• What the paper proposes: A two-number construction profile computable without running any defense (containment and length overlap), a five-level control ladder that preserves the payload, and six detection reporting protocols; the authors explicitly do not propose a defense (Contributions, Section VII).
• Threat model (Section III-B):
  • Goals: Get the selected x* through the gate so the payload reaches the generator, get benign documents blocked or honest sources down-weighted, and have no attributable ESCALATE/BLOCK (G1–G3).
  • Knowledge: Knows the algorithm, ρd, thresholds, and trust update rules under the Kerckhoffs assumption (C6); all attacks reported in this paper are black-box (C3 plus a surrogate encoder).
  • Capabilities: Insert or edit N documents per target query, control all text and self-declared fields (C1, C2); query the system to obtain a hard-label oracle (C3); cannot change model weights (C5).
  • Victim system: RAG with a query-time admission gate that outputs PASS/ESCALATE/BLOCK for each candidate document.

RAG poisoning attacks

• PoisonedRAG (Zou et al., 2025): A knowledge corruption attack that achieves over 90% attack success rate with 5 segments per target query; its released code concatenates the target question before each poisoning segment, a key fact for this paper's profile (Section I, II-A).
• Subsequent attacks: CorruptRAG (2026), AuthChain (2025), and others reduce the budget to 1 segment or disguise injections as corrections using "latest data confirmation," authority cues, and timestamps; the Purpose attack (2026) writes poisonings as non-contradictory updates (Section II-A).
• Trigger and backdoor types: Phantom (2026), BadRAG (2024), TrojanRAG (2024), and others hide the payload behind triggers (Section II-A).

Staged and granular defenses

• Offline: Duplicate hashing (PoisonedRAG), DRS's covariance outlier score (Xian et al., 2025), source reliability estimation (Section II-B).
• At retrieval and before generation: RAGuard's (Cheng et al., 2025) per-chunk perplexity and query similarity, TrustRAG stage 1's (2025) k-means removal, RAGDefender's (2025) hierarchical clustering, ReliabilityRAG's (2025) NLI contradiction graph, RADAR's (2026) min-cut (Table I, Section II-B).
• At and after generation: RobustRAG's (2026) isolate-then-aggregate with certified upper bounds, RevPRAG's (2025) answer activation analysis, forensic attribution by RAGForensics (2025) and RAGOrigin (2026) (Section II-B).

Evaluation methodology for safety classifiers

• Catalog of evaluation biases: TESSERACT's (2019) experimental bias, Arp et al.'s (2022) sampling bias and spurious correlations, Sommer & Paxson's (2010) base-rate and closed-world problems, shortcut learning (Geirhos et al., 2020) (Section II-D).
• Limits of ranking metrics: The authors cite Carlini et al. (2022), Prompt-Shield (2025), and Hand (2009) to show that ranking metrics can conceal performance at deployable false positive rates; the control ladder follows the adaptive evaluation paradigm of Carlini et al. (2019) and Tramèr et al. (2020) (Section II-D).

Baselines and benchmarks: The paper reproduces and compares 7 published defenses on a unified candidate set (perplexity, RAGuard, DRS, TrustRAG stage 1, RAGDefender, NLI consistency, Dup-only), plus the authors' own learned scorer (3 threshold rows) and two single-feature reference detectors; data come from four corpora: NQ/BEIR, PubMedQA, FinQA+TAT-QA, and CUAD (Table I, V).

Positioning: The authors state that prior work has treated query inclusion as a filterable construction artifact to build poisonings without prefixes (CamoDocs et al.), but no one has measured what published filters lose in ranking and at the deployment point after removing that artifact from the attacker's own text, whether the loss is calibration or signal, or the role of length cues (Section II-E).

Overall approach: first, without running any defense, compute two construction quantities from the poisoning set and the clean corpus to predict which benchmark cells will saturate; then, using payload-preserving edits, remove these cues one by one and measure, on the same candidate set, the change in each defense's miss rate at the deployment operating point, distinguishing calibration collapse from signal collapse.

Construction profile (Section V-A)

• verbatim containment: After normalization (lowercase, punctuation removal, whitespace compression), the proportion of poisoned documents in which the target question appears as a contiguous substring.
• length overlap: The proportion of poisonings whose word count falls within the clean corpus word-count interval [ℓ5, ℓ95], also reporting the clean interval width ℓ95/ℓ5; CUAD's fixed-length 150-word chunks make this 1.00.
• Key property: Neither quantity runs a defense, reads scores, or requires labels; the authors report that containment is 1.00 for all poisonings regenerated from published templates, because the PoisonedRAG implementation concatenates the target question before each segment (Table III, IV).

Control ladder (Section V-B)

• Five rungs: template (the unmodified published generator) → prefix removed (remove all verbatim occurrences of the target question) → length matched (pad the poisoning with benign filler into the clean word-count interval) → both; the fifth rung, mimicry, changes only the target fact and applies length matching.
• Placebo padding: The length-matched rung is paired with two equal-length placebos—a word-shuffled version of clean sentences and a pseudoword version—to separate the effects of length and content (Section VI-B).
• Success criterion (Section III-C): A rung counts as a successful attack only under the conjunction of three conditions: the document is still retrieved after the edited corpus is re-embedded and re-ranked, the payload is intact relative to before the edit, and it passes the gate; retrieval survival is re-measured for each rung and printed next to the miss rate.

Measurement stack (Section IV-A, IV-B)

• Corpora and retrieval: Four corpora (NQ 24,295 documents, PubMedQA 21,000, FinQA+TAT-QA 24,991, CUAD 33,530), each with 100 target questions split 40/20/40 into scorer training, calibration, and evaluation; the retriever is all-MiniLM-L6-v2, no reranker, k=10.
• Poisoning: Four published attack families (PoisonedRAG N=5, CorruptRAG-AS N=1, HijackRAG-style instruction injection, jamming blocker); 15 of the 16 corpus×family cells were regenerated by the authors from published templates, and the 16th (PoisonedRAG on NQ) uses the attack authors' own text.
• Metrics: Deployment-point FNR and FPR reported separately, FNR at matched 5% FPR, AUROC, ECE over 15 equal-width bins, harm per thousand queries Hd and CCR; 5 seeds, with comparisons using a paired cluster bootstrap over 40 query clusters with 1000 resamples.

Decision layer as instrument (Section IV-C, IV-D)

• Cost-sensitive threshold: Deployment d specifies miss, false-block, and adjudication costs; only ρd := CFN/CFP and cA := CA/CFP enter the decision; under assumptions A1, A3, A4, the pointwise rule minimizing expected harm is a_i = BLOCK ⟺ p ≥ τ_d := 1/(1+ρ_d), i.e., the threshold moves only with the harm ratio.
• Trust term: Trust enters as a prior-odds multiplier κs, and the threshold becomes τ_d,s = 1/(1+ρ_dκ_s), with κs clipped to [0.25, 20]; the two knobs only move documents whose scores fall within a bounded band.
• Authors' position: The decision layer is a measurement instrument, not a contribution; source identity here is an exact label indicator (provenance-only AUROC 1.000), so no trust number is a detection result (Section IV-A).

Experimental setup

• Defenses under test: ten defenses, eleven table rows, eight different scoring systems—perplexity (GPT-2), RAGuard (Cheng et al.), DRS, TrustRAG stage 1, RAGDefender, NLI consistency (ReliabilityRAG), Dup-only, and rows for the authors' own learned scorer at three thresholds (τ=0.5, τd, τd,s with two trust weights); plus two single-feature reference detectors (length-only, containment-only) as floors rather than defenses (Table V).
• Datasets: NQ (BEIR subcorpus, 24,295 documents), PubMedQA (21,000), FinQA+TAT-QA (24,991), CUAD (33,530); 100 target questions per corpus, evaluated on 40 evaluation queries per cell (Section IV-A).
• Attacks: PoisonedRAG (N=5), CorruptRAG-AS (N=1), HijackRAG-style instruction injection, jamming blocker; the NQ PoisonedRAG poisonings are the attack authors' originals, the rest were regenerated from published templates (Section IV-A).
• Metrics and decision rules: FNR/FPR at the deployment point, FNR at matched 5% FPR, AUROC, ECE, Hd, CCR; retriever all-MiniLM-L6-v2, k=10; 5 seeds {11,22,33,44,55}, paired cluster bootstrap (40-query clusters, 1000 resamples) (Section IV-B).
• Hardware: AMD Ryzen 7 5700G, 15 GiB RAM, CPU only, 35.8 CPU hours for the main-table channels (Table I note).

Main results

Per Table V (each cell is deployment-point FNR / FPR at that point / FNR at matched 5% FPR, attack poisonedrag_bb):

Swipe horizontally to read the table

Defense	general	general, −prefix	medical	financial	legal
Perplexity (GPT-2)	1.000/0.005/0.809	1.000/0.005/0.866	0.062/0.000/0.046	1.000/0.005/1.000	0.551/0.000/0.392
RAGuard (Cheng)	0.191/0.065/0.216	0.763/0.061/0.796	0.000/0.115/0.000	0.146/0.104/0.309	0.078/0.108/0.087
DRS	0.854/0.154/0.970	0.930/0.164/0.995	0.700/0.035/0.635	0.833/0.094/0.904	0.816/0.128/0.897
TrustRAG stage 1	0.000/0.149/N/A	0.070/0.153/N/A	0.000/0.014/N/A	0.009/0.665/N/A	0.004/0.147/N/A
RAGDefender	0.045/0.025/N/A	0.172/0.117/N/A	0.000/0.055/N/A	0.081/0.119/N/A	0.339/0.029/N/A
Ours, τ=0.5	0.015/0.010/0.000	0.118/0.014/0.043	0.000/0.000/0.000	0.025/0.017/0.017	0.002/0.059/0.005
length-only (ref.)	1.000/0.000/1.000	1.000/0.000/1.000	0.000/0.000/0.000	1.000/0.000/1.000	0.992/0.000/0.183
containment-only (ref.)	0.000/0.025/0.000	0.882/0.023/0.839	0.000/0.005/0.000	0.009/0.298/0.022	0.077/0.029/0.039

(No defense, Dup-only, NLI and the τd, τd,s rows of Ours are omitted; NLI has FNR 0.793–1.000 on all corpora, one of the worst rows in the whole table.)

• Authors' interpretation: on templated medical poisonings, 4 of the 8 scoring systems have FNR 0.000, which the authors call saturation of the profile prediction rather than capability; after prefix removal, RAGuard's AUROC drops from 0.953 to 0.758 and its deployment-point FNR rises from 0.191 to 0.763 (Table IX).
• Authors' interpretation: the near-zero miss rates are bought at false-positive rates spanning more than two orders of magnitude, and the cheapest end relies on a single boolean feature; the authors say a zero miss rate paired with an FPR above 0.5 should be read as "closing the door" rather than detection (Fig. 2, Section VII rule 5).
• Authors' interpretation: the four values of the profile predict four outcomes—medical (containment plus length separation) is where all content defenses saturate, legal's fixed-length clean corpus makes the length cue free, on financial the prefix alone breaks the deployment point, and NQ is the diagnostic cell (Fig. 1, Section VI-A).

Direct evaluation of released code and released poisonings (Table VI)

• What was measured: TrustRAG stage 1 and RAGDefender's released repositories run as-is, on the NQ poisonings and clean top-5 released by PoisonedRAG, evaluated under the code's insertion form (Q⊕I) and the archived form (I) respectively.
• Results: on the ten-candidate set, TrustRAG's poisoning removal rate is 0.996 and 0.980 for the two forms (clean removal 0.122), and RAGDefender's is 0.884 and 0.830; with the prefix, its Contriever top-5 contains 4.79 poisoned passages per query, dropping to 2.40 without the prefix.
• Authors' interpretation: these two set-level filters read redundancy, a construction cue, rather than containment; with the prefix, the top-5 is all poisoning for 86 of 100 queries, and TrustRAG returns empty context on 84 queries, which the authors describe as emptying the context rather than discriminating within it (Section VI-A).

Control ladder and placebo (Fig. 3, Table VII)

• What was measured: deployment-point FNR of each defense under four payload-preserving edit rungs, with the medical length-matching rung paired with three equal-length fillers (clean prose, word-order-shuffled, pseudowords).
• Results: prefix removal raises the authors' scorer's deployment-point FNR by +0.009 on medical and +0.421 on financial; length matching raises it by +0.983 on medical, +0.036 on legal, and only +0.014 on financial. Under word-order-shuffled filler, TrustRAG stage 1's FNR goes from 0.000 to 0.827 and the authors' scorer from 0.000 to 0.986 (AUROC stays 0.953, 0.321 at matched 5% FPR); perplexity and RAGuard collapse under clean filler (0.361, 0.519) but return to 0.000 and 0.000 under shuffled filler.
• Authors' interpretation: which cue bears the weight is a corpus property, and a single control reverses the conclusion on another corpus; the collapse of the two NLL detectors is due to content dilution, and the authors retract that headline reading and report both arms as bounds (Section VI-B).

Collapse modes, ablations and decision consistency (Fig. 4, Table VIII, XIII)

• Two collapse modes: distinguished by the ratio of ΔFNR to ΔAUROC at the deployment point—calibration collapse (ranking usable, deployment point dead, e.g., the authors' scorer under shuffled filler with ECE 0.471) and signal collapse (ranking falls to chance level, e.g., AUROC 0.503 on medical after both cues are removed); the authors say reporting AUROC alone reports both as success (Section VI-C).
• Feature ablation: removing the document-length feature on length-matched medical lowers deployment-point FNR from 0.986 to 0.204 (clean filler), ECE from 0.416 to 0.111, and raises AUROC from 0.885 to 0.992; the authors say the feature carries the threshold yet harms ranking, and the fix is a rollback rather than content recovery (Table VIII, Section VI-D).
• Decision consistency: across 26 corpus×attack cells, harm-blind τ=0.5, cost-derived τd and trust-adjusted τd,s produce bit-identical actions over all candidates in 12 cells; on templated medical poisonings the proportion of candidates whose scores fall within the decision band is 0 (0.00%), and the authors say operating-point claims on these cells are unfalsifiable (Table XIII, Section VI-E).

Other ablations and analyses

• Defense-aware attacker: a query-type attacker tuned against the authors' scorer on NQ (500 oracle queries, 60 iterations per document) gets 0.977 of documents through; for other defenses it is a lower bound under transfer attack (Table XIV, Section VI-B).
• DRS correction: an early port of the authors calibrated on 199 clean documents (fewer than 384-dimensional embeddings); after correction, DRS's clean FPR on medical drops from 0.945 to 0.035, and the authors state explicitly that the old number was a defect of their own port, not a problem with DRS (Table V note, Section VIII).
• Cells where the operating point matters: on unsaturated scores, harm per thousand queries drops from 4195 to 2585 for length-matched legal and from 1600 to 900 for prefix-removed medical; the same rule package points in the same direction on RAGuard and perplexity scores (Fig. 7, Section VI-E).
• Negative result: the profile is wrong in direction in 40 of 90 (corpus, attack, defense) points (Fig. 5); after both cues are removed, medical's retrieval survival rate is only 0.18, and attack success under the conjunctive sense is 0.18 (Section VI-B).

Limitations and future directions noted by the authors

• Regenerated poisoning is an upper bound (Section VIII): poisoning for three of the four corpora was regenerated from published templates, and every separability number on those cells is an upper bound; the exception, NQ, carries the argument, and its prefix control is one of the paper's two pillars.
• A placebo retracted a headline (Section VIII): an early draft headlined the collapse of perplexity under length matching; equal-length word-order-shuffled padding revoked it (Table VII).
• Gap between reproduction and the original systems (Section VIII): the seven published defenses are the authors' reproductions following published rules; RAGDefender uses the MiniLM embedder from its artifact rather than the 1.5B-parameter encoder reported in the paper; RAGuard, DRS, perplexity, NLI and the duplicate filter were run only as the authors' ports.
• Scale (Section VIII): 100 target questions, 40 evaluation queries per cell, corpora of 21k–34k documents, against a subfield norm of 10^6–10^7; except for DRS, every fitted threshold is a quantile of ≤200 clean documents on the calibration split.
• Uncovered measurement surfaces (Section VIII): a single retriever, no reranker, no NQ length ladder, a single poisoning rate, a single trust setting; the Contriever condition, synthetic corpora, the legitimate-update benchmark (E5) and the poisoning-rate sweep (E6) were cut for compute and are named.
• Adaptive numbers are lower bounds (Section VIII): only one attacker tuned against the authors' scorer and transferred as-is to other defenses, no LLM-guided or human arm, a budget far below prior work, and no strongest learned generator.

Experimental coverage

• The subjects are ten defenses (eleven table rows, eight scoring systems) plus two single-feature reference detectors, all scored on the same candidate set (Table V).
• Four corpora and four attack families, 16 corpus×family cells in total, of which 15 poisonings were regenerated by the authors; 40 evaluation queries per cell, 5 seeds (Section IV-A, IV-B).
• The defense-aware attacker experiment is on NQ only, tuned only against the authors' own scorer, with 500 oracle queries and 60 iterations per document (Section III-C, Table XIV).
• The end-to-end attack success rate experiment (E9) uses Qwen2.5-0.5B-Instruct as the attacked generator and substring matching as the judge, runs only on the template ladder, and reports 0.150 (Section VIII, LLM Usage Considerations).
• The paper reports no judge model or human agreement (no LLM judging step); the trust and poisoning budget numbers all come from simulation, and the evaluation pipeline is reported at ε=0 throughout (Appendix A, Section III-B).

A measurement paper on the validity of RAG poisoning defense evaluations, with the conclusion "ranking is not decision."

• Problem: query-time filters are the mainstream published defense against RAG poisoning and report near-perfect detection; of the 21 published defense evaluations the authors surveyed, 8 verifiably use PoisonedRAG poisonings with the target-question prefix, and 12 do not report deployment-point false-positive rates (Table II).
• Method: profile poisoning sets with two construction quantities computable without any defense—containment and length overlap—then use a five-level payload-preserving control ladder to remove the cues one by one, measuring deployment-point miss rate, false-positive rate and AUROC on a unified candidate set across four corpora, four attack families and ten defenses.
• Result one: on NQ, merely removing the prefix added by the attack authors' own code drops RAGuard's AUROC from 0.953 to 0.758 and its deployment-point miss rate rises from 0.191 to 0.763, while 0.93 of the prefix-missing poisonings are still retrieved (Table V, IX).
• Result two: on medical, length matching with equal-length word-order-shuffled filler takes TrustRAG's set-level stage miss rate from 0.000 to 0.827 and the authors' own learned scorer from 0.000 to 0.986 (0.321 at matched 5% FPR), with AUROC staying at 0.953 and the proportion of poisonings entering the context rising from 0.00 to 0.94 (Table VII, abstract).
• Result three: collapse comes in two modes—calibration collapse (ranking usable, deployment point dead, fixable at the cost of false positives) and signal collapse (ranking falls to chance level, e.g., AUROC 0.503 on medical after both cues are removed, unfixable at the decision layer); in 12 of 26 cells the three threshold rules make bit-identical decisions (Fig. 4, Table XIII).
• Authors' conclusion: on cells flagged by the profile, any operating-point claim is unfalsifiable; AUROC counts as evidence only when reported together with the construction profile of the poisoning set and the false-positive rate at the actual deployment threshold, otherwise it states how the poisoning was written, not what the filter can stop (Section VII, IX).