GuardRAG: a post-retrieval defense against retrieval-augmented generation (RAG) poisoning attacks

1. 01What problem does this paper attempt to solve?

   Defending against coordinated corpus poisoning: multiple mutually reinforcing poisoned documents enter the retrieval context, and per-document evaluation defenses struggle to cope.

   Core problem: how to defend against coordinated corpus poisoning — an attacker injects multiple poisoned documents into a RAG corpus that mutually support the same wrong answer, so that they jointly enter the retrieval context and manipulate the generated output.

   • Scenario and importance: RAG relies on large-scale or continuously updated external corpora; the authors argue that verifying the credibility of each document before retrieval is unrealistic, so poisoned evidence needs to be identified and filtered after retrieval and before generation.
   • Shortcomings of existing methods: The authors say existing defenses mostly rely on robust aggregation, reliability scoring, knowledge integration or self-reflective generation; under high-intensity coordinated poisoning, multiple poisoned documents reinforce the same misinformation and dominate the retrieved evidence, degrading conventional evidence aggregation and reliability assessment.
   • Core observation: Coordinated poisoned documents show stronger local semantic clustering in embedding space than benign evidence. The authors verify this on 900 query-level instances: in 896 cases the intra-group distance of poisoned documents is smaller than the poisoned-benign distance, and in 862 cases all retrieved poisoned documents are grouped into the same HAC cluster (Appendix B.4).
   • Proposed approach: GuardRAG, a training-free, plug-and-play post-retrieval defense framework that performs group-level structural analysis through three stages — retrieval expansion and deduplication, adaptive semantic clustering, and suspicious-cluster pruning — rather than scoring documents individually.
   • Threat model (Section 3.2, terminology copied from the paper):
     • Goal: make the system generate, for a target query q*, an answer containing a predetermined target phrase y*, where y* is usually a misinformation phrase or entity; an attack is judged successful if y* appears as a substring in the output.
     • Capability: the attacker can inject a limited budget of b poisoned passages M into corpus C, b = |M| ≪ |C|, and optimize their retrieval probability so they mutually reinforce the same wrong answer.
     • Knowledge: following the PoisonedRAG setting, the attacker cannot access the internal parameters or weights of the generator G, but can access specific user queries and the detailed parameters of the retriever R.
     • Victim system: a standard RAG system composed of corpus C, retriever R and generator G.

   Collapse this answer

2. 02What related research exists?

   Related work falls into three groups: RAG and retrieval methods, corpus poisoning attacks, and three categories of defense methods; this paper distinguishes itself from document-by-document evaluation through group-level structural analysis.

   RAG and retrieval methods

   • Lewis et al. (2020) proposed the RAG framework, consisting of two core components, a retriever and a generator.
   • Sparse retrieval is represented by TF-IDF (Salton and Buckley, 1988) and BM25 (Robertson et al., 1994), based on lexical matching.
   • Dense retrieval is based on embedding similarity, with representative methods including DPR (Karpukhin et al., 2020), ANCE (Xiong et al., 2020), and Contriever (Izacard et al., 2021).

   Corpus poisoning attacks

   • PoisonedRAG (Zou et al., 2025) shows that malicious documents injected into an external corpus can manipulate downstream generation results; this paper's threat model and PRAGB attack artifacts both come from that work.
   • Subsequent targeted poisoning attacks include POISONCRAFT (Shao et al., 2025, which improves attack effectiveness through adversarial optimization of poisoned documents), AgentPoison (Chen et al., 2024) and BadRAG (Xue et al., 2024, which combines poisoned knowledge with a backdoor trigger mechanism), CPA-RAG (Li et al., 2025), and PR-Attack (Jiao et al., 2025, which improves retrieval success rate through collaborative optimization of multiple poisoned documents).

   Defense methods (the paper divides them into three groups)

   • Evidence aggregation and evaluation: RobustRAG (Xiang et al., 2024), InstructRAG (Wei et al., 2024), ReliabilityRAG (Shen et al., 2025); the paper notes that such methods often introduce additional verification, reasoning, or token processing overhead.
   • Self-reflection and internal knowledge: ASTUTE RAG (Wang et al., 2025), TrustRAG (Zhou et al., 2025), Self-RAG (Asai et al., 2023); the paper notes that such methods generally require additional inference-time computation.
   • Learned filtering and compression: Why So Gullible? (Hong et al., 2024), RECOMP (Xu et al., 2023), Learning to Filter (Wang et al., 2023); the paper notes that such methods require auxiliary training or task-specific data.

   Baselines and benchmarks: the comparison baselines are Vanilla RAG, RobustRAG, InstructRAG, and ReliabilityRAG (Section 5.1); the evaluation benchmarks are Natural Questions, HotpotQA, and MS MARCO.

   Positioning of this paper: the authors state that GuardRAG shifts the defense perspective from document-by-document evaluation to group-level structural analysis of retrieval evidence, works after retrieval and before generation, and requires neither auxiliary model training nor additional LLM generation calls.

   Collapse this answer

3. 03How does the paper address this problem?

   GuardRAG has three stages: retrieval expansion and deduplication → adaptive-threshold HAC clustering → scoring by relevance, size, and compactness and pruning the most suspicious clusters.

   Overall approach: GuardRAG exploits the structural feature that coordinated poisoned documents cluster locally in embedding space, performing group-level filtering after retrieval and before generation, entirely training-free and without additional LLM calls. The pipeline is shown in Algorithm 1.

   Stage I: Retrieval expansion and deduplication

   • Standard RAG retrieves top-k; GuardRAG first expands to top-K, where K = mk and m > 1, providing more candidate evidence for structural analysis.
   • Near-duplicate documents are removed by embedding cosine similarity: similarity ≥ γ is treated as near-duplicate, and only the higher-ranked one is kept; in experiments γ = 0.98.
   • The deduplicated set is denoted Rq, with Nq = |Rq| ≤ K.

   Stage II: Adaptive semantic clustering

   • Queries and all candidate documents are encoded with bge-large-en-v1.5; embeddings are L2-normalized and Euclidean distance is used.
   • HAC clustering with average linkage is used; the number of clusters need not be preset, and granularity is controlled by a distance threshold.
   • The threshold is query-adaptive: for each document, the first-nearest-neighbor distance is computed, sorted, and the largest adjacent gap is found; the midpoint of that gap is taken as the preliminary threshold τ̂_q = (δ_(j^∗) + δ_(j^∗+1))/2, i.e., the midpoint of the two endpoints of the largest gap.
   • The final threshold is τ_q = τ̂_q (if τ̂_q ≤ τ_max), otherwise 0; the global upper bound τmax = 0.8 × 0.877 ≈ 0.702 is estimated from the average pairwise distance of benign documents on 300 calibration queries (non-overlapping with the main evaluation) (Appendix A.1). The authors say the adaptive threshold is used because background semantic density varies greatly across datasets, making a single static threshold hard to apply across retrieval distributions (Figure 3).

   Stage III: Suspicious-cluster scoring and pruning

   • For each cluster, suspiciousness is computed from three aspects: query relevance ri = cos(q, µi), cluster size si = log(|Ci|+1), and semantic compactness ci = 1/(σi+ϵ), where µi is the cluster centroid and σi is the average intra-cluster distance.
   • The final suspiciousness is the product of the three, favoring clusters that simultaneously have high query relevance, large size and semantic compactness.
   • Pruning is applied only to clusters with |Ci| ≥ 3 (the same minimum cluster size is used in all experiments), removing the most suspicious cluster; if no cluster meets the condition, all documents are kept.

   Success criterion and evaluation method

   • Attack success follows the PoisonedRAG protocol: success if the generated answer contains the attacker-specified target phrase y* (substring match).
   • Defense-side metrics: PDFR (proportion of retrieved poisoned documents removed), CFR (proportion of benign documents wrongly removed), ACC (proportion of answers containing the correct answer substring).
   • The generation stage uses the prompt template in Appendix E, passing the filtered documents together with the question to the generator.

   Collapse this answer

4. 04What experiments did the paper conduct?

   Three datasets, three attacks, six generators: average ASR under adv5 is 0.8%–16.2%; under white-box adaptive attacks ASR rises to 23.0%.

   Experimental setup

   • Generators tested (6): GPT-3.5, GPT-4o, GPT-5, DeepSeek-V3.2, Llama-2-7B, Llama-2-13B; retrievers are Contriever, Contriever-ms, ANCE; the embedding encoder is bge-large-en-v1.5.
   • Datasets: NQ (corpus of 2,681,468 documents), HotpotQA (5,233,329 documents), MS MARCO (8,841,823 documents); the main experiments randomly sample 100 queries from each dataset (Appendix B.1).
   • Attacks: PRAGB (target-specific passages released by PoisonedRAG), PRAGW (generated by PoisonedRAG white-box optimization, 5 per query), POISONCRAFT (generated per its public protocol, 5 per query); poisoning strength adv3/advk means there are k poisoned documents in the retrieval context.
   • Metrics: ASR (proportion of answers containing the attacker-specified wrong-answer substring, computed over all evaluated queries), PDFR, CFR, ACC (proportion containing the correct-answer substring); adaptive attacks use RSR@10 (proportion of attempted queries where at least 3 poisoned documents enter the top-10 candidates).
   • Default setting and number of repetitions: default HotpotQA + Contriever + Llama-2-13B; standard retrieval k = 5, GuardRAG expansion m = 2, K = 10, and all methods in Table 2 use the same top-10 candidate pool; each setting is run independently 3 times and the arithmetic mean is taken.
   • Baselines: Vanilla RAG, RobustRAG, InstructRAG, ReliabilityRAG.

   Main results

   Core numbers from Table 1 (adv5, GuardRAG, average over six generators) and Table 2 (PRAGB, comparison with baselines):

   Swipe horizontally to read the table

   Attack	Dataset	Average ASR↓	Average PDFR↑	Average ACC↑	Average CFR↓
   PRAGB	HotpotQA	4.0	100.0	87.5	3.0
   PRAGB	NQ	0.8	100.0	88.0	6.0
   PRAGB	MS MARCO	8.0	95.0	85.5	10.0
   PRAGW	HotpotQA	6.0	99.0	89.0	1.0
   POISONCRAFT	HotpotQA	2.2	99.0	94.7	0.0
   POISONCRAFT	MS MARCO	2.7	99.0	94.8	1.0

   Per Table 1 (units %); the average ASR of PRAGW on NQ and MS MARCO and of POISONCRAFT on NQ is 5.7, 16.2, and 4.5, respectively.

   Table 2 (PRAGB, adv5, ASR/ACC, units %):

   Swipe horizontally to read the table

   Model	Defense	HotpotQA	NQ	MS MARCO
   GPT-4o	Vanilla	30.0 / 73.0	40.0 / 63.0	23.0 / 70.0
   GPT-4o	InstructRAG	87.0 / 14.0	78.0 / 24.0	87.0 / 15.0
   GPT-4o	ReliabilityRAG	46.0 / 54.0	37.0 / 65.0	40.0 / 60.0
   GPT-4o	GuardRAG	8.0 / 84.0	0.0 / 86.0	2.0 / 88.0
   Llama-2-13B	Vanilla	77.0 / 30.0	80.0 / 27.0	87.0 / 23.0
   Llama-2-13B	RobustRAG	62.0 / 38.0	76.0 / 34.0	72.0 / 30.0
   Llama-2-13B	GuardRAG	6.0 / 88.0	2.0 / 86.0	8.0 / 80.0

   Per Table 2; the rows for RobustRAG (GPT-4o) and InstructRAG and ReliabilityRAG (Llama-2-13B) are omitted; in Table 2, GuardRAG has the lowest ASR in almost all settings.

   • The authors state that GuardRAG consistently maintains low ASR across different attacks, with PDFR reaching 100% on HotpotQA and NQ under PRAGB and CFR at most 10%.
   • The authors note that when poisoning strength rises from adv3 to adv5, some baselines degrade: on HotpotQA + GPT-4o, InstructRAG's ASR rises from 27.0% to 87.0% and ReliabilityRAG's from 16.0% to 46.0%, whereas GuardRAG is below 10.0% at both strengths.
   • Under adv5, Vanilla RAG's ASR with Llama-2-13B is higher than with GPT-4o on all three datasets.

   Adaptive attack stress test

   • Setup: 3+2 diversification splits the 5 poisoned passages into two semantic groups; the GuardRAG-aware white-box attack generates 15 candidates and uses defense feedback and beam search to select 5 to reduce semantic clustering (Appendix A.3).
   • Results (Table 3): under diversification, ASR drops from 76.0% (Vanilla) to 6.0% and PDFR is 99.0%; under the white-box attack, ASR drops from 77.0% to 23.0%, PDFR is 72.0%, and RSR@10 is 93.0%.
   • Authors' interpretation: defense-aware optimization weakens the structural signal that pruning relies on; the residual white-box ASR indicates that dispersed poisoning evidence is harder to isolate through cluster-level filtering, which the authors explicitly call a limitation.

   Clean retrieval and semantic overlap stress test

   • Setup (Table 5): Clean-original (original clean retrieval), Clean-duplicate (adding near-identical copies of correct passages), Clean-paraphrase (semantically similar non-duplicate variants).
   • Results: ACC is 90.0% in the first two settings; Clean-duplicate has CFR 27.2% (on average 2.22 near-duplicates removed per query) but ACC unchanged; under Clean-paraphrase, ACC drops to 72.0% and CFR is 35.6%, with on average 3.56 removed by cluster pruning per query.
   • Authors' interpretation: paraphrased benign evidence can evade deduplication and form compact clusters; the authors state that highly relevant non-duplicate benign evidence is a boundary case.

   Other ablations and analyses

   • Ablation (Table 4, HotpotQA, Contriever, Llama-2-13B, adv3): expanding depth to 10 alone gives ASR 74.0% and ACC 26.0%; Stages II–III@5 gives ASR 8.0%, PDFR 98.0%, ACC 60.0%; full GuardRAG@10 gives ASR 3.0%, PDFR 100.0%, CFR 3.0%, ACC 86.0%.
   • Clustering method comparison (Figures 5, 6): HAC achieves PDFR of 100%, 100%, and 95% on the three datasets, with CFR of 3%, 6%, and 10%; Mean Shift has lower PDFR, AP reaches CFR 48% on MS MARCO, and DBSCAN has CFR 10% on MS MARCO.
   • Fixed vs adaptive threshold (Table 8, adv5): with fixed τ = 0.4, PDFR is as low as 54.0%/48.0%/18.0% (three datasets); with τ = 0.6, CFR reaches 24.0% on MS MARCO; adaptive τq gives PDFR 100.0%/100.0%/95.0% and CFR 3.0%/6.0%/10.0%.
   • Efficiency (Table 7, two RTX 4090s): GuardRAG takes 7.715 seconds and 407.7 LLM tokens per query; the highest among the baselines is about 4.9 times its tokens; the authors state that the defense itself requires no LLM calls.
   • Structural statistics (Table 9): among 900 query-level instances, 896 have ρ < 1, in 862 instances all poisoned documents are assigned to a single HAC cluster, and the largest poison cluster covers on average 98.4% of the retrieved poisoned documents; PRAGW clusters relatively weakly on MS MARCO (Unified Rate 82.0%).

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors note two limitations: weak structural signal when there are few poisoned documents, and easy wrongful pruning of highly relevant benign documents; under white-box adaptive attacks ASR is still 23.0%.

   Limitations and future directions noted by the authors

   • Structural patterns too weak with few poisoned documents (Limitations section): efficacy depends on identifiable structural patterns among retrieved documents; when only a few poisoned documents are retrieved, these patterns may be too weak for reliable cluster-level defense.
   • Highly relevant benign documents may be wrongly pruned (Limitations section): such documents may exhibit structural features similar to collaborative poisoning evidence, increasing the risk of wrongful pruning; the authors state that distinguishing malicious collaboration from legitimate semantic consistency is an important direction for future work.
   • Residual ASR under white-box adaptive attacks (Section 5.3): the authors state that the residual 23.0% ASR under GuardRAG-aware white-box attacks highlights a limitation—dispersed poisoning evidence is harder to isolate through cluster-level filtering.
   • Semantically overlapping benign evidence is a boundary case (Section 5.3, at the Clean-paraphrase results): the authors state that highly relevant non-duplicate benign evidence constitutes a boundary case (under this setting ACC 72.0%, CFR 35.6%).

   Scope of experiments

   • The generators tested are GPT-3.5, GPT-4o, GPT-5, DeepSeek-V3.2, Llama-2-7B, and Llama-2-13B, 6 in total; the retrievers are Contriever, Contriever-ms, and ANCE, 3 in total (Section 5.1).
   • The datasets are NQ, HotpotQA, and MS MARCO; the main experiments randomly sample 100 queries from each dataset, and each setting is run independently 3 times and averaged (Section 5.1, Appendix B.1).
   • The attacks cover three types, PRAGB, PRAGW, and POISONCRAFT, with poisoning strengths adv3 and adv5, plus two adaptive attacks, 3+2 diversification and GuardRAG-aware white-box (Sections 5.1, 5.3).
   • Baseline defense evaluation includes Vanilla RAG, RobustRAG, InstructRAG, and ReliabilityRAG, with comparisons conducted under the PRAGB attack and the same top-10 candidate pool (Section 5.1, Table 2).
   • Attack success and answer correctness are both judged by substring matching; the paper does not report human evaluation or LLM judging or their agreement (Sections 3.2, 5.1).

   Collapse this answer

6. 06Summarize the main content of the paper

   GuardRAG: a training-free post-retrieval defense that exploits the semantic clustering of poisoned documents, achieving low ASR while preserving clean utility, but white-box adaptive attacks can weaken its structural signal.

   GuardRAG is a training-free, plug-and-play post-retrieval defense against RAG corpus poisoning attacks, targeting the scenario where an attacker injects multiple mutually reinforcing poisoned documents to manipulate the results generated for a target query (the threat model follows PoisonedRAG: the attacker does not know the generator parameters but can access user queries and retriever parameters).

   • Core observation: collaboratively poisoned documents exhibit stronger local semantic clustering in embedding space than benign evidence—among 900 query-level instances, 896 had within-poison-group distances smaller than poison-benign distances, and in 862 instances all poisoned documents fell into the same HAC cluster (Appendix B.4).
   • Method: a three-stage pipeline—retrieval is expanded from top-5 to top-10 and near-duplicates are removed with γ = 0.98; average-linkage HAC clustering with a query-adaptive threshold (the threshold is taken as the midpoint of the largest adjacent gap in first-nearest-neighbor distances, with an upper bound τmax ≈ 0.702); clusters are scored by the product of query relevance, cluster size, and semantic compactness, and the most suspicious cluster among those with |Ci| ≥ 3 is pruned.
   • Main results: under adv5, across three attacks and six generators, the average ASR is 0.8%–16.2%; under PRAGB, PDFR on HotpotQA and NQ reaches 100%, with CFR at most 10% (Table 1); under PRAGB and adv5, GuardRAG's ASR on GPT-4o and Llama-2-13B is no more than 8.0%, lower than Vanilla RAG and the three baselines (Table 2).
   • Ablation: at the same depth of 10, retrieval expansion alone gives ASR 74.0%; adding cluster pruning lowers it to 3.0% and raises ACC to 86.0% (Table 4); the adaptive threshold achieves the highest PDFR on all three datasets with CFR lower than fixed τ = 0.6 (Table 8).
   • Boundaries: under GuardRAG-aware white-box adaptive attacks, ASR is still 23.0% and PDFR drops to 72.0% (Table 3); under semantically overlapping benign evidence (Clean-paraphrase), ACC drops to 72.0% and CFR is 35.6% (Table 5).
   • Authors' conclusion: the authors state that group-level evidence structure analysis can reduce poisoning success rate and preserve answer utility under clean retrieval without adding LLM calls at defense time; they also note two limitations—weak structural signal when there are few poisoned documents, and easy wrongful pruning of highly relevant benign documents—and leave distinguishing malicious collaboration from legitimate semantic consistency for future work.

   Collapse this answer

Related papers