RAGSieve通过自参考对比检测检索增强生成中的知识投毒，无需可信数据源。
RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
- 用自身检索结果做参照，构建查询局部和语料局部的对比机制。
- 在三个数据集上检测准确率达95.2% AUROC，仅移除5%正常文档即可拦截82.2%投毒。
- 适合防御无标签、无可信数据的投毒攻击，适用于实际部署场景。
检索增强生成将外部语料视为推理证据，使得注入文档可支持攻击者指定的主张。现有检测方法依赖可信参考、特定攻击特征或对语料拓扑敏感的全局阈值。我们提出RAGSieve，一种自参考检测框架，其参考来自待检系统本身。RAGSieve-Query（RSQ）执行查询局部对比，将前五名候选与同一检索中第6至第20名的排名进行对比，以检测答案锚点集中和载体转移。RAGSieve-Graph（RSG）执行语料局部对比，比较每篇文档与其语义相似但词汇不同的邻近文档与本地基线，以检测查询前的协同密度。在三个QA数据集和六种投毒构造下，RSQ实现95.2% AUROC，仅移除5%干净文档即检测到82.2%投毒，优于GMTP的81.1%/52.5%。RSG实现93.3%/79.8%，优于CleanBase的79.4%/37.6%。联合部署使攻击成功率从67.4%降至14.0%，同时保持41.3%的未中毒检索F1，证明了在无需投毒标签或可信语料的情况下，于语料摄入和查询阶段均具备实用防护能力。源代码见https://github.com/XrazyMee/RAGSieve。
原文摘要 · Abstract (English)
Retrieval-augmented generation treats an external corpus as inference evidence, allowing injected documents to promote attacker-chosen claims. Existing detectors depend on trusted references, specific attack artifacts, or global thresholds sensitive to corpus topology. We present RAGSieve, a self-referenced detection framework that constructs its reference from the inspected system. RAGSieve-Query (RSQ) performs query-local contrast, scoring top-five candidates against ranks 6-20 of the same retrieval to detect answer-anchor concentration and carrier transitions. RAGSieve-Graph (RSG) performs corpus-local contrast, comparing each document's semantically similar but lexically distinct neighbors with its local baseline to detect coordinated density before queries arrive. Across three QA datasets and six poisoning constructions, RSQ achieves 95.2% AUROC and detects 82.2% of poison at 5% clean-document removal, versus 81.1%/52.5% for GMTP. RSG achieves 93.3%/79.8%, versus 79.4%/37.6% for CleanBase. Joint deployment reduces attack success from 67.4% to 14.0% while retaining 41.3% F1 on unpoisoned retrieval, demonstrating practical protection at both corpus ingestion and query time without poison labels or trusted corpora. Source code is available at https://github.com/XrazyMee/RAGSieve.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。