TriShieldRAG introduces a three‑layered defense for Retrieval‑Augmented Generation: an Ingest Guard that screens documents, a Retrieval Scorer that re‑ranks based on trust, and a Cross‑LLM Consensus that validates evidence across three models. Against the original PoisonedRAG attack on the 2.68M‑passage Natural Questions corpus, the framework reduces attack success from about 79% to 1%. However, adaptive attacks that only alter document formatting can bypass the Ingest Guard and still achieve high success rates, revealing limits of layered defenses that rely on the same retrieved evidence.
By Susil Kumar Mohanty, Rohit Patel, Kosuru Yuvaraj, Jeenal Chaudhary, Disha Singhania
The paper evaluates CASCADE, a fully local layered defense for Model Context Protocol (MCP)-based systems, by conducting a component ablation and corpus audit on a fixed 5,000-sample dataset. It demonstrates that the choice of aggregation convention heavily influences reported metrics, that detection performance varies with provenance, and that the released configuration does not fully disclose the operating point. The study also shows that a local review model invoked for a third of requests does not alter classification outcomes, highlighting the importance of reproducibility and transparency in defense evaluations.
By \.Ipek Abas{\i}kele\c{s} Turgut, Edip G\"um\"u\c{s}
arXiv:2610.31695v1 Announce Type: cross
Abstract: Safety guards check content before an LLM application acts on it, and most paste that content into a plain-text prompt. Content that imitates the pro...
By Utkarsh Kanwat
arXiv:2608. 02678v1 Announce Type: cross Abstract: Retrieval-augmented generation (RAG) systems are vulnerable to corpus poisoning: an attacker who inserts a crafted document into the retrieval corpus can steer the underlying large language model (LLM) toward an attacker-chosen wrong answer.
By Abay Zhurekbay, Tao Liu, Fan Li
arXiv:2609.00470v1 Announce Type: new
Abstract: Retrieval-Augmented Generation (RAG) grounds large language models in external corpora, but implicit trust in retrieved documents creates a critical at...
By Muhaimin Bin Munir, Akib Jawad Ononto, Nazia Shehnaz Joynab, Bhavani Thuraisingham, Latifur Khan
arXiv:2607. 26339v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence.
By Pushkal Kumar, Tucker Nielson, Tanish Kolhe, Shubham Zala, Vincent Li
arXiv:2608. 09624v1 Announce Type: cross Abstract: Internal safety scores judge a prompt before any text is generated, and they are validated by how well they separate harmful prompts from benign ones.
By Mingyu Luo, Ming Deng, Zilang Qiu, Yiming Cheng, Ci Tao, Xue Tan, Sijin Sun, Yangfu Li, Ping Chen, Jun Dai, Xiaoyan Sun
arXiv:2607. 23838v1 Announce Type: cross Abstract: Retrieval-Augmented Generation (RAG) lets a large language model answer questions using documents retrieved from an external knowledge base at query time.
By Susil Kumar Mohanty, Rohit Patel, Kosuru Yuvaraj, Jeenal Chaudhary, Disha Singhania
arXiv:2608.21230v1 Announce Type: cross
Abstract: Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measu...
By Arulnidhi Karunanidhi
The paper investigates how the choice of feature space affects the effectiveness of label‑only backdoor detection. By keeping the test, labels, and metric constant while swapping feature spaces, the authors show that defenses can perform very differently—e.g., a nearest‑neighbor check yields AUROC 0.546 on poisoned features but 0.995 on frozen DINOv2 features. They also demonstrate that higher detection scores do not necessarily translate to safer models and that static prototype‑based audits can be bypassed by adaptive attackers.
By Arnab Dey, Mohammad Mahfuzul Islam
arXiv:2609.22818v1 Announce Type: cross
Abstract: Memory-poisoning defenses for LLM agents are typically evaluated by their ability to prevent attacks. However, the traffic they process is rarely adv...
By Pritom Bhowmik
arXiv:2610.28364v1 Announce Type: cross
Abstract: Local Retrieval-Augmented Generation (RAG) systems are vulnerable to indirect prompt injection and retrieval poisoning, where malicious instructions...
By Abhishek Rai