The Flow has not summarised this story yet — read it at arXiv Computation and Language.
arXiv:2608.21230v1 Announce Type: cross Abstract: Persistent memory makes false information durable: once a false statement is stored, it can be retrieved into future sessions that match it. We measu...
arXiv:2609.00470v1 Announce Type: new Abstract: Retrieval-Augmented Generation (RAG) grounds large language models in external corpora, but implicit trust in retrieved documents creates a critical at...
The paper surveys 118 retrieval‑augmented generation (RAG) defense studies, categorizing them by the specific protection endpoint rather than the claimed goal or mechanism. It introduces a seven‑family taxonomy covering content disclosure, privacy proxies, access control, corpus‑use detection, and pipeline integrity, and reports high inter‑annotator agreement (kappa = 0.867). The survey highlights gaps: most studies target non‑primary endpoints, rely on generic QA datasets and non‑adaptive attacks, and fail to prevent private‑fact recovery even when verbatim copying is blocked.
TriShieldRAG introduces a three‑layered defense for Retrieval‑Augmented Generation: an Ingest Guard that screens documents, a Retrieval Scorer that re‑ranks based on trust, and a Cross‑LLM Consensus that validates evidence across three models. Against the original PoisonedRAG attack on the 2.68M‑passage Natural Questions corpus, the framework reduces attack success from about 79% to 1%. However, adaptive attacks that only alter document formatting can bypass the Ingest Guard and still achieve high success rates, revealing limits of layered defenses that rely on the same retrieved evidence.
The paper introduces Trustworthy RAG, an evaluation agent designed to detect misinformation and knowledge poisoning in Retrieval-Augmented Generation systems. It combines natural language inference verification, a five-signal poison detector, and a weighted Trust Index to assess the reliability of retrieved content. Experiments on multiple LLMs show high accuracy and precision, with the agent effectively blocking unsafe advice in a secure-coding assistant scenario.
The paper introduces MONOLOGUE, a single‑document poisoning framework that uses logic hijacking to subtly alter Retrieval‑Augmented Generation (RAG) outputs without overt contradictions. Instead of directly refuting facts, MONOLOGUE frames updates as authoritative historical corrections, embedding counterfactuals into a grounded narrative. The method refines payloads offline through local multi‑dimensional gated optimization, combining text quality audits with surrogate behavioral verification, and demonstrates superior attack efficacy across multiple benchmarks, retrieval backends, and open‑weight generators.