RAG Retrieval Integrity & Governance

Series · 1 posts

← Back to Paper Reading

  • RAGSieve: Detecting RAG Knowledge-Poisoning Promotion with Self-Referenced Local Contrast

    Advanced
    RAG Retrieval Integrity & Governance: Part 1 , Note: Sep 17, 2026 , Paper: 2026 , Information Retrieval

    A deep read of RAGSieve: query-local and corpus-local references expose suspicious retrieval promotion without a trusted clean corpus, while the paper's boundary remains essential—promotion detection is not truth verification.

    Understand it in 90 seconds
    Problem
    RAG places external corpus content inside the evidence used for generation. An attacker who can get a small number of documents ingested through a public page, shared store, or connector may promote a chosen false answer into the top five for a target query. The hard part is that the attacked corpus is not a trusted reference, and natural semantic density varies by topic.
    Core insight
    Do not assume a separately clean dataset, and do not apply one global threshold across the corpus. RSQ performs query-local contrast between the top five and ranks 6–20 for the same query; RSG performs corpus-local contrast between each document's semantic neighbors and its own local floor. Both let the inspected system supply its own matched control.
    Strongest evidence
    Across nine dataset–retriever systems and six attacks, RSQ reaches 95.2% macro AUROC and detects 82.2% of poison at an operating point allowing at most 5% clean-document removal. RSG reaches 93.3% and 79.8%. Serial RSG plus RSQ lowers ASR from 67.4% to 14.0% while unpoisoned-retrieval F1 changes from 42.1% to 41.3% (Tables 1, 5, and 9).
    Main boundary
    These are results on synthetic attacks, three QA corpora, three dense retrievers, and a fixed evaluation protocol. They support the claim that suspicious promotion patterns can be exposed by local contrast; they do not support the claim that a flagged document is false, that a retrieved claim has been truth-verified, or that production-scale multi-tenant latency and zero-poison guarantees follow.
    Read the full deep dive

For speaking invitations, internal engineering sessions, or architecture exchange, see the topics and public work I can bring into the conversation.

Speaking & contact