arXiv cs.CL· Pushkal Kumar, Arvin Sahaym·· 12 小时前AI 评分47
排名不等于决策：查询时 RAG 投毒防御中的基准捷径与工作点崩塌
Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses
AI 导读
研究发现，查询时 RAG 投毒防御在基准上的近乎完美检测率主要由投毒集的构造方式决定，而非过滤器实际读取的内容。仅删除 PoisonedRAG 代码中前置的目标问题前缀，RAGuard 的 AUROC 就从 0.953 降至 0.758，漏检率从 0.191 升至 0.763。作者指出检测结果必须同时报告投毒集构造特征与实际部署阈值下的假阳性率，并开源了计算该特征的脚本。
正文
Abstract:Query-time filters that screen each retrieved document before it reaches the generator are the dominant published defense against retrieval-augmented generation poisoning, and they report near-perfect detection on domain benchmarks. We show that this performance is predicted by how the poison set was built rather than by what the filter reads: removing a single construction cue destroys the deployed decision before it destroys the ranking. Two label-free statistics of a poison set and its clean corpus profile the cue: containment, how often the target question appears verbatim in the poison, and length overlap. PoisonedRAG's released code prepends the target question to every inserted passage. Of the 21 published defense evaluations we survey, 8 verifiably run poison built this way and 5 substitute a length cue; separately, 12 report no false-positive rate at the operating point they deploy. Deleting only that prefix from the attack authors' own passages (0.93 still retrieved for their target) takes RAGuard, a published content filter we re-implement, from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763. Across four corpora, four attack families and ten per-document defenses on one shared candidate set, the profile predicts where detection saturates. Padding medical poison to clean length with word-shuffled filler that carries no content takes TrustRAG's set-level stage from a miss rate of 0.000 to 0.827, and one learned scorer of ours from 0.000 to 0.986 (0.321 at a matched 5% false-positive rate) while its AUROC holds at 0.953. The ranking survives; the decision does not. A defense-aware attacker defeats our own scorer, so we claim no defense. A detection result is evidence only when it is reported with its poison set's construction profile and the false-positive rate at the threshold actually deployed; we release the script that computes the profile.
| Comments: | 26 pages, 7 figures, 14 tables |
| Subjects: | Cryptography and Security (cs.CR); Computation and Language (cs.CL); Machine Learning (cs.LG) |
| Cite as: | arXiv:2610.33849 [cs.CR] |
| (or arXiv:2610.33849v1 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2610.33849 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Pushkal Kumar [view email]
[v1]
Sat, 24 Oct 2026 18:40:31 UTC (173 KB)
来源：arXiv cs.CL · arxiv.org