RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation

TL;DR - RAGSieve detects poisoned knowledge in retrieval-augmented generation using local comparisons within the inspected system, requiring neither trusted corpora nor poison labels. Its query-time and corpus-ingestion defenses jointly cut attack success from 67.4% to 14.0%.

• RSQ contrasts the top five retrieval results with ranks 6–20 to identify suspicious answer-anchor concentration and carrier transitions.
• RSG compares documents with semantically similar but lexically distinct neighbors to detect coordinated poisoning before query time.
• RSQ and RSG achieve 95.2% and 93.3% AUROC, respectively, outperforming the cited GMTP and CleanBase baselines.
• The combined defense retains 41.3% F1 on unpoisoned retrieval.