GuardRAG cuts poisoning attack success while preserving answer quality in RAG
The claim
GuardRAG substantially reduces attack success rates without harming clean answer utility
Published as: “GuardRAG: A Post-Retrieval Defense against Poisoning Attacks in Retrieval-Augmented Generation”
So what
GuardRAG can be added to existing RAG pipelines to markedly improve resistance to coordinated poisoning without extra model training or inference cost.
The five-minute version
GuardRAG dramatically cuts attack success rates of coordinated corpus poisoning in Retrieval-Augmented Generation, achieving average ASR as low as 4% on HotpotQA, 0.8% on Natural Questions, and 8% on MS MARCO, while keeping answer accuracy above 85%. It works by expanding the retrieved candidate set, deduplicating, then clustering documents with a query-adaptive HAC threshold and pruning suspicious clusters based on relevance, size, and semantic compactness. The evidence comes from experiments on three public QA benchmarks, three dense retrievers, six LLM generators, and three poisoning attacks, compared against four prior defenses, showing consistent low ASR (<10%) and high PDFR (≥95%). However, a white-box adaptive attack still leaves 23% ASR, indicating the defense can be weakened when attackers disperse poisoned content.
What they found 3
- GuardRAG consistently achieves low attack success rates across attacks and datasets.
“GuardRAG consistently achieves low ASR under different attack settings. For example, under PRAGB, the average ASR is 4.0% on HotpotQA, 0.8% on NQ, and 8.0% on MS MARCO.”
- Even against a white-box adaptive attack, GuardRAG reduces ASR substantially compared to no defense.
“GuardRAG reduces ASR from 76.0% to 6.0% under diversification and from 77.0% to 23.0% under the white-box attack.”
- The clean filtering rate stays low, indicating most benign evidence is preserved.
“the CFR remains consistently low across the evaluated attack settings (at most 10%)”
What undercuts it the paper’s own results
- Under a GuardRAG-aware white-box attack, ASR remains at 23%, showing the defense is less effective when poisoned documents are deliberately diversified.
- When only a few poisoned documents are retrieved, the structural signal may be too weak for reliable cluster-level defense.
Stated limits 2
- First, its efficacy depends on identifiable structural patterns in retrieved documents; when only a small number of poisoned documents are retrieved, such patterns may become too weak for reliable clusterlevel defense.
- Second, highly correlated benign documents may exhibit structural characteristics similar to coordinated poisoned evidence, increasing the risk of erroneous pruning.
What’s new here 4
- Detects coordinated poisoning by clustering retrieved documents rather than scoring each passage individually.
- Operates without any additional training or fine-tuning, making it a plug-and-play post-retrieval filter.
- Combines retrieval expansion, near-duplicate removal, and adaptive semantic clustering to expose structural patterns of malicious evidence.
- Provides a lightweight defense that does not require extra LLM calls during inference.
Artifacts & methods 6
- GuardRAGsystem
- Hierarchical Agglomerative Clustering (HAC)
- Retrieval expansion and deduplication
- Natural Questions, HotpotQA, MS MARCOdataset
- PRAGB, PRAGW, POISONCRAFT attacks
- Vanilla RAG, RobustRAG, InstructRAG, ReliabilityRAG