Cordon-MAS: RAG Systems Can Detect Poisoned Documents But Still Act on Them
arXiv·high signal
Researchers demonstrate a critical 'monitoring-control gap' in RAG systems: models can detect contradictions in retrieved evidence yet still generate outputs based on poisoned claims. They introduce the Cordon Principle — no agent capable of detecting a threat should also be the agent acting on the threatened data — and implement it via information-flow control in a multi-agent architecture that defends against Confundo-style poisoning attacks.