RAGSieve Detects RAG Knowledge Poisoning at 95.2% AUROC Using the Corpus as Its Own Reference

arXiv 2608.13010·high signalXBlueskyLinkedInCopy link

RAGSieve drops the requirement for a trusted reference corpus or attack-specific artifacts: RAGSieve-Query scores the top-five retrieval candidates against ranks 6–20 of the same query to detect answer-anchor concentration, while RAGSieve-Graph compares each document to its semantically similar but lexically distinct neighbors to spot coordinated density before any query arrives. Across three QA datasets and six poisoning constructions, RSQ hits 95.2% AUROC and catches 82.2% of poison at 5% clean-document removal versus 81.1%/52.5% for GMTP; RSG reaches 93.3%/79.8% versus 79.4%/37.6% for CleanBase. Deployed jointly, attack success drops from 67.4% to 14.0% while retaining 41.3% F1 on unpoisoned retrieval. Code at github.com/XrazyMee/RAGSieve.