Perplexity-based RAG poisoning detection is actively misleading, because poisoned answers score lower perplexity.

D-SCAN (SIGIR 2026) found the standard guardrail returns high confidence on compromised output. Their alternative signal is document-level attention dynamics: during a poisoned generation, attention concentrates on the injected document and entropy collapses, versus dispersed attention on a legitimate answer. Lightweight runtime check, code at github.com/yingtaoren/D-Scan. Works on any self-hosted stack where you can read attention weights.