A new defense for retrieval-augmented generation (RAG) recorded a much lower rate of attacker-chosen wrong answers when retrieved documents were poisoned. In one test, the attack success rate was 3% with RAGSentinel, compared with 38% for Vanilla RAG and 6% for RobustRAG.
That result came with a matching utility figure in a no-attack setting. On MS-MARCO with Mistral-7B, RAGSentinel's ACC was 82%, the same as Vanilla RAG. ACC is the study's measure of utility on benign queries; ASR is the fraction of queries that produced the attacker's target wrong answer. The work is an arXiv version 1 paper dated Aug. 25, 2026.
How the filter works
RAGSentinel is designed to operate after retrieval and before the final model call. It is training-free and label-free: a surrogate encoder scores how far each document departs from a robust majority consensus built with a geometric median, a way of locating a central consensus among the document representations. The system applies a query-adaptive radius to make the filtering decision, then makes one final black-box LLM call alongside exactly k+1 surrogate forward passes.
The evaluation used three open-domain question-answering benchmarks: Natural Questions (NQ), HotpotQA and MS-MARCO, with 100 randomly sampled queries from each.
Results across attack types
Across two additional attack types, labeled PIA and AD, RAGSentinel's ASR was at most 11% across the evaluated models and datasets. InstructRAG and CrAM frequently exceeded 30% in the same broad comparison.
The filter also faced a mixed setting in which two attacks were active at once and one poisoned document came from each. Its ASR stayed below 12%, while Vanilla RAG and CrAM reached 80% and 86%, respectively, on HotpotQA with Mistral-7B under PoisonedRAG+AD.
Document-level results were similarly high in the cited examples. With Mistral-7B on NQ under PoisonedRAG, document-filtering accuracy was 94.1%, with a 6% false-positive rate and 5% false-negative rate. On HotpotQA under AD, the corresponding figures were 98.1%, 1% and 10%.
The promise has a boundary
The reported performance had a clear boundary. When the tested context contained up to two poisoned documents, ASR stayed below 14% and ACC above 56%. With five poisoned documents, NQ ACC fell to 31%, near the paper's reported majority threshold of at least four.
Under adaptive attacks, the reported margin narrowed. On HotpotQA, ASR rose from 8% under standard PoisonedRAG to 11% under the adaptive version, and the paper reports that RAGSentinel remained the strongest method across its tested settings and attacks.
A conditional guarantee
Those numbers should not be read as an unconditional guarantee. Theorem 1 applies only when the retrieved set has an honest majority and poisoned and benign documents are sufficiently separated in the surrogate representation. Under those conditions, it says the trusted context contains no poisoned documents, has exactly ceil(k/2) selected documents, and is a subset of the benign documents. The paper does not claim that every factually wrong document will be separated in that representation space.
The authors explicitly leave open a stronger attacker that can query the surrogate encoder directly. The reported performance also deteriorated as the poisoned share approached or exceeded the honest-majority regime, with higher poison ratios left for future work. Because the evaluation used sampled benchmark queries, these figures describe the tested settings rather than an unconditional result for every RAG system.
Processing cost and design choices
The reported processing averages were 0.99, 1.16 and 0.85 seconds per query on NQ, HotpotQA and MS-MARCO, respectively, compared with 0.49, 0.49 and 0.48 seconds for Vanilla RAG. The paper reports that RAGSentinel was three times faster than RobustRAG and twice as fast as AstuteRAG.
Component comparisons linked every part of the pipeline to a positive reported contribution. Replacing the geometric median with an arithmetic mean was associated with the largest ASR increase, while removing topic-direction removal, active-subspace selection, adaptive norm clipping or the adaptive radius was associated with worse ASR. The authors present the combined approach as a black-box-compatible defense, but its evidence remains conditional on the stated assumptions and benchmark scope.
Paper data and sources
Original title: RAGSentinel: Certifiable Geometric Consensus for Robust Retrieval-Augmented Generation
Authors: Yueyang Quan, Anjun Gao, Yufei Xia et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-25
DOI: Not available
Original paper · Full text