A new defense against RAG poisoning skips trust in the language model's own judgment and instead checks the geometry of its internal representations.
The system, called RAGSentinel, is training-free, label-free, and designed to work on black-box retrieval-augmented generation setups. It uses a surrogate encoder to measure how each retrieved document shifts the model's hidden states relative to the query, strips out directions shared just because documents cover the same topic, and flags whatever is left over as an outlier if it breaks from the majority consensus. The researchers say that under an "honest-majority" assumption - most retrieved documents are legitimate - and a separation condition on the representations, the method provably recovers a poison-free set of documents. They tested it across three question-answering datasets, three LLM families, and multiple poisoning attack types, including adaptive attackers who know the full defense pipeline.
RAG's rise as the default way to keep LLMs grounded in current facts also opened a new attack surface: anyone who can write to a knowledge base can try to hijack the answers pulled from it. Earlier post-retrieval defenses checked whether the model still followed instructions or matched its own parametric knowledge, both signals an adaptive attacker can learn to spoof. Working on internal geometry instead of surface text is a harder target to fake.
That said, the "honest majority" assumption doing the proving here is also the assumption most likely to break in the wild - a knowledge base padded with enough poisoned documents by a persistent attacker stops being a majority of honest ones.