Pith. sign in

REVIEW 5 major objections 7 minor 40 references

TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

T0 review · 5 major / 7 minor · reviewed 2026-07-30 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Three independent checks cut RAG knowledge-poisoning success from about 91% to about 13% against a standard non-adaptive attacker.

desk verdict Honest defense-in-depth blueprint whose 91%→13% number is mostly Ring 1 catching a template it was written to catch, not evidence that the three rings work together. read the letter →

arxiv 2607.23838 v1 pith:NEMO4RG4 submitted 2026-07-26 cs.CR cs.AIcs.CLcs.LG

Susil Kumar Mohanty , Rohit Patel , Kosuru Yuvaraj , Jeenal Chaudhary , Disha Singhania This is my paper
classification cs.CRcs.AIcs.CLcs.LG
keywords Retrieval-AugmentedGenerationdatapoisoningknowledgecorruptionLLMsecuritydefense-in-depthcorpusmulti-LLMconsensusprovenancetrustscoring
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Retrieval-augmented generation answers questions from documents pulled at query time, so a few adversarial writes into a shared knowledge base can steer the model to a chosen wrong answer. Prior single-stage defenses left attack success at 30% or higher because an attacker only had to beat one checkpoint. TriShieldRAG places three independent rings—ingest screening for lexical and statistical poison signatures, trust re-ranking of the retrieved set by provenance and consistency, and a three-model consensus vote with one bounded re-retrieval on disagreement—so poison must defeat all three at once. Against the non-adaptive PoisonedRAG-style attacker with five poison documents per target on a 5,000-document Wikipedia base and ten questions, the full pipeline drops attack success from roughly 91% to roughly 13% while keeping accuracy on clean queries. The authors derive that the later rings work only while poison stays a minority of the retrieved set and provenance tags are not spoofed, and they report that their single evaluation setup is consistent with that analysis.

What carries the argument

TriShieldRAG’s three rings: Ring 1 scores each document on perplexity/burstiness, pattern flags, and embedding outlier status and blocks above a fixed threshold; Ring 2 re-ranks survivors by a weighted trust score (provenance, inter-document consistency, retrieval relevance); Ring 3 polls three architecturally diverse LLMs and allows one bounded re-retrieval if they disagree. The load-bearing analysis is the minority-poison assumption: Rings 2 and 3 recover the true answer only while poison remains a minority of the retrieved top-k.

What would settle it

Run a controlled sweep of poison fraction ρ in the retrieved top-k across the 0.5 boundary (and a provenance-spoofing condition): if Rings 2 and 3 still recover the correct answer when poison is a majority, or fail when it is clearly a minority under the stated setup, the central recovery claim is settled against the paper’s own analysis.

Watch

Extended reading notes

Core claim

A three-ring defense-in-depth pipeline—Ingest Guard, Retrieval Scorer, and Cross-LLM Consensus—reduces attack success rate from roughly 91% to roughly 13% against the non-adaptive PoisonedRAG attacker (five crafted documents per target) on a 5,000-document Wikipedia knowledge base with ten target questions, while preserving benign-query accuracy, closing much of the residual gap left by single-stage defenses.

Load-bearing premise

Rings 2 and 3 only work while poisoned documents stay a minority of what the retriever returns and attackers cannot fake trusted source tags; the paper has not yet swept poison fraction across that boundary to confirm it.

Editorial extensions

If this is right

  • Layered checks at ingest, retrieval, and generation can cut residual poison success well below what any one of perplexity filtering, paraphrasing, or knowledge-base expansion achieved alone.
  • Production RAG on open or multi-writer corpora can treat individual-document ingest screening as the primary non-adaptive filter, with trust re-ranking and multi-model vote as recovery layers.
  • If poison ever dominates the retrieved window, majority-style consistency and voting will reinforce the wrong answer rather than correct it, so bounding poison share at retrieval becomes a design requirement.
  • A heterogeneous multi-vendor LLM panel can catch poison that misleads one model but not others, at the cost of extra latency and calls unless gated to uncertain queries.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Single-document poison attacks, which keep ρ low by construction, are a natural next test of whether the minority-poison regime is the realistic operating point rather than the five-document saturation case.
  • Cryptographic or signed provenance would convert Ring 2’s provenance weight from a soft signal into a hard suppressant independent of ρ, addressing the spoofing hole the paper already names.
  • Scaling the same rings to multi-million-document indexes with approximate nearest-neighbor search will change the effective ρ the later rings see whenever recall drops legitimate neighbors, so security claims and index recall must be measured together.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The manuscript proposes TriShieldRAG, a three-stage defense against PoisonedRAG-style knowledge-corruption attacks on retrieval-augmented generation: (Ring 1) an ingest-time guard combining a lexical-diversity "perplexity" heuristic, a pattern score for verbatim-question/boilerplate triggers, and an embedding-outlier score; (Ring 2) a provenance/consistency/relevance-weighted trust re-ranker; (Ring 3) a three-vendor LLM panel with a 2-of-3 agreement threshold and one bounded re-retrieval. The authors formalize each ring with fixed thresholds, derive a minority-poison precondition (Proposition 1) under which Rings 2–3 can work, release a reference implementation and harness, and evaluate against the non-adaptive PoisonedRAG template over a 5,000-document Wikipedia corpus with 10 target questions, reporting ASR reduction from ≈91% to ≈13%. The paper is unusually candid about its own gaps: no adaptive-attacker evaluation, no ρ sweep, no per-ring ablation, and an explicitly "illustrative" baseline row.

Significance. If the three-ring claim were empirically supported, the work would be a useful contribution: the rings are specified as explicit algorithms with fixed constants rather than tuned-to-result knobs, the failure boundary of the aggregation rings is stated as a formal precondition rather than assumed away, and the code, per-query trace entry point, and target-question list are released for reproduction. The honest treatment of scope (§X) is commendable and rare in this subfield. However, as shown below, the single reported experiment cannot and does not support the defense-in-depth claim: the evaluated configuration sits in the regime where the paper's own Proposition 1 predicts Rings 2 and 3 fail, and the measured improvement is attributable entirely to Ring 1 filtering a template whose two defining features are exactly the features Ring 1's pattern score was written to detect. The current evidence therefore supports at most a single-ring result against a non-adaptive attacker at small scale. The contribution is real but presently narrower than the framing claims.

major comments (5)
  1. [§IX, Table VI, Fig. 6, Prop. 1 (§VI)] The headline result does not support the central architectural claim. With np=5 poison documents against k=5 retrieval and a verbatim-question trigger engineered to out-rank clean documents, the retrieved top-5 is plausibly all or mostly poison (ρ≈0.8–1.0). Per §VI and Proposition 1, in this regime the majority token bag µ is poison-dominated, Ring 2's consistency score c(d) favors poison, and Ring 3's panel can unanimously agree on the wrong answer with no disagreement to trigger re-retrieval. Fig. 6 confirms the actual recovery path: 'Ring 1 blocks poison → fallback re-retrieval recovers clean documents,' after which Rings 2/3 operate on a mostly-clean context. The experiment therefore attributes 100% of the measured improvement to Ring 1 plus re-retrieval and provides no evidence that Rings 2 or 3 contribute anything — which undercuts the paper's stated raison d'être (§I: 'a single po
  2. [§VIII, Eq. (3), §V-A] The detection result is close to tautological for the evaluated template. The attack template is defined (§VIII) as verbatim target question plus 'verified records'/'multiple independent sources' boilerplate; Eq. (3) assigns 0.5 for verbatim-question presence and 0.3 for boilerplate, totaling 0.8 ≥ ϑ1=0.5 by construction. Ring 1's detector was written against precisely this template family, and the attacker is explicitly non-adaptive, so the ≈91%→≈13% drop demonstrates that a detector fires on the features it encodes. The authors cite Carlini et al. [10] and defer the adaptive attacker to future work, but a minimal, cheap intermediate step exists and is load-bearing: evaluate template variants that preserve the false claim while removing one detector feature at a time (paraphrased rather than verbatim trigger; boilerplate-free assertion; longer documents to dodge the shortq flag). Withou
  3. [Table VI, §IX-B] Two reporting problems in the central results table. (1) The middle row ('Paper's single-stage defenses [2] (illustrative) ≈29%') is explicitly described in §VIII and §IX as an illustrative reproduction 'pending a full 30-question harness run to firm up this specific number.' An illustrative, not-yet-computed number has no place in a results table; it should either be computed with the released harness or removed, with the comparison made textually against [2]'s published figures. (2) With N=10 target questions, ASR values of ≈91% and ≈13% are not integer multiples of 10%, so the denominator is unclear (averaging over the three panel models? over runs?). Report raw counts (x/10 per configuration), the aggregation method, and binomial confidence intervals; at N=10 the difference between 1/10 and 2/10 residual successes is within noise, and the '≈13%' figure needs that context.
  4. [Table II, §VI, §X] Internal inconsistency on the status of Proposition 1. Table II states TriShieldRAG handles single-document poison 'Yes for ρ<0.5 (Prop. 1); confirmed failing at ρ=0.6.' But §X states plainly that the controlled ρ sweep 'would be needed to confirm the assumption independently' and 'currently is not' run. The phrase 'confirmed failing at ρ=0.6' asserts an empirical result the paper elsewhere says does not exist. Either the ρ=0.6 experiment was run (in which case report it — it would directly address Major Comment 1) or the table entry must be corrected to 'predicted to fail.'
  5. [§VIII, §IX, Table VII] Scale and task-design limitations constrain what the result can show. (a) A 5,000-document corpus is four orders of magnitude below PoisonedRAG's evaluation scale; retrieval-saturation dynamics and the effect of approximate indexing (which the authors themselves flag in §X as security-relevant) are untested. (b) All 10 target questions (Table VII) are canonical factoids (Hamlet, Mona Lisa, capital of Australia) that Claude/Mistral/Llama almost certainly know from parametric memory; Ring 3's panel may answer correctly regardless of the retrieved context, inflating the apparent recovery. A no-retrieval control (panel answers with empty context) is needed to show the pipeline's answers actually depend on the retrieved evidence. (c) The claim in §IX-B that 'benign-query accuracy is preserved' is stated without any number, table, or definition of the benign evaluation set.
minor comments (7)
  1. [§III] The paragraph beginning 'This assumption is not contrived; it reflects how production vector data management systems are actually deployed...' appears three times verbatim. Clear copy-paste error.
  2. [§V-A, Eq. (2)] The 'perplexity detector' is not a perplexity measure; it is a lexical-diversity/repetition heuristic stand-in. Given that perplexity filtering [8] is a specific baseline in the literature (and in Table I), the naming invites confusion. Rename (e.g., 'repetition score') or compute actual LM perplexity.
  3. [§VII] The released package is named ragshield_core while §II-D explicitly disclaims affiliation with the concurrently developed RAGShield [13]. This naming collision is avoidable and will cause citation confusion; consider renaming the package.
  4. [§VII, Table V] The Claude panel member is cited only as 'https://claude.com/' with no model version; Mistral Small likewise lacks a version. Since panel diversity is a stated design rationale, exact model identifiers and dates are needed for reproducibility. Reference [11] (Touvron et al.) is the Llama 2 paper but is cited for Llama 3.2.
  5. [§V-B, Eq. (7)] The 'minimum trust guarantee' (prov=1.0 ⇒ trust≥0.45>ϑ2) is presented as a safety property, but it equally means a provenance-spoofed poison document can never be dropped by Ring 2 regardless of content. The one-sided framing should be noted, especially since §VI already acknowledges the spoofing failure mode.
  6. [§IV, Fig. 2–4] The equivalence claim that ingest-time filtering and post-retrieval filtering make 'identical' decisions holds only because Ring 1 is per-document and order-independent; this is worth one sentence of justification, since the outlier score o(d) depends on a corpus centroid that could differ between the two timings.
  7. [References] Reference [18] lacks a venue/arXiv identifier; several arXiv entries (e.g., [13], [17], [40]) carry 2026 dates and should be checked for stable identifiers. The keywords list includes 'Adaptive Attacker Evaluation,' which the paper explicitly does not perform — remove or qualify.

Circularity Check

1 steps flagged · score 2.0 of 10

No load-bearing circular derivation; mild by-construction alignment of Ring-1 pattern flags with the single evaluated poison template.

  1. other [§V.A Eq. (3); §VIII attack template; §IX Fig. 6 / Table VI]
    "pa(d)=min[1, 0.4 1[shortq]+0.5 1[verbatimq]+0.3 1[boilerplate]]. ... following the aggressive, non-adaptive template: verbatim target question plus “verified records” / “multiple independent sources” boilerplate. In isolation, Ring 1 scores this template well above ϑ1=0.5, correctly flagging it as poison. ... Ring 1: verbatim-question pattern ≥ϑ1 for poison docs → blocked"

    For every poison document in the reported evaluation, 1[verbatimq]=1 and 1[boilerplate]=1 by the attacker definition in §VIII, so pa(d)≥0.8≥ϑ1=0.5 holds identically from Eq. (3). Ring 1’s block decision on this template is therefore guaranteed by how the detector was written, not measured against an independent attack surface. The paper still reports the full-pipeline ASR drop as empirical support for the three-ring design; the Ring-1 contribution to that drop is tautological for the sole attacker tested. This is local detector–template alignment, not a fitted global prediction or a self-citation chain.

full rationale

TriShieldRAG does not present a fitted-parameter-as-prediction chain, does not import a uniqueness theorem from overlapping authors, and does not rename a known empirical law as a new derivation. The minority-poison and provenance-tag conditions in §VI are ordinary majority-aggregation reasoning (once ρ>0.5 the majority bag and the panel context are poison-dominated); they are stated as assumptions, not as theorems proved from the reported ASR, and the authors explicitly mark the missing ρ-sweep as future work. Trust weights (0.45/0.35/0.20) and thresholds (ϑ1=0.5, ϑ2=0.35, ϑ3=0.66) are fixed design constants, not reverse-fitted to Table VI. The only mild circularity is local to Ring 1: the pattern score (Eq. 3) hard-codes the exact surface features of the non-adaptive PoisonedRAG template used in §VIII–IX (verbatim target question + boilerplate authority phrases), so pa(d)≥0.8≥ϑ1 holds by construction for every evaluated poison document. That makes Ring-1’s success on this attacker definitional rather than an independent empirical test; it does not, however, force the end-to-end 91%→13% number or the analytical content of Proposition 1. Score 2 reflects that single, non-central alignment. Broader concerns (regime mismatch np=k so ρ≈1 under Proposition 1; no adaptive attacker; no per-ring ablation) are validity/overclaim issues, not circular derivation.

Assumptions & free parameters 8 free parameters · 6 assumptions · 2 invented entities

The headline defense claim depends on hand-chosen detector thresholds and trust weights, on poison remaining a minority of top-k, on provenance tags not being spoofed, and on a non-adaptive attacker whose lexical fingerprints match Ring 1. No new physical entities; the “rings” are engineering modules. Free parameters dominate the ledger because small threshold moves would change what Ring 1 blocks on the exact template tested.

free parameters (8)
  • ϑ1 Ring-1 block threshold = 0.5
    Documents blocked when combined score ≥ ϑ1; set to 0.5 with no sensitivity sweep reported.
  • ϑ2 Ring-2 drop threshold = 0.35
    Documents dropped when trust < ϑ2; set to 0.35; interacts with provenance floor of 0.45 for clean tags.
  • ϑ3 Ring-3 agreement threshold = 0.66
    Accept panel answer only if agree ≥ ϑ3; 0.66 encodes 2-of-3 for M=3.
  • trust weights (prov, consistency, relevance) = 0.45 / 0.35 / 0.20
    trust = 0.45 prov + 0.35 c + 0.20 rel; hand-chosen to down-weight attacker-controlled similarity.
  • perplexity detector coefficients = 0.6, 2.0, 0.12
    p(d) = min(1, 0.6(1-ω) + 2.0 max(0, ε-0.12)); coefficients and 12% top-token cutoff are design choices.
  • pattern-score flag weights = 0.4, 0.5, 0.3
    pa penalties 0.4 / 0.5 / 0.3 for short-question, verbatim-q, boilerplate flags (Eq. 3).
  • outlier mix weight in Ring-1 score = 0.7 / 0.3
    score uses max(p, pa, 0.7o + 0.3 max(p,pa)); 0.7/0.3 mix is free.
  • k and np evaluation budget = k=5, np=5
    Top-k=5 and np=5 fix ρ regime for the only reported run; not swept.
assumptions (6)
  • ad hoc to paper Minority-poison assumption: Rings 2–3 recover the true answer only while poison fraction ρ of Retr(q,k) stays below majority dominance of the token bag and panel context.
    Proposition 1 §VI; authors state the reported config is consistent but the confirming ρ sweep is future work.
  • domain assumption Provenance-tag assumption: attacker documents do not carry spoofed trusted-source tags (prov=1.0).
    §VI; experiments assign poison prov=0.5 neutral default; spoofing would bypass Ring 2’s strongest weight.
  • domain assumption Black-box non-adaptive attacker: knows q* and can write to D, does not know TriShieldRAG thresholds or architecture.
    §III threat model; adaptive/white-box settings explicitly unevaluated.
  • domain assumption Open or semi-open multi-writer knowledge base (wiki/crawl/user uploads) with no FAISS-level write auth.
    §III; motivates insert-only poison capability.
  • domain assumption Panelists are treated as a majority quorum (Byzantine-style intuition) though failures are not independent.
    §V.C and §X explicitly note LLMs may not fail independently.
  • standard math Standard dense retrieval + generation pipeline (top-k embeddings into LLM context) as the system under defense.
    RAG formulation from Lewis et al. and PoisonedRAG threat construction adopted in §I–III.
invented entities (2)
  • TriShieldRAG three-ring architecture (Ingest Guard, Retrieval Scorer, Cross-LLM Consensus)
    purpose: Name the composed defense-in-depth pipeline and its per-stage algorithms/thresholds.
    Engineering system composition, not a new physical or mathematical object; independent evidence is the empirical ASR run, which remains preliminary.
  • Combined Ring-1 suspicion score max(p, pa, 0.7o+0.3 max(p,pa))
    purpose: Scalar gate for blocking documents at ingest/post-retrieval proxy.
    Ad hoc aggregation of three detectors; no external calibration study beyond the same evaluation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/NEMO4RG4

@misc{pith2026260723838,
  author       = {Pith},
  title        = {Pith review of: TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NEMO4RG4}},
  note         = {Machine review of arXiv:2607.23838}
}
read the original abstract

Retrieval-Augmented Generation (RAG) lets a large language model answer questions using documents retrieved from an external knowledge base at query time. This makes RAG useful for private data, fast-changing information, and reducing hallucination, but it also means the model's answer is only as trustworthy as whatever the retriever hands it. If the knowledge base accepts writes from more than one party, an attacker needs only a handful of adversarial documents to steer the model toward a chosen wrong answer. PoisonedRAG demonstrated this: as few as five crafted documents flip an undefended system's answer roughly 90% of the time, and three natural single-stage defenses (perplexity filtering, query paraphrasing, knowledge-base expansion) leave attack success at 30% or higher. We built TriShieldRAG to close that gap. Rather than relying on one checkpoint, we place three independent, formally specified rings across the pipeline: an Ingest Guard that screens documents for lexical and statistical poisoning signatures; a Retrieval Scorer that re-ranks the retrieved set by a provenance and consistency-weighted trust score; and a Cross-LLM Consensus stage that polls three architecturally diverse language models (Claude, Mistral Small, Llama 3.2) and allows one bounded re-retrieval on disagreement. We derive the conditions under which Rings 2 and 3 are expected to work: a minority-poison assumption and an explicit provenance-tag assumption. Our reported configuration is consistent with this analysis, though we have not yet run the controlled poison-fraction sweep needed to confirm it independently. Evaluated against the non-adaptive attacker from the original PoisonedRAG, over a 5,000-document Wikipedia knowledge base with 10 target questions, the full pipeline reduces attack success rate from roughly 91% to roughly 13% while preserving accuracy on benign queries.

Figures

Figures reproduced from arXiv: 2607.23838 by the authors.

Figure 1
Figure 1. TriShieldRAG’s three checkpoints, mapped against the specific gap identified in [2]: a document is screened individually as it enters the knowledge [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. High-level TriShieldRAG pipeline. A user query and the (possibly [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. The RAG pipeline with and without TriShieldRAG, shown side by side. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Ring 1 internal signal flow (Algorithm 1). Each candidate document [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Query workflow without TriShieldRAG. The undefended pipeline has no stage that inspects document trustworthiness; the poisoned top-k set is passed straight to the LLM, which reproduces the attacker’s target answer wq (red path) – matching the ASR ≈ 91% reported in Tabl…
Figure 6
Figure 6. Figure 6: Query workflow with TriShieldRAG (full pipeline), same query and poison as [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

40 extracted references · 12 linked inside Pith

  1. [10]

    On evaluating adversarial robust- ness,

    N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, A. Kurakin, “On evaluating adversarial robust- ness,”arXiv preprint arXiv:1902.06705, 2019

    arXiv 1902

  2. [2]

    PoisonedRAG: Knowledge corrup- tion attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, J. Jia, “PoisonedRAG: Knowledge corrup- tion attacks to retrieval-augmented generation of large language models,” arXiv preprint arXiv:2402.07867, 2024

    arXiv 2024

  3. [1]

    Retrieval-augmented generation for knowledge-intensive NLP tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. K ¨uttler, M. Lewis, W.-t. Yih, T. Rockt ¨aschel, S. Riedel, D. Kiela, “Retrieval-augmented generation for knowledge-intensive NLP tasks,” inAdvances in Neural Information Processing Systems (NeurIPS), vol. 33, 2020, pp. 9459–9474

    2020

  4. [3]

    Poisoning retrieval corpora by injecting adversarial passages,

    Z. Zhong, Z. Huang, A. Wettig, D. Chen, “Poisoning retrieval corpora by injecting adversarial passages,” inProc. EMNLP, 2023

    2023

  5. [4]

    Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, M. Fritz, “Not what you’ve signed up for: Compromising real-world LLM- integrated applications with indirect prompt injection,”arXiv preprint arXiv:2302.12173, 2023

    arXiv 2023

  6. [5]

    Sentence-BERT: Sentence embeddings using Siamese BERT-networks,

    N. Reimers and I. Gurevych, “Sentence-BERT: Sentence embeddings using Siamese BERT-networks,” inProc. EMNLP-IJCNLP, 2019, pp. 3982–3992

    2019

  7. [6]

    Billion-scale similarity search with GPUs,

    J. Johnson, M. Douze, H. J ´egou, “Billion-scale similarity search with GPUs,”IEEE Transactions on Big Data, vol. 7, no. 3, pp. 535–547, 2019

    2019

  8. [7]

    Term-weighting approaches in automatic text retrieval,

    G. Salton and C. Buckley, “Term-weighting approaches in automatic text retrieval,”Information Processing & Management, vol. 24, no. 5, pp. 513–523, 1988

    1988

Show all 40 references
  1. [8]

    Lan- guage models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever, “Lan- guage models are unsupervised multitask learners,” OpenAI Technical Report, 2019

    2019

  2. [9]

    The Byzantine generals problem,

    L. Lamport, R. Shostak, M. Pease, “The Byzantine generals problem,” ACM Transactions on Programming Languages and Systems, vol. 4, no. 3, pp. 382–401, 1982

    1982

  3. [11]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al., “Llama 2: Open foundation and fine-tuned chat models,”arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  4. [12]

    HotFlip: White-box adversarial examples for text classification,

    J. Ebrahimi, A. Rao, D. Lowd, D. Dou, “HotFlip: White-box adversarial examples for text classification,” inProc. 56th Annual Meeting of the Association for Computational Linguistics (ACL), 2018, pp. 31–36

    2018

  5. [13]

    RAGShield: Detecting numerical claim manipulation in government RAG systems,

    K. S. R. Patil, “RAGShield: Detecting numerical claim manipulation in government RAG systems,”arXiv preprint arXiv:2604.00387, 2026

    2026 arXiv

  6. [14]

    TrustRAG: Enhancing robustness and trustworthiness in retrieval-augmented generation,

    H. Zhou, K.-H. Lee, Z. Zhan, Z. Li, Y . Chen, Z. Wang, H. Had- dadi, E. Yilmaz, “TrustRAG: Enhancing robustness and trustworthiness in retrieval-augmented generation,”arXiv preprint arXiv:2501.00879, 2025

    2025 arXiv

  7. [15]

    Benchmarking poisoning attacks against retrieval- augmented generation,

    B. Zhang et al., “Benchmarking poisoning attacks against retrieval- augmented generation,”arXiv preprint arXiv:2505.18543, 2025

    2025 arXiv

  8. [16]

    Practical poi- soning attacks against retrieval-augmented generation,

    B. Zhang, Y . Chen, Z. Liu, L. Nie, T. Li, Z. Liu, “Practical poi- soning attacks against retrieval-augmented generation,”arXiv preprint arXiv:2504.03957, 2025

    2025

  9. [17]

    Cordon-MAS: Defending RAG against knowledge poi- soning via information-flow control,

    H. Zhou et al., “Cordon-MAS: Defending RAG against knowledge poi- soning via information-flow control,”arXiv preprint arXiv:2605.26754, 2026

    2026 arXiv

  10. [18]

    Rescuing the unpoisoned: Efficient defense against knowledge corruption attacks on RAG systems,

    M. Kim, H. Lee, H. Koo, “Rescuing the unpoisoned: Efficient defense against knowledge corruption attacks on RAG systems,” 2025

    2025

  11. [19]

    Traceback of poisoning attacks to retrieval-augmented generation,

    B. Zhang, H. Xin, M. Fang, Z. Liu, B. Yi, T. Li, and Z. Liu, “Traceback of poisoning attacks to retrieval-augmented generation,” inProceedings of The Web Conference (WWW), 2025. arXiv:2504.21668

    2025

  12. [20]

    Dense passage retrieval for open-domain question answering,

    V . Karpukhin, B. O ˘guz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W.-t. Yih, “Dense passage retrieval for open-domain question answering,” inProc. EMNLP, 2020, pp. 6769–6781

    2020

  13. [21]

    Unsupervised dense information retrieval with con- trastive learning,

    G. Izacard, M. Caron, L. Hosseini, S. Riedel, P. Bojanowski, A. Joulin, and E. Grave, “Unsupervised dense information retrieval with con- trastive learning,”Transactions on Machine Learning Research, 2022. arXiv:2112.09118

    2022 arXiv

  14. [22]

    Approximate nearest neighbor negative contrastive learning for dense text retrieval,

    L. Xiong, C. Xiong, Y . Li, K.-F. Tang, J. Liu, P. Bennett, J. Ahmed, and A. Overwijk, “Approximate nearest neighbor negative contrastive learning for dense text retrieval,” inProc. ICLR, 2021

    2021

  15. [23]

    The probabilistic relevance framework: BM25 and beyond,

    S. Robertson and H. Zaragoza, “The probabilistic relevance framework: BM25 and beyond,”Foundations and Trends in Information Retrieval, vol. 3, no. 4, pp. 333–389, 2009

    2009

  16. [24]

    BEIR: A heterogeneous benchmark for zero-shot evaluation of infor- mation retrieval models,

    N. Thakur, N. Reimers, A. R ¨uckl´e, A. Srivastava, and I. Gurevych, “BEIR: A heterogeneous benchmark for zero-shot evaluation of infor- mation retrieval models,” inProc. NeurIPS Datasets and Benchmarks Track, 2021

    2021

  17. [25]

    Machine learning with adversaries: Byzantine tolerant gradient descent,

    P. Blanchard, E. M. El Mhamdi, R. Guerraoui, and J. Stainer, “Machine learning with adversaries: Byzantine tolerant gradient descent,” inAd- vances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017

    2017

  18. [26]

    Byzantine-robust distributed learning: Towards optimal statistical rates,

    D. Yin, Y . Chen, K. Ramchandran, and P. Bartlett, “Byzantine-robust distributed learning: Towards optimal statistical rates,” inProc. Interna- tional Conference on Machine Learning (ICML), 2018

    2018

  19. [27]

    The hidden vul- nerability of distributed learning in Byzantium,

    E. M. El Mhamdi, R. Guerraoui, and S. Rouault, “The hidden vul- nerability of distributed learning in Byzantium,” inProc. International Conference on Machine Learning (ICML), 2018

    2018

  20. [28]

    Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,

    Y . Chen, L. Su, and J. Xu, “Distributed statistical machine learning in adversarial settings: Byzantine gradient descent,”Proc. ACM on Measurement and Analysis of Computing Systems, vol. 1, no. 2, 2017

    2017

  21. [29]

    FLTrust: Byzantine- robust federated learning via trust bootstrapping,

    X. Cao, M. Fang, J. Liu, and N. Z. Gong, “FLTrust: Byzantine- robust federated learning via trust bootstrapping,” inProc. Network and Distributed System Security Symposium (NDSS), 2021

    2021

  22. [30]

    Efficient and robust approxi- mate nearest neighbor search using hierarchical navigable small world graphs,

    Y . A. Malkov and D. A. Yashunin, “Efficient and robust approxi- mate nearest neighbor search using hierarchical navigable small world graphs,”IEEE Transactions on Pattern Analysis and Machine Intelli- gence, vol. 42, no. 4, pp. 824–836, 2020

    2020

  23. [31]

    Product quantization for nearest neighbor search,

    H. J ´egou, M. Douze, and C. Schmid, “Product quantization for nearest neighbor search,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 33, no. 1, pp. 117–128, 2011

    2011

  24. [32]

    Natural Questions: A benchmark for question answering research,

    T. Kwiatkowski, J. Palomaki, O. Redfield, M. Collins, A. Parikh, C. Alberti, D. Epstein, I. Polosukhin, J. Devlin, K. Lee et al., “Natural Questions: A benchmark for question answering research,”Transactions of the Association for Computational Linguistics, vol. 7, pp. 453–466, 2019

    2019

  25. [33]

    HotpotQA: A dataset for diverse, explainable multi-hop question answering,

    Z. Yang, P. Qi, S. Zhang, Y . Bengio, W. Cohen, R. Salakhutdinov, and C. D. Manning, “HotpotQA: A dataset for diverse, explainable multi-hop question answering,” inProc. EMNLP, 2018

    2018

  26. [34]

    MS MARCO: A human-generated machine reading comprehension dataset,

    T. Nguyen, M. Rosenberg, X. Song, J. Gao, S. Tiwary, R. Majumder, and L. Deng, “MS MARCO: A human-generated machine reading comprehension dataset,”arXiv preprint arXiv:1611.09268, 2016

    2016 arXiv

  27. [35]

    MPNet: Masked and permuted pre-training for language understanding,

    K. Song, X. Tan, T. Qin, J. Lu, and T.-Y . Liu, “MPNet: Masked and permuted pre-training for language understanding,” inAdvances in Neural Information Processing Systems (NeurIPS), vol. 33, 2020, pp. 16857–16867

    2020

  28. [36]

    BERT: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” inProc. NAACL-HLT, 2019, pp. 4171–4186

    2019

  29. [37]

    The Faiss library,

    M. Douze, A. Guzhva, C. Deng, J. Johnson, G. Szilvasy, P.-E. Mazar ´e, M. Lomeli, L. Hosseini, and H. J´egou, “The Faiss library,”arXiv preprint arXiv:2401.08281, 2024

    2024 arXiv

  30. [38]

    Milvus: A purpose-built vector data management system,

    J. Wang, X. Yi, R. Guo, H. Jin, P. Xu, S. Li, X. Wang, X. Guo, C. Li, X. Xu et al., “Milvus: A purpose-built vector data management system,” inProc. ACM SIGMOD International Conference on Management of Data, 2021, pp. 2614–2627

    2021

  31. [39]

    Survey of vector database management systems,

    J. J. Pan, J. Wang, and G. Li, “Survey of vector database management systems,”The VLDB Journal, 2024. arXiv:2310.14021

    2024 arXiv

  32. [40]

    RAGPart & RAGMask: Retrieval-stage defenses against corpus poi- soning in retrieval-augmented generation,

    P. Pathmanathan, M.-A. Panaitescu-Liess, C.-Y . J. Chiang, and F. Huang, “RAGPart & RAGMask: Retrieval-stage defenses against corpus poi- soning in retrieval-augmented generation,” inAAAI Workshop on New Frontiers in Information Retrieval, 2026. arXiv:2512.24268

    2026

Pith tools

Reviewed July 30, 2026 · model on record in the stance chip above.