Filters against poisoned text relied on benchmark shortcuts
The RAGuard document filter’s miss rate rose from 0.191 to 0.763 after researchers removed prepended questions from the attack authors’ poisoned passages.
Edited by Boris Djordjevic · Paperfoot
The empirical study tested ten document-screening defenses across four document collections and four attack families, using a shared set of candidate documents. Such filters screen retrieved text before an AI system uses it to answer questions. The authors profiled two construction clues: verbatim copies of the target question and overlap in length between poisoned and clean documents.
They re-created RAGuard, a published filter, and removed only the target-question prefix from the attack authors’ poisoned passages. Its miss rate rose from 0.191 to 0.763. Its ranking score, measuring how well it separated poisoned from clean text, fell from 0.953 to 0.758. The altered passages were still retrieved for their target questions at a rate of 0.93. Across the broader tests, the construction profile predicted where detection saturated. The authors released a script to compute that profile.
Why it matters
The benchmark tests showed why ranking suspicious documents and deciding which to reject need separate checks. The authors called for reporting poison-construction clues and the share of clean documents wrongly rejected at the cutoff actually used.
Caveats
The results came from benchmark tests, and an attacker aware of the defense defeated the authors’ own scorer; the authors claimed no new defense. The paper is a preprint, not yet peer-reviewed.
In this paper
retrieval-augmented generation poisoning defense
- Methods
- learned scorer (this paper)RAGuard (evaluated)TrustRAG (evaluated)
Results
- RAGuard, AUROC, deleting target question prefix: 0.758; RAGuard, miss rate, deleting target question prefix: 0.763
Deleting only that prefix from the attack authors' own passages (0.93 still retrieved for their target) takes RAGuard, a published content filter we re-implement, from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763.
Abstract
- TrustRAG, miss rate, padding medical poison to clean length with word-shuffled filler: 0.827; learned scorer, miss rate, padding medical poison to clean length with word-shuffled filler: 0.986; learned scorer, miss rate, padding medical poison to clean length with word-shuffled filler at a matched 5% false-positive rate: 0.321; learned scorer, AUROC, padding medical poison to clean length with word-shuffled filler: 0.953
Padding medical poison to clean length with word-shuffled filler that carries no content takes TrustRAG's set-level stage from a miss rate of 0.000 to 0.827, and one learned scorer of ours from 0.000 to 0.986 (0.321 at a matched 5% false-positive rate) while its AUROC holds at 0.953.
Abstract
What it shows
- Removing a single construction cue destroys the deployed decision before it destroys the ranking in query-time RAG poisoning defenses.
We show that this performance is predicted by how the poison set was built rather than by what the filter reads: removing a single construction cue destroys the deployed decision before it destroys the ranking.
Abstract
- Deleting the prepended target question prefix from attack passages takes RAGuard from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763.
Deleting only that prefix from the attack authors' own passages (0.93 still retrieved for their target) takes RAGuard, a published content filter we re-implement, from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763.
Abstract
- Padding medical poison to clean length with word-shuffled filler increases the miss rate of TrustRAG's set-level stage from 0.000 to 0.827.
Padding medical poison to clean length with word-shuffled filler that carries no content takes TrustRAG's set-level stage from a miss rate of 0.000 to 0.827, and one learned scorer of ours from 0.000 to 0.986 (0.321 at a matched 5% false-positive rate) while its AUROC holds at 0.953.
Abstract
- A defense-aware attacker defeats the authors' learned scorer, so they claim no defense.
A defense-aware attacker defeats our own scorer, so we claim no defense.
Abstract
Quoted word for word from the abstract on arXiv.
The paper
arXiv, Oct 24, 2026, Open access, CC BY, Preprint, not peer-reviewed
doi.org/10.48550/arxiv.2610.33849
arXiv:2610.33849v1 in cs.CR, also cs.CL, cs.LG
Comments: 26 pages, 7 figures, 14 tables
Cite as BibTeX
@misc{kumar2026ranking,
title = {Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses},
author = {Kumar, Pushkal and Sahaym, Arvin},
year = {2026},
eprint = {2610.33849},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
doi = {10.48550/arxiv.2610.33849},
url = {https://arxiv.org/abs/2610.33849}
}