TrustRAG: Defending Retrieval-Augmented Generation against Corpus Poisoning
A training-free, plug-and-play defense that protects Retrieval-Augmented Generation from corpus-poisoning attacks, where adversarial documents injected into the knowledge base hijack the LLM's output. It applies a two-stage filter: (1) cluster filtering that embeds retrieved documents and isolates the anomalous tightly-clustered injected documents, and (2) an LLM self-assessment stage that uses the model's internal knowledge to flag remaining malicious passages and reconcile inconsistencies before generation. Works with any open- or closed-source LLM and improves retrieval accuracy and attack resistance.
TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation Huichi Zhou*1
TrustRAG is a training-free defense framework that hardens Retrieval-Augmented Generation (RAG) systems against corpus-poisoning attacks, in which adversaries inject malicious documents into the exte…