Technical Summary: RADAR: Defending RAG Dynamically against Retrieval Corruption

1. Problem Statement

Retrieval-Augmented Generation (RAG) systems, particularly those deployed in dynamic web search environments, face significant vulnerabilities to adversarial attacks. While early RAG systems operated on static corpora, modern applications continuously ingest evolving information from the web. This temporal volatility amplifies susceptibility to corpus poisoning (injecting deceptive documents) and prompt injection attacks (embedding malicious instructions in retrieved text).

Existing defense mechanisms are largely designed for static settings. Heuristic filtering often incurs utility loss, while optimization-based consistency selection relies on approximations without strong guarantees. When naively extended to dynamic settings, these methods fail to handle continuously mutating threats and suffer from prohibitive storage costs due to the need to archive raw historical documents. The core challenge is maintaining robustness against evolving adversarial strategies while preserving adaptability to genuine knowledge shifts (the stability-plasticity dilemma) without excessive storage overhead.

2. Methodology: The RADAR Framework

RADAR (Robust Adaptive Defense Against Retrieval corruption) addresses these challenges by modeling reliable context selection as a graph-based energy minimization problem, solved exactly via Max-Flow Min-Cut. The framework operates in two primary modes: static and dynamic.

2.1. Core Mechanism: Energy Minimization via Min-Cut

RADAR treats the selection of reliable documents as a binary labeling problem. Given a set of retrieved documents $D = \{d_1, ..., d_k\}$, the goal is to identify a subset $D_{rel}$ that maximizes consistency.

• Atomic Answer Generation: For each retrieved document, the system generates an "atomic answer" using an LLM.
• Semantic Scoring: An NLI (Natural Language Inference) model computes two matrices:
  • Consistency ($M$): Logical entailment between atomic answers.
  • Contradiction ($C$): Logical conflict between atomic answers.
• Graph Construction: A directed graph $G=(V, E)$ is constructed with a source node $s$, a sink node $t$, and nodes for each document.
  • Unary Potentials (Terminal Edges): Edges from $s$ to $d_i$ ($S_i$) represent the benefit of retaining a document (based on centrality and rank), while edges from $d_i$ to $t$ ($F_i$) represent the cost of retaining it (based on conflict with central documents).
  • Pairwise Potentials (Inter-document Edges): Edges between $d_i$ and $d_j$ with capacity $M_{ij}$ enforce logical consistency.
• Inference: The Min-Cut algorithm partitions the graph into a source set (reliable documents) and a sink set (filtered documents). This provides an exact solution to the energy minimization problem, balancing individual document confidence with pairwise consistency.

2.2. Dynamic Defense: Bayesian Memory Node

To handle time-evolving evidence streams without storing raw historical documents, RADAR introduces a Bayesian Memory Node ($a_{t-1}$) representing the system's belief state from the previous time step.

• Recursive Belief Update: Instead of archiving documents, the system updates the capacity of edges connected to the memory node using Bayesian inference.
  • Prior: Derived from the coherence of the previous answer.
  • Likelihood: Calculated based on the entailment (support) or contradiction (conflict) between the historical answer and the new evidence $D(t)$.
  • Posterior: The updated edge capacity determines whether the historical answer should be retained (source side) or discarded (sink side) in the current Min-Cut.
• Stability-Plasticity Balance: This mechanism allows the system to adaptively retain valid historical knowledge when new evidence supports it, or discard it when new evidence contradicts it, effectively resolving the stability-plasticity trade-off.

2.3. Post-Processing

After Min-Cut selection, the system performs a secondary filtering step based on pairwise cosine similarity of the selected atomic answers to remove isolated outliers, ensuring semantic coherence before the final generation step.

3. Key Contributions

1. RADAR Framework: A novel defense framework that models RAG context sanitization as a Min-Cut problem, delivering exact and efficient inference with superior robustness against corpus-based attacks.
2. Dynamic Graph Construction with Bayesian Memory: The first defensive approach explicitly tailored for continuous time-step attacks. By maintaining a recursive belief state via a Bayesian memory node, it achieves an effective balance between historical consistency and new evidence without archiving raw documents.
3. Dynamic Dataset Construction: The creation of a comprehensive dataset for dynamic RAG security, simulating evolving adversarial scenarios with time-varying ground truths and attack patterns.

4. Experimental Results

Experiments were conducted on four datasets (RealTimeQA, Natural Questions, TriviaQA, Bio) using multiple LLMs (DeepSeek, GPT-4o, Grok-4-fast) and compared against baselines like RobustRAG, AstuteRAG, and ReliabilityRAG.

• Static Performance: RADAR achieved superior robustness-utility trade-offs. In RealTimeQA (RQA) under Prompt Injection Attacks (PIA) at the top rank (Pos 1), RADAR maintained 69.0% accuracy with an 11.0% Attack Success Rate (ASR), significantly outperforming baselines like AstuteRAG (25.0% Acc, 1.0% ASR) and ReliabilityRAG (69.0% Acc, 15.0% ASR). In long-form Bio generation, RADAR achieved peak accuracy of 84.4% under poisoning attacks, outperforming all baselines.
• Dynamic Performance: In evolving evidence streams, RADAR demonstrated superior adaptability. Under cumulative snapshot settings with PIA at Pos 1, RADAR achieved 63.60% accuracy with 17.85% ASR, outperforming RobustRAG (61.29% Acc) and ReliabilityRAG (53.61% Acc).
• Efficiency: RADAR reduced storage overhead from tens of megabytes (required for raw document archiving in other methods) to approximately 1 KB per query (storing only the belief state). While the runtime is dominated by atomic answer generation, the Min-Cut inference introduces negligible overhead.
• Robustness: The method remained stable under adaptive attacks designed to bypass NLI checks and showed low sensitivity to the choice of NLI model (DeBERTa-v3, BART, ModernBERT).

5. Significance and Claims

The paper claims that RADAR provides a mathematically grounded, time-aware resilience mechanism essential for next-generation trustworthy AI agents operating in real-time. By formulating context sanitization as an exact Min-Cut problem and integrating a Bayesian memory node, RADAR effectively balances adversarial resilience with knowledge adaptation.

The authors emphasize that this approach significantly reduces storage overhead while improving robustness and answer accuracy under evolving attacks. They posit that as real-time RAG becomes integral to AI assistants and search engines, such dynamic defenses are vital for mitigating prompt injection and corpus poisoning risks, promoting the safe deployment of LLM-powered systems in dynamic real-world settings. The work does not claim to solve all RAG vulnerabilities but specifically targets the gap in defending against dynamic retrieval corruption with minimal storage cost.