TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation

Technical Summary: TriShieldRAG

Problem Statement
Retrieval-Augmented Generation (RAG) systems rely on external knowledge bases to ground Large Language Model (LLM) responses. While this mitigates hallucination and allows for dynamic knowledge updates, it introduces a critical vulnerability: if an attacker can inject adversarial documents into a shared or crowd-sourced knowledge base, they can manipulate the retriever to surface these "poisoned" documents. As demonstrated by PoisonedRAG, injecting as few as five crafted documents containing a retrieval trigger and a false claim can cause an undefended RAG system to output the attacker's desired wrong answer with approximately 91% success. Existing defenses proposed in the literature (e.g., perplexity filtering, query paraphrasing, knowledge base expansion) operate at a single stage of the pipeline. The paper argues that single-stage defenses constitute a "single point of failure," as an adaptive attacker can tune their poison to bypass that specific checkpoint, leaving residual attack success rates of 30% or higher.

Methodology: TriShieldRAG
TriShieldRAG proposes a "defense-in-depth" framework comprising three independent, formally specified rings that operate at distinct stages of the RAG pipeline: Ingest, Retrieval, and Generation.

1. Ring 1: Ingest Guard (Ingest Time)

   • Function: Screens candidate documents before they enter the searchable index (or immediately post-retrieval if a persistent index is not maintained).
   • Mechanism: Assigns a suspicion score based on three signals:
     • Perplexity: Detects repetitive or unnatural text patterns (lexical diversity and token burstiness).
     • Pattern Matching: Flags specific red flags such as verbatim inclusion of the target question, short question-like structures, or boilerplate authority phrases (e.g., "verified records").
     • Outlier Detection: Measures the cosine distance of the document embedding from the knowledge base centroid.
   • Decision: Documents exceeding a fixed threshold ($\vartheta_1 = 0.5$) are blocked.

2. Ring 2: Retrieval Scorer (Retrieval Time)

   • Function: Re-ranks the documents that survive Ring 1 based on a trust score.
   • Mechanism: Computes a weighted trust score combining:
     • Provenance: A source allow-list weight (1.0 for curated, 0.1 for known poison, 0.5 for unknown).
     • Consistency: Measures overlap between a document's token bag and the majority token bag of the retrieved set.
     • Relevance: The retriever's original similarity score (weighted lowest to avoid trusting the attacker's optimized trigger).
   • Decision: Documents falling below a trust threshold ($\vartheta_2 = 0.35$) are dropped. The system relies on a provenance-tag assumption (that attackers cannot spoof trusted source tags) and a minority-poison assumption (that clean documents outnumber poisoned ones in the retrieved set).

3. Ring 3: Cross-LLM Consensus (Generation Time)

   • Function: Validates the final answer using a panel of heterogeneous LLMs.
   • Mechanism: Queries a panel of three architecturally diverse models (Claude, Mistral Small, Llama 3.2) with the filtered context.
   • Decision: Accepts the answer if a majority quorum (at least 2 of 3) agrees ($\vartheta_3 = 0.66$). If there is disagreement, the system performs one bounded re-retrieval after dropping the lowest-trust third of the context, then returns the new outcome regardless of the second vote's agreement level.

Key Contributions

1. Three-Ring Architecture: The first framework to integrate lexical/statistical screening, provenance-weighted trust re-ranking, and multi-vendor consensus voting into a single pipeline, ensuring a poison document must defeat all three layers simultaneously.
2. Formal Assumptions: Derivation of the minority-poison assumption (Rings 2 and 3 function correctly only if poison is a minority of the retrieved set) and the provenance-tag assumption (Ring 2 relies on unspoofed source tags). The paper explicitly notes these are derived conditions, not yet independently confirmed via controlled $\rho$-swept experiments.
3. Reference Implementation: A modular Python implementation using FAISS for retrieval and a heterogeneous LLM panel, with full traceability of decisions at each ring.
4. Reproducible Evaluation: An evaluation against the non-adaptive PoisonedRAG attacker over a 5,000-document Wikipedia corpus.

Experimental Results
Evaluated against a non-adaptive attacker injecting 5 poison documents per query into a 5,000-document knowledge base:

• Undefended Baseline: Attack Success Rate (ASR) $\approx$ 91%.
• Single-Stage Defenses (Reproduction): ASR $\approx$ 29% (illustrative).
• TriShieldRAG (Full Pipeline): ASR reduced to $\approx$ 13%.
• Benign Performance: The framework preserves accuracy on unpoisoned queries.

The residual 13% failure rate is attributed to poison documents whose phrasing is sufficiently natural to evade Ring 1's lexical/pattern checks, leaving Ring 2 and 3 to recover the correct answer from a context that may still contain some poison.

Significance and Claims
The paper claims TriShieldRAG addresses a specific gap in the literature: the lack of layered protection that screens documents at ingest, retrieval, and generation. By moving beyond single checkpoints, it significantly reduces the success of non-adaptive attacks.

However, the authors maintain a modest scope regarding their current claims:

• Adaptive Attackers: The current evaluation does not include an adaptive attacker aware of TriShieldRAG's specific thresholds or design. Evaluating against such an attacker is explicitly identified as the primary open item for future work.
• Scale: The evaluation was conducted on a 5,000-document corpus. The authors acknowledge that the original PoisonedRAG evaluation used larger scales (millions of documents) and that scaling TriShieldRAG to that level (requiring approximate nearest neighbor indices) is a necessary next step to validate the results at production scale.
• Assumption Verification: The minority-poison assumption is derived analytically and found to be consistent with the current configuration, but the paper admits it has not yet been confirmed by a controlled experiment sweeping the poison fraction $\rho$ across the minority/majority boundary.

In summary, TriShieldRAG demonstrates that a three-ring defense-in-depth approach can drastically reduce attack success rates against known non-adaptive templates, but the authors position this as an initial version of ongoing work, with rigorous testing against adaptive attackers and large-scale deployments remaining as future priorities.