ML-FilterRAG: Enhanced Retrieval Defense

• ML-FilterRAG is a machine-learning-based filtering approach that uses supervised classifiers on query-conditioned passage features to detect and block poisoned retrieval outputs.
• It integrates metrics such as Freq-Density, perplexity, and joint log probability to make informed filtering decisions between retrieval and generation.
• Evaluations on benchmarks like MS-MARCO, HotpotQA, and Natural Questions show that ML-FilterRAG significantly reduces attack success rates while preserving or restoring task accuracy.

ML-FilterRAG denotes, in the narrow named sense, a retrieval-side defense against poisoned Retrieval-Augmented Generation that replaces a hand-tuned filtering threshold with a supervised classifier over query-conditioned passage features (Edemacu et al., 4 Aug 2025). In a broader systems sense suggested by adjacent RAG work, the term also captures architectures that insert explicit machine-learning-based filtering, grading, pruning, or query-control stages between retrieval and generation, rather than relying only on embedding similarity, prompt engineering, or manual corpus refinement (Naikov et al., 23 Jan 2025, Jeong, 17 Jun 2025). Across this literature, the central problem is the same: retrieved context is rarely uniformly useful, and the quality, safety, privacy, or trustworthiness of what reaches the generator often dominates end-task performance.

1. From naïve retrieval to explicit filtering

A useful point of departure is the class of systems that perform retrieval but do not implement a distinct ML filter. In a local RAG setup for developers and administrators of large computing systems, the architecture consists of an embedding model, a vector database built from local PDF documentation, a retriever, open-source LLMs such as LLaMA2/3 and Mistral served through Ollama, a prompt template, and a Streamlit frontend. Its control mechanisms are prompt editing, temperature reduction to $0.1$, and a human-in-the-loop loop that rewrites documentation and prompts when answers are poor. The paper is explicit that it does not report learned query-document relevance models, rerankers, metadata filters, classifier-based filtering, confidence scoring, uncertainty estimation, or supervised fine-tuning of retrievers or generators; in ML-FilterRAG terms, it is therefore a naïve local RAG baseline with human-driven refinement rather than a machine-learned filtering pipeline (Naikov et al., 23 Jan 2025).

A similar boundary case appears in domain RAG for systems biology. BioModelsRAG converts SBML to Antimony, splits models into semantic sections, summarizes those sections into plain text with Llama 3.1, embeds the summaries with all-MiniLM-L6-v2, stores them in ChromaDB, and retrieves the top 5 chunks by cosine similarity. It adds an instruction to state clearly when the retrieved context is insufficient, and its strongest contributions are domain-specific chunking and representation transformation. However, it does not report score thresholding, learned relevance filters, rerankers, hybrid retrieval, metadata-aware filtering, or confidence estimation. This places it closer to a well-engineered domain RAG than to a full ML-FilterRAG system (Krishnan et al., 30 Jan 2026).

This distinction is substantive rather than terminological. In these minimal pipelines, “selection” is mostly top-$k$ vector retrieval plus prompt control. ML-FilterRAG begins where retrieval output is itself subjected to an explicit learned or statistically parameterized decision about what should survive into the final context.

2. ML-FilterRAG as a poisoning defense

The most literal use of the name appears in work on defending RAG against knowledge poisoning. In that setting, an attacker injects poisoned passages into the knowledge source so that, when a target question is asked, the final generator is steered toward an attacker-chosen answer. The defense premise is retrieval-side: poisoned passages must appear in the retrieved top-$k$ to influence generation, so filtering them after retrieval but before prompting the final LLM can block the attack (Edemacu et al., 4 Aug 2025).

The paper first introduces a simpler thresholded baseline, FilterRAG, built around Freq-Density. For each retrieved text $d_j$, a smaller LLM generates an answer-like output

$a_j = \text{SLM}(q_i, d_j),$

and the filter computes

$$\text{Freq-Density} = \frac{\sum_{w \in (q_i \oplus a_j) \cap d_j} \text{Freq}(w, d_j)}{\text{UniqueWords}(d_j)}.$$

Here, word matching is based on semantic similarity rather than exact lexical identity. The intuition is that successful PoisonedRAG passages are unusually dense in words semantically aligned with both the target query and the induced answer. Thresholded FilterRAG retains passages whose Freq-Density falls below a manually chosen $\epsilon$: $$\text{Filter}(d_j)= \begin{cases} 1, & \text{if } \text{Freq-Density}<\epsilon \ 0, & \text{otherwise}. \end{cases}$$

ML-FilterRAG replaces this single-score threshold with a supervised classifier: $pred_j = \mathcal{M}(\text{Feature}(q_i,d_j)).$ The feature set includes Freq-Density, perplexity, the joint log probability of the SLM output $a_j$, and the sum of frequencies of semantically similar words between $k$0 and $k$1. Training uses labeled adversarial and clean retrieved texts. The paper starts from the PoisonedRAG benchmark on MS-MARCO, Natural Questions, and HotpotQA, where each target question already has 5 adversarial texts injected, then generates 5 additional adversarial texts per target question with GPT-4o and balances those against clean texts. The downstream classifiers are dataset-specific: XGBoost for NQ and Random Forest for HotpotQA and MS-MARCO. Appendix accuracies are reported as 0.970 test accuracy for NQ/XGBoost, 0.982 for HotpotQA/Random Forest, and 0.850 for MS-MARCO/Random Forest (Edemacu et al., 4 Aug 2025).

At inference time, the system retrieves top-$k$2 candidates with Contriever using dot-product similarity, uses an SLM such as LLaMA-3 to generate $k$3 for each candidate, computes the feature vector, predicts whether each passage is adversarial, discards predicted adversarial passages, and passes top-$k$4 retained passages to the final generator. The default semantic similarity threshold for feature extraction is $k$5, which the ablation identifies as the best default region. With GPT-3.5 under black-box attack, ML-FilterRAG reduces HotpotQA attack success rate from 0.940 to 0.090 while restoring accuracy from 0.042 to 0.903; on MS-MARCO it reduces attack success rate from 0.820 to 0.060 and recovers accuracy from 0.160 to 0.851; on NQ it reduces attack success rate from 0.880 to 0.020 and raises accuracy from 0.108 to 0.811. Across these settings it generally preserves clean-task accuracy better than the simpler thresholded FilterRAG, even when FilterRAG occasionally yields slightly lower adversarial-text ratios (Edemacu et al., 4 Aug 2025).

3. Filtering loci across the broader RAG literature

Contemporary work uses “filtering” for several distinct interventions: post-retrieval relevance grading, adaptive demonstration selection, multimodal evidence gating, source-restricted web querying, hierarchical URL and section pruning, privacy-budget filtering, and domain-specific evidence pruning (Jeong, 17 Jun 2025, Bonomo et al., 18 Jan 2025, Sarwar, 25 Feb 2025, Dai et al., 11 Aug 2025, Nuengsigkapian, 27 Dec 2025, Luo et al., 18 Nov 2025).

System	Filtering locus	Mechanism
"Lightweight Relevance Grader in RAG" (Jeong, 17 Jun 2025)	Post-retrieval	Fine-tuned Llama-3.2-1B binary relevance classifier
"Visual RAG" (Bonomo et al., 18 Jan 2025)	Demonstration selection	CLIP embeddings + FAISS IndexFlatL2 top-$k$6 example retrieval
"FilterRAG" for VQA (Sarwar, 25 Feb 2025)	Multimodal retrieval stage	Top-$k$7 evidence retrieval guided by image-question representation
"WebFilter" (Dai et al., 11 Aug 2025)	Pre-retrieval web search	RL-trained source-restricted queries using site:, quotes, [AND](https://www.emergentmind.com/topics/aria-navigation-dataset-and), OR, [NOT](https://www.emergentmind.com/topics/neural-organ-transplantation-not), after:
"HiFi-RAG" (Nuengsigkapian, 27 Dec 2025)	URL and section levels	Gemini 2.5 Flash URL filtering and hierarchical section selection
"MalRAG" (Luo et al., 18 Nov 2025)	Post-retrieval evidence pruning	Traffic-Aware Adaptive Pruning with class–protocol–view thresholds

These systems differ in both granularity and objective. The lightweight relevance grader inserts a hard binary gate after standard dense retrieval and before generation. Its best configuration, full fine-tuning of Llama-3.2-1B with a 2-way classification head, raises precision from 0.1301 to 0.7750 on teacher-labeled news query-document pairs, though recall drops from 0.9176 to 0.6670 (Jeong, 17 Jun 2025). Visual RAG moves the filter earlier: instead of retrieving text passages, it retrieves labeled image demonstrations with CLIP and exact FAISS nearest-neighbor search, then injects only the top-$k$8 examples into Gemini 1.5 Pro. Relative to many-shot random in-context learning, it raises the average score from 71.71 to 74.20 while using about 23% as many demonstrations on average (Bonomo et al., 18 Jan 2025).

Other systems filter at yet different stages. WebFilter does not primarily score retrieved documents after the fact; it learns a retrieval policy that issues source-restricted web queries and filters noise upstream. HiFi-RAG uses a training-free LLM cascade in which Gemini 2.5 Flash first filters search-result URLs, reducing URL count by 33.5% on average across 100 queries, and then filters webpage sections, removing about 60.5% of chunks on average across 100 queries. MalRAG retrieves candidates across payload, packet-length, and inter-arrival-time views, then applies Traffic-Aware Adaptive Pruning with thresholds of the form

$k$9

retaining only candidates whose distance to the query falls within class–protocol–view-specific variability (Dai et al., 11 Aug 2025, Nuengsigkapian, 27 Dec 2025, Luo et al., 18 Nov 2025).

The VQA paper titled FilterRAG occupies an intermediate and somewhat ambiguous position. It combines frozen BLIP-VQA, retrieval from Wikipedia and DBpedia, and frozen GPT-Neo 1.3B, and formalizes retrieval with standard RAG notation using $k$0. However, it does not specify a distinct learned or rule-based filtering module beyond multimodal retrieval and top-$k$1 selection, so its “filter” is better interpreted as informed multimodal retrieval than as a separate evidence filter in the stronger ML-FilterRAG sense (Sarwar, 25 Feb 2025).

4. Evaluation criteria and system-level trade-offs

The literature shows that ML-FilterRAG is not optimized against a single objective. Precision, recall, robustness, privacy, cost, and downstream answer quality often move in different directions. The relevance-grader paper makes this explicit: hard post-retrieval gating can substantially increase precision, but it may also suppress useful borderline documents and harm completeness, as reflected in the recall drop from 0.9176 to 0.6670 for the best 1B grader (Jeong, 17 Jun 2025).

A stronger structural critique comes from work on noise robustness in RAG. That paper argues that filtering irrelevant information is inherently difficult because relevance can be “triple-wise,” not merely pairwise, and therefore limited-depth transformer layers cannot be expected to eliminate all noise. It further argues that standard fine-tuning is poorly matched to the goal of strongly suppressing irrelevant tokens while preserving relative attention over relevant tokens. Its proposed remedy is generator-side robustness via a non-linear rectification of the learned attention update,

$k$2

combined with placing the query before the documents in the prompt. On noisy-retrieval evaluations, this improves mean performance over standard LoRA, for example from 40.72 to 42.88 for Llama in the all-retrieved-documents setting and from 72.0 to 74.3 in the explicit-distractor setting. This suggests that explicit retrieval-side filtering and generator-side noise tolerance are complementary rather than interchangeable (Liu et al., 5 Jan 2026).

Privacy introduces a different trade-off. In multi-query private RAG, MuRAG and MuRAG-Ada filter retrieval not only by relevance but also by per-document privacy budget. A document remains in the active set only while its remaining budget permits reuse, and MuRAG-Ada further releases a query-specific threshold via noisy prefix sums. The central claim is that privacy loss can scale with how often each document is retrieved rather than with the total number of queries, and the experiments report meaningful utility over hundreds of queries within a practical privacy budget around $k$3 (Wu et al., 10 Nov 2025).

The empirical consequence is that “better filtering” depends on the deployment criterion. In security, the key metric may be attack success rate. In retrieval grading, it may be precision at the passage gate. In open-set cyber classification, it may be whether pruning leaves sufficiently reliable evidence for a “novel” decision. In privacy-sensitive RAG, the filter is part of the accountant. ML-FilterRAG is therefore better understood as a family of control architectures than as a single optimization recipe.

5. Boundary cases, misconceptions, and terminological instability

A recurring source of confusion is that many RAG systems perform some kind of selection, but not all of them implement an ML-FilterRAG module in a strong sense. The local large-systems RAG paper is a clear non-example: it performs embedding-based retrieval, prompt editing, and human documentation refinement, yet it explicitly lacks learned query-document relevance models, rerankers, metadata filters, classifier-based filtering, confidence scoring, and uncertainty estimation (Naikov et al., 23 Jan 2025).

A second misconception is that the presence of “FilterRAG” in a title guarantees a distinct filtering algorithm. In the multimodal VQA paper, the name refers mainly to multimodal informed retrieval plus grounding-oriented evaluation. The paper gives RAG-style equations for $k$4 and uses top-$k$5 retrieval from Wikipedia and DBpedia, but it does not specify a separate learned selector, thresholding policy, reranker, confidence model, or answer-evidence verifier. The “filter” is therefore only loosely specified (Sarwar, 25 Feb 2025).

A third boundary case involves systems with strong preprocessing or workload-level gating rather than explicit learned relevance filtering. BioModelsRAG uses domain-aware chunking and representation transformation but no learned reranker. CE-RAG4EM reduces cost by blocking similar entity-matching queries, batching retrieval, and sometimes batching generation, which is a powerful form of pre-retrieval filtering and grouping, but it is not a learned filter policy. In both cases, the system suppresses redundancy or irrelevant scope, yet the mechanism is heuristic or structural rather than a trained filter model (Krishnan et al., 30 Jan 2026, Ma et al., 5 Feb 2026).

These distinctions matter because they separate three research questions that are often conflated: whether retrieval should be narrowed, whether the narrowing rule is learned, and whether the generator can still cope with residual noise. Much of the literature supports the first proposition, only part of it addresses the second directly, and several papers argue that the third remains necessary even when filtering is strong.

6. Research directions

Several trajectories emerge from the current literature. Visual RAG identifies failure modes where global embedding similarity is insufficient, notably fine-grained inter-class similarity, small or blurry objects, and multi-label scenes. The paper explicitly suggests that more effective filters should be object-aware, region-aware, label-aware, or task-aware rather than relying only on global image embeddings (Bonomo et al., 18 Jan 2025). This suggests a general shift from holistic similarity toward task-conditioned relevance estimation.

Post-retrieval grading remains underdeveloped as an end-to-end science. The lightweight relevance-grader work shows that a small classifier can approach the precision of much larger models, but it also leaves threshold calibration, confidence estimation, domain transfer, human-labeled evaluation, and end-to-end answer-quality measurement as open issues (Jeong, 17 Jun 2025). A plausible implication is that future ML-FilterRAG systems will need calibrated operating points rather than pure argmax gating.

Domain RAG work points toward richer structural filters. BioModelsRAG explicitly identifies possible extensions such as cross-encoder reranking, metadata filters, hybrid retrieval, section-aware weighting, context compression, structured citations, and GraphRAG (Krishnan et al., 30 Jan 2026). WebFilter suggests that filtering can be learned as a retrieval policy, with reinforcement learning used to decide when to restrict sources, when to relax constraints, and how to use advanced search operators to reduce web noise upstream (Dai et al., 11 Aug 2025).

Finally, generator robustness is likely to remain part of the design space. The noise-filtering paper argues that retrievers cannot be expected to eliminate all irrelevant material, and its results suggest that query-first prompting and non-linear attention rectification can make the generator more selective over mixed evidence (Liu et al., 5 Jan 2026). This suggests that a mature ML-FilterRAG architecture will probably be hybrid: retrieval-time filtering for precision, structured or adaptive reranking for context control, and generator-side robustness for the residual cases that no filter can resolve perfectly.