Retrieval-Augmented Defense (RAD)

• RAD is a security framework that augments retrieval-based generation with sanitization and filtering to mitigate adversarial poisoning, prompt injection, and leakage risks.
• It employs methods like document scoring, re-ranking, masking, and graph-based inference to ensure the integrity and confidentiality of retrieved evidence.
• Empirical studies show that RAD can significantly reduce attack success rates while maintaining robust answer accuracy across dynamic, multi-stage RAG pipelines.

Retrieval-augmented defense (RAD) is the general idea of augmenting the retrieval phase with mechanisms to assess and sanitize evidence before it is passed to the generator, with the aim of filtering or downweighting adversarial or low-quality documents, exploiting cross-document and cross-time consistency, and providing robustness guarantees against poisoning and injection in retrieval-augmented generation (RAG) systems (Chen et al., 21 May 2026). In the broader security literature, the term also encompasses input-stage, retrieval-stage, generation-stage, and output-side mitigations for privacy, integrity, and leakage risks in multi-module RAG pipelines (Qi et al., 10 Feb 2026, Mu et al., 23 Mar 2026).

1. Formal model and conceptual scope

A standard RAG system consists of a retriever $R$ and a generator $G$. Given a query $q$ and corpus $C$, the retriever returns top-$k$ relevant documents

$D = R(q, C) = \{d_1, d_2, \dots, d_k\},$

and the generator produces an answer

$a = G(q, D).$

In dynamic settings, retrieval and generation vary over discrete time steps,

$D(t)=R(q), \qquad a(t)=G(q, D(t)),$

so both evidence quality and ground truth may drift over time (Chen et al., 21 May 2026).

Within this formalism, RAD can be understood in a narrow and in a broad sense. In the narrow sense, it is a context-sanitization layer inserted between retrieval and generation: retrieved documents are scored, filtered, re-ranked, or transformed before they reach the LLM. In the broader sense, it is a pipeline-level security architecture spanning query intake, retrieval, prompt construction, generation, and post-processing. The benchmark literature explicitly describes a RAD stack containing Query Block, Threshold defense, System-Block, and Summary defense (Qi et al., 10 Feb 2026), while the survey literature frames secure RAG as a workflow containing vector database construction, retrieval, reranking, prompt construction, and generation, each with distinct attack surfaces and defense points (Mu et al., 23 Mar 2026).

This broader interpretation is significant because many failure modes arise before or after retrieval proper. Retrieval corruption, knowledge extraction, embedding inversion, and content leakage all exploit the fact that RAG couples an external corpus to an LLM through a retrieval interface. A plausible implication is that RAD is best treated not as a single algorithmic primitive but as a family of retrieval-centric security controls whose common purpose is to prevent unsafe or confidential evidence from becoming trusted generation context.

2. Threat models and attack surfaces

The canonical RAD threat model begins with corpus-based attacks against RAG. In dynamic web retrieval, the central cases are Prompt Injection Attacks (PIA), in which malicious instructions are embedded in retrieved text, and corpus poisoning attacks, in which deceptive but plausible-looking documents are inserted into the corpus so that they rank highly for chosen queries (Chen et al., 21 May 2026). Dynamic settings exacerbate these attacks through temporal volatility, evolving attack scale, and changing ground truth; a defender may not know when poisoning occurs, how many malicious documents are present, or whether a new answer reflects a genuine knowledge shift rather than adversarial manipulation (Chen et al., 21 May 2026).

A second major threat family is knowledge extraction. The extraction benchmark models a multi-round attacker that submits queries

$\mathcal{Q}=\{\mathcal{Q}^t\}_{t=1}^{T},$

collects retrieved sets $\{\mathcal{R}^t\}$ and generated answers $G$0, and seeks high coverage of a target subset $G$1 with minimal irrelevant leakage. Each query is decomposed into an INFORMATION component $G$2, which steers retrieval toward $G$3, and a COMMAND component $G$4, which instructs the generator how to reproduce retrieved content (Qi et al., 10 Feb 2026). This benchmark includes RandomText, RandomToken, RandomEmb, DGEA, CopyBreak, and IKEA on the retriever side, together with SMPL, MED, CPLX, and JAILBREAK command designs on the generator side (Qi et al., 10 Feb 2026).

A third threat family targets the retrieval layer itself. The medical-domain study on universal poisoning shows that poisoned documents constructed as

$G$5

can be consistently retrieved at high rank across corpora, retrievers, query sets, and targeted information types (Xian et al., 2024). Its central geometric explanation is the orthogonal augmentation property: appending approximately orthogonal targeted information $G$6 to a query leaves the poisoned document unusually close to the query in inner-product space, often closer than clean retrieved documents (Xian et al., 2024). This explains why dense retrievers can be systematically manipulated without modifying model parameters.

The survey and cryptographic literature extend the threat surface further to membership inference, embedding inversion, content leakage, and knowledge base poisoning against both public and private stores (Mu et al., 23 Mar 2026, Zhou et al., 1 Aug 2025). In that setting, RAD is not limited to content sanitization; it also includes access control, encrypted retrieval, differential privacy, federated isolation, and lightweight masking (Mu et al., 23 Mar 2026). A useful synthesis is that RAD addresses both integrity failures, where the retriever surfaces poisoned evidence, and confidentiality failures, where retrieved evidence or embeddings expose proprietary or private knowledge.

3. Defense architectures and representative mechanisms

The current literature contains a heterogeneous but increasingly structured RAD design space. Representative systems include Query Block, Threshold defense, System-Block, and Summary defense (Qi et al., 10 Feb 2026); retrieval-stage defenses such as RAGPart and RAGMask (Pathmanathan et al., 30 Dec 2025); sentence-level context sanitization in EcoSafeRAG (Yao et al., 16 May 2025); ranking-structural filtering in BiRD (Gao et al., 19 May 2026); non-parametric poisoning detection in RAGuard (Cheng et al., 28 Oct 2025); dual-path extraction defense in RAGFort (Li et al., 13 Nov 2025); and cryptographic protection of content and embeddings in SAG (Zhou et al., 1 Aug 2025).

Layer or objective	Representative systems	Core mechanism
Input gating	Query Block; RAD for jailbreak prevention	intent classification; retrieval of known jailbreak exemplars and harmfulness threshold
Retrieval filtering	Threshold defense; RAGPart; RAGMask; RAGuard	similarity thresholding; partition-and-aggregation; token masking; perplexity and text-similarity filtering
Context-structure analysis	EcoSafeRAG; BiRD; RADAR	bait-guided context diversity; bidirectional ranking consistency; graph-based energy minimization
Dynamic control	RADAR memory node; Sentinel-Strategist	Bayesian belief update; query-aware defense selection
Privacy and extraction resistance	System-Block; Summary defense; SAG; RAGFort	summarization and refusal policies; encryption and access control; dual-path isolation and cascade generation

At the input stage, Query Block is an LLM-based intent classifier that rejects explicit extraction attempts before they reach the retriever or generator. In the extraction benchmark it completely blocks explicit COMMAND-based attacks such as R-TK, R-EB, R-TT, DGEA, and CopyBreak, but has no effect on stealthy IKEA-style benign-looking queries (Qi et al., 10 Feb 2026). The same paper defines Threshold defense,

$G$7

which produces a security–utility trade-off: $G$8 yields moderate defense with acceptable QA recall, while $G$9–$q$0 drives retrieval extraction effectiveness nearly to zero at the cost of sharply reduced benign utility (Qi et al., 10 Feb 2026).

At the retrieval stage, RAGPart and RAGMask both operate directly on the retriever and require no modification to the generation model. RAGPart partitions documents into fragments, embeds fragments individually, and averages fragment embeddings across combinations,

$q$1

so poisoned fragments are diluted rather than dominating raw-text embeddings. RAGMask instead measures similarity shifts under targeted masking and permanently masks segments whose removal does not significantly harm query relevance, using the criterion

$q$2

Both defenses consistently reduce ASR across HotFlip, Query-as-poison, and AdvRAGgen, with RAGMask generally preserving higher success rate on benign retrieval (Pathmanathan et al., 30 Dec 2025).

EcoSafeRAG moves the granularity down to the sentence level. It segments each retrieved passage into sentences, screens high-similarity core sentences, embeds sentence contexts with BAAI/bge-large-en-v1.5, and uses bait-guided DBSCAN clustering to detect low-diversity or templated malicious contexts (Yao et al., 16 May 2025). Because it relies on sentence-level processing and bait-guided context diversity detection rather than on LLM internal knowledge, it is presented as an external RAD mechanism rather than an LLM-internal denoiser (Yao et al., 16 May 2025).

BiRD argues that prior defenses focus on semantic relevance while neglecting retrieval context defined by ranking structure. It combines forward ranking relevance $q$3 with backward ranking consistency, quantified as a Spearman correlation between the query’s forward ranking and each candidate document’s backward ranking. Its composite score is

$q$4

where high content relevance coupled with high forward–backward alignment is treated as suspicious (Gao et al., 19 May 2026). This directly targets a ranking-level signal induced by poisoning.

RAGuard expands the retrieval scope from top-$q$5 to top-$q$6, computes chunk-wise perplexity difference,

$q$7

perplexity maximum,

$q$8

and text similarity

$q$9

and then applies empirical percentile thresholds derived from a random subset of the database (Cheng et al., 28 Oct 2025). The defense is non-parametric and explicitly designed to detect poisoned texts without retraining the underlying retriever or LLM.

RAGFort addresses proprietary knowledge-base extraction through a different lens. It decomposes reconstruction into inter-class and intra-class paths, then combines contrastive reindexing for inter-class isolation with constrained cascade generation for intra-class protection (Li et al., 13 Nov 2025). On the retrieval side it uses HDBSCAN pseudo-labels and supervised contrastive learning to rebuild a structure-aware index; on the generation side it mixes a draft model $C$0 and reference verifier $C$1 through

$C$2

where the rejection rule is derived from a constrained optimization problem balancing quality, divergence, and sensitivity (Li et al., 13 Nov 2025).

Finally, SAG relocates RAD into the cryptographic substrate. It encrypts both textual content and vector embeddings before storage, protects per-user private stores with AES-CBC, HKDF-based key derivation, HMAC, and Authdoor entries, and reconstructs private databases only for authenticated users inside a trusted environment (Zhou et al., 1 Aug 2025). This turns retrieval itself into an access-controlled cryptographic boundary rather than merely a semantic ranking layer.

4. Graph-based, dynamic, and orchestration-based RAD

RADAR is the clearest example of RAD formulated as exact inference over a structured reliability model. It casts reliable context selection as a binary Markov Random Field over retrieved documents $C$3, with energy

$C$4

where the unary term

$C$5

encodes document trustworthiness and the pairwise term

$C$6

penalizes inconsistent labels for semantically consistent documents (Chen et al., 21 May 2026). Atomic answers are generated per document, NLI is used to compute entailment and contradiction matrices $C$7 and $C$8, eigenvector centrality identifies consensus structure, and the resulting submodular Potts-like energy is minimized exactly via Max-Flow Min-Cut (Chen et al., 21 May 2026). The final sanitized context is further pruned by an embedding-based outlier filter with default $C$9 (Chen et al., 21 May 2026).

RADAR’s distinct contribution is its dynamic mode. At time $k$0, it augments the graph with a Bayesian memory node representing the previous answer $k$1. The memory node receives source and sink capacities from posterior correctness and incorrectness probabilities computed by Bayes’ rule from prior beliefs and new evidence consistency or conflict (Chen et al., 21 May 2026). This yields a recursive belief update that replaces storing raw historical documents; storage per query drops from tens of MB to roughly a 1 KB belief state, while the mechanism remains stable against brief poisoning and plastic enough to adapt to genuine knowledge shifts (Chen et al., 21 May 2026).

A different dynamic-control view appears in the Sentinel-Strategist architecture. Instead of fixing a static defense stack, it separates a data plane with policy enforcement points from a control plane containing a Sentinel that detects anomalous retrieval behavior and a Strategist that selectively deploys only the defenses warranted by the query context (Pallerla et al., 22 Apr 2026). The Sentinel uses pre-retrieval metrics such as lexical overlap, complexity score, and intent velocity, and post-retrieval metrics such as vector dispersion and score drop-off, together with a global trust score updated as

$k$2

to estimate membership inference, poisoning, and leakage risk (Pallerla et al., 22 Apr 2026). The Strategist then decides whether to enable DP-RAG, TrustRAG, or attention-variance filtering and how strongly to parameterize them (Pallerla et al., 22 Apr 2026).

A useful implication of these systems is that RAD has moved beyond local document heuristics. The newer frameworks model either global agreement structure, temporal belief state, retrieval-context geometry, or per-query defense orchestration. This suggests an architectural shift from single-pass filtering toward structured inference and adaptive control.

5. Evaluation methodology and empirical performance

RAD evaluation is now multi-objective. The extraction benchmark disentangles Retriever Extraction Effectiveness $k$3, Generator Extraction Effectiveness $k$4, combined end-to-end extraction effectiveness $k$5, and Attack Success Rate (ASR) (Qi et al., 10 Feb 2026). Other papers report Answer Accuracy (Acc.), Attack Success Rate (ASR), Detection Accuracy (DACC), False Positive Rate (FPR), False Negative Rate (FNR), Output Accuracy (OACC), Chunk Recovery Rate (CRR), contextual recall, contextual relevancy, answer relevancy, faithfulness, runtime, and storage overhead (Cheng et al., 28 Oct 2025, Li et al., 13 Nov 2025, Pallerla et al., 22 Apr 2026, Mu et al., 23 Mar 2026). This metric diversification reflects the fact that RAD is judged simultaneously on integrity, confidentiality, utility, and efficiency.

The dynamic-defense literature has introduced dedicated benchmarks. RADAR constructs a benchmark with 500 open-domain questions whose ground-truth answers change over time; 77.8% of questions have at least one answer change and 68.3% change between adjacent years (Chen et al., 21 May 2026). On RealTimeQA, top-$k$6, DeepSeek, and PIA at position 1, Vanilla RAG obtains Acc 35.0% and ASR 65.0%, RobustRAG obtains Acc 69.0% and ASR 9.0%, and RADAR obtains Acc 72.0% and ASR 5.0% (Chen et al., 21 May 2026). In dynamic cumulative-snapshot evaluation under PIA at position 1, RADAR reaches Acc 69.41% and ASR 7.22%, compared with 66.28% and 11.00% for RobustRAG (Chen et al., 21 May 2026).

EcoSafeRAG reports that, across all datasets and models, it reduces ASR to 0–3%, improves clean accuracy by up to 23% on Vicuna and by about 5–9% on Llama2 and Llama3, reduces token usage by 48–80%, and adds about 1.16–1.2× latency relative to Vanilla RAG (Yao et al., 16 May 2025). BiRD reports that it reduces the attack success rate of PoisonedRAG by up to 54% while simultaneously improving task accuracy by up to 56%, with average additional latency under 1 second (Gao et al., 19 May 2026). RAGFort reports Relative Mean CRR of $k$7 the unprotected baseline, compared with $k$8 for re-ranking and $k$9 for summarization, while keeping ACC drops below 2 percentage points across its main settings (Li et al., 13 Nov 2025).

RAGuard reports particularly strong document-level detection performance. Under PoisonedRAG on NQ, it achieves DACC 0.962, FPR 0.028, FNR 0.038, and OACC 0.999; on MS-MARCO it reports DACC 0.924, FPR 0.039, FNR 0.076, and OACC 0.973 (Cheng et al., 28 Oct 2025). Against adaptive attacks based on GPT-4 paraphrasing or human rewriting, DACC remains above 0.92 and OACC remains high across all five evaluated corpora (Cheng et al., 28 Oct 2025).

Adaptive orchestration results show the cost of naive defense composition. In Sentinel-Strategist experiments, an always-on full defense stack reduces contextual recall by more than 40%, with drops of 41.0% on Natural Questions, 46.4% on PubMedQA, and 41.6% on TriviaQA, whereas the strongest ADO variants eliminate MBA-style membership inference leakage, reduce poisoning success to near zero, and restore contextual recall to more than 75% of the undefended baseline under data poisoning (Pallerla et al., 22 Apr 2026). This is one of the clearest empirical demonstrations that RAD performance depends not only on the strength of individual components but on how and when they are activated.

6. Limitations, terminology variants, and research directions

RAD remains constrained by several recurrent failure modes. RADAR depends on retrieval and NLI quality; if benign evidence is too sparse or noisy, the consensus cluster can itself be wrong, and dynamic failures arise when only one informative document is available or when centrality favors incomplete answers (Chen et al., 21 May 2026). RAGPart and RAGMask explicitly do not solve semantic misinformation that is already natively retrievable without poison tokens, because dense retrievers encode semantic similarity rather than factual correctness (Pathmanathan et al., 30 Dec 2025). EcoSafeRAG depends on dataset-specific DBSCAN $D = R(q, C) = \{d_1, d_2, \dots, d_k\},$0 and on the continued relevance of hand-designed bait patterns (Yao et al., 16 May 2025). Sentinel-Strategist remains sensitive to controller choice and leaves latency and long-horizon multi-turn attacks as open questions (Pallerla et al., 22 Apr 2026). SAG assumes trusted execution environments and does not resolve SGX-style side channels, cross-user collaborative retrieval, or graph-based KAG settings (Zhou et al., 1 Aug 2025). The survey literature correspondingly emphasizes the need for standardized end-to-end benchmarks, compositional privacy guarantees, and more formal treatment of retrieval robustness under adaptive attacks (Mu et al., 23 Mar 2026).

The acronym itself has become polysemous. In one line of work, "Retrieval-Augmented Defense" names a jailbreak-prevention framework that maintains a database of known jailbreak attack examples, retrieves similar exemplars for an incoming prompt, infers the underlying malicious query and jailbreak strategy, and classifies harmfulness via a thresholded probability $D = R(q, C) = \{d_1, d_2, \dots, d_k\},$1 (Yang et al., 22 Aug 2025). In another, retrieval-augmented detection is applied to audio deepfake detection by retrieving similar bonafide audio samples and comparing them to a query sample through a RAD-MFA classifier (Kang et al., 2024). These usages are adjacent rather than identical: the common motif is retrieval of safety-relevant exemplars, but the protected object differs across jailbreak detection, audio forensics, and RAG hardening.

Within RAG security specifically, the most stable interpretation of RAD is retrieval-centric hardening of a multi-module system. The field now includes exact graph-cut sanitization, ranking-structural filtering, sentence-level diversity analysis, dynamic belief states, query-aware orchestration, encryption and access control, and dual-path protection against corpus extraction. A plausible implication is that future RAD systems will increasingly combine these strands: structure-aware retrieval, adaptive control, privacy-preserving storage, and output-side leakage constraints, all evaluated against poisoning, extraction, prompt injection, membership inference, and reconstruction in a single end-to-end framework.