Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution
Provides a lightweight detection method for corpus poisoning attacks in RAG systems, reducing computational overhead compared to existing approaches.
TRACE detects corpus poisoning attacks in RAG systems by tracing answer-related tokens via token influence attribution, achieving strong detection performance across three QA benchmarks and six LLMs while uncovering attacker-specified target answers.
Retrieval-Augmented Generation (RAG) systems are vulnerable to corpus poisoning attacks that manipulate model outputs through malicious retrieved documents. Existing detection methods typically rely on auxiliary classifiers or additional LLM-based verification, introducing substantial computational overhead. We present TRACE, a lightweight detection framework that identifies poisoning attacks by tracing answer-related tokens through token influence attribution. TRACE first discovers recurrent high-influence keywords across retrieved documents and then performs a secondary verification to confirm their influence on model predictions. Experiments on three QA benchmarks and six LLMs demonstrate strong detection performance while simultaneously uncovering attacker-specified target answers.