Knowledge Base Poisoning Attacks and Defense for Policy-Aware LLM-RAG Framework
For IoBT mission control systems relying on LLM-RAG, this work highlights a critical vulnerability and provides an effective, edge-deployable defense against knowledge base poisoning.
The paper introduces a query-agnostic semantic retrieval poisoning attack that corrupts 85% of LLM contexts in a PA-LLM-RAG framework with only 1.6% poisoning rate, and proposes CLD-KB, a dual-detector defense that outperforms five baselines with only 7ms overhead per mission.
This paper presents an adversarial security study of the Policy-Aware LLM Retrieval-Augmented Generation (PA-LLM-RAG) framework for Internet of Battlefield Things (IoBT) mission control. We propose Query-Agnostic Semantic Retrieval Poisoning, a novel attack that injects semantically crafted rules into the IoBT knowledge base achieving high retrieval ranking across all operator query types without requiring knowledge of runtime prompts. The attack achieves 85% LLM context corruption from a single injected rule (1.6% poisoning rate) and saturates at 7.7% poisoning, demonstrating that even minimal knowledge base compromise is sufficient to corrupt mission decisions. To counter this threat, we propose CLD-KB (Cyber-Layered Defense for Knowledge Base), a dual-detector anomaly detection framework combining One-Class SVM boundary detection with a novel Member-Based Category Spread analysis that exploits the three-category IoBT policy taxonomy to identify poisoned rules before they reach the decision LLM. CLD-KB significantly outperforms five baseline methods including DBSCAN, LOF, K-Means, Isolation Forest, and One-Class SVM in both poisoning detection and knowledge preservation, with only 7ms computational overhead per mission, establishing it as an effective and edge-deployable defense for LLM-driven IoBT mission systems.