When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse
This work tackles the critical problem of detecting poisoning attacks in RAG systems, which is important for ensuring the reliability and trustworthiness of large language models for all users.
This paper addresses the vulnerability of Retrieval-Augmented Generation (RAG) systems to poisoning attacks, where adversarial documents manipulate generator outputs. The authors identify "Attention Collapse" as a unique signature of such attacks, where attention concentrates on poisoned documents, and propose D-SCAN, a lightweight detection framework that monitors these attention dynamics.
Retrieval-augmented generation (RAG) is indispensable for enhancing large language models. However, RAGs are increasingly susceptible to poisoning attacks, in which adversarial documents are injected to manipulate generator outputs. Previous methods rely on output-side signals such as perplexity and consistency checks to detect such attacks. Nevertheless, our analysis reveals that deliberate attacks often induce false confidence, where poisoned outputs exhibit even lower perplexity than benign ones, rendering uncertainty-based detection ineffective. To address this challenge, we explore the internal dynamics of the generator and identify a distinctive signature termed \textit{Attention Collapse}. Unlike the dispersed attention in benign generations, attacked generations exhibit a decrease in entropy as attention concentrates on poisoned documents. Building on these findings, we propose \texttt{D-SCAN} (Document-level Signal Collapse Analysis), a lightweight detection framework that monitors attention dynamics to identify attacked generations. Extensive experiments on multiple attack benchmarks demonstrate the effectiveness of our method. Moreover, D-SCAN can detect attacks even when they fail to alter the final answer. Code is available at https://github.com/yingtaoren/D-Scan.git.