Provably robust RAG: aggregating retrieved passages to survive poisoning

What is this?

On May 8, 2026, Xue Tan and colleagues published PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption on arXiv (2607.00012, cs.IR/cs.AI). It tackles a problem that has haunted retrieval-augmented generation since its adoption: an attacker who can slip even a few malicious passages into the corpus a system retrieves from can steer the model’s answer. PRA-RAG is a defense — a retrieval-aggregation algorithm that comes with theoretical bounds on how much poisoned content can affect the final output, rather than the usual “we tried it and it seemed to help” empirical guarantee.

Corpus poisoning is a well-documented class of attack (see our earlier coverage of poisoning that survives re-ranking and silent corpus poisoning). What is new here is a defense that quantifies its own worst case.

How it works

A standard RAG pipeline retrieves the top-k passages most similar to a query and concatenates them into the model’s context. That design has an obvious weakness: retrieval is a similarity contest, and an attacker who writes a passage tuned to a target query can win a slot in the top-k. Once inside the context, the poisoned passage competes with the legitimate ones for the model’s attention. The authors note that existing defenses “lack theoretical robustness guarantees and perform unreliably when the LLM has limited knowledge of the retrieved content” — that is, precisely when RAG is doing its job of supplying facts the model does not already hold.

PRA-RAG changes the aggregation step rather than the retrieval step. Instead of trusting a single top-k set, it samples multiple combinations of retrieved passages and looks at where each combination lands in the embedding space. Because a small number of poisoned passages can only distort a bounded fraction of those sampled combinations, the genuine passages form a dense cluster while poisoned outliers scatter. PRA-RAG uses that geometric structure to identify a robust subset and derives a stable aggregated representation from it. From this construction the authors derive a bound on the maximum impact of poisoned content and a quantitative robustness measure for a given RAG configuration — the number of passages an adversary would need to control to move the answer.

The reported results are strong: across multiple benchmarks and RAG architectures, PRA-RAG drives the attack success rate as low as 1% while holding clean-task accuracy at 71%, outperforming representative state-of-the-art defenses. As always with a single paper, treat the exact figures as the authors’ measurements under their evaluation setup rather than a universal guarantee.

Why it matters

RAG is now the default way to give an LLM access to private or up-to-date knowledge, which means the retrieval corpus is an attack surface in every serious deployment: support knowledge bases, internal wikis, ticket histories, and any pipeline that ingests documents a user or third party can influence. When retrieval feeds an agent that can then act, a poisoned passage stops being a wrong answer and becomes a foothold — one leg of the lethal trifecta. Most deployed defenses are heuristic filters or re-ranking tweaks with no way to say how much poisoning they can actually absorb. A defense that produces a numeric robustness budget lets a security team reason about the corpus the way they reason about any other trust boundary: how many malicious documents would it take to flip this system, and is that number larger than an attacker’s plausible write access?

Defenses

PRA-RAG itself is the headline mitigation, but the design points to controls any team can apply now. Treat robust aggregation as a layer: do not let a single retrieved passage decide an answer — sample and cross-check multiple retrieval subsets and prefer the consensus, which is the intuition PRA-RAG formalizes. Keep the certified-robustness mindset by asking, for each RAG surface, how many poisoned documents would be needed to change outputs, and drive that number up with corpus hygiene: authenticate document provenance, restrict who can write to the retrieval corpus, and quarantine freshly ingested or externally sourced content until reviewed. Pair aggregation with the defenses covered previously on this site — hybrid retrieval that resists poisoning and token-influence tracing — so that a passage which slips past retrieval still has to survive attribution at generation time. Finally, keep the downstream agent least-privileged: robust retrieval reduces the odds of a poisoned answer, but a compromised answer should never be able to trigger an irreversible action without a human or a second check.

Status

PRA-RAG is a research disclosure (arXiv:2607.00012, submitted May 8, 2026), released under CC BY 4.0 with theoretical analysis and benchmark evaluation rather than any weaponized attack. It is a defensive contribution: there is no exploit to patch and no product advisory attached. Teams running RAG should read it as a template for measuring corpus robustness, and as a reminder that the retrieval store deserves the same integrity controls as any other input an LLM is told to trust. For broader context on the attack landscape it defends against, the authors’ framing aligns with the 2026 RAG security taxonomy of attacks and defenses.