PRA-RAG slashes RAG attack success rate to 1% with provable defenses

Retrieval-Augmented Generation (RAG) has become a standard way to give LLMs up-to-date knowledge, but it's vulnerable to poisoning attacks that inject malicious text into the retrieved context. A team of researchers from multiple institutions has unveiled PRA-RAG, a new defense that provides provable robustness guarantees against such corruption. Instead of simply filtering or ranking retrieved passages, PRA-RAG samples multiple combinations of texts and leverages geometric structures in the embedding space to identify a robust subset. From that subset, it derives a stable aggregated representation that minimizes the influence of poisoned content. The approach comes with theoretical bounds on the maximum impact an attacker can have, turning RAG's security from a heuristic problem into a quantifiable one.

Experimental results across several benchmarks and RAG architectures show PRA-RAG cuts the attack success rate to as low as 1%, while maintaining a respectable accuracy of 71%. This dramatically outperforms existing state-of-the-art defense methods, which often fail when the LLM has limited prior knowledge of the retrieved content. For professionals deploying RAG in sensitive domains like legal research, finance, or customer support, PRA-RAG offers a practical, mathematically grounded way to protect outputs against adversarial manipulation without sacrificing too much performance.