RADAR: Defending RAG Dynamically against Retrieval Corruption
Ziyuan Chen 1 Yueming Lyu 1 Yi Liu 2 Weixiang Han 1 Jing Dong 3 Caifeng Shan 1 Tieniu Tan 1
arXiv:2605.22041v1 [cs.CR] 21 May 2026
Abstract
updated information from evolving sources such as the web. A prominent application is LLM-augmented search engines: a web search engine retrieves documents relevant to the user’s query, and the retrieved content is fed into an LLM to produce a final response grounded in that evidence. Notable examples include Deepseek (DeepSeek-AI, 2024), ChatGPT (OpenAI, 2024), and Grok (xAI, 2025).
While RAG systems are increasingly deployed in dynamic web search, temporal volatility amplifies their vulnerability to adversarial attacks. Existing static-oriented defenses struggle to handle evolving threats and incur prohibitive storage costs in dynamic settings. We propose RADAR, a framework that models reliable context selection as a graph-based energy minimization problem, solved exactly via Max-Flow Min-Cut. By incorporating a Bayesian memory node, RADAR recursively updates a belief state instead of archiving raw historical documents, effectively balancing stability against attacks with adaptability to genuine knowledge shifts. Experiments on a novel dynamic dataset show that RADAR achieves superior robustness and response quality with minimal storage overhead compared to the baselines. Codes are available at https://github. com/Etherealllllll/RADAR_code.
Despite its potential, RAG-based web search remains vulnerable to adversarial attacks. Specifically, corpus poisoning (Zou et al., 2025; Hu et al., 2026) and prompt injection (Clop & Teglia, 2024) can manipulate LLMs into generating incorrect or malicious outputs. In dynamic settings, these threats are compounded by temporal volatility, such as mutating or transient content, leading to continuous corruption. This expanded attack surface necessitates defenses that are resilient not only to static attacks but also to evolving adversarial strategies. Existing defense mechanisms are largely designed for static settings. Heuristic aggregation or filtering (Xiang et al., 2024) often causes utility loss, while optimization-based consistency selection (Shen et al., 2025) typically relies on approximations without strong guarantees. While they alleviate certain vulnerabilities and can be naively extended to dynamic settings, such adaptations are often suboptimal. Without explicit consideration of temporal dynamics, these methods fail to maintain robust performance against continuously mutating threats, resulting in a significant drop in defensive efficacy within dynamic web search contexts.
1. Introduction Large Language Models (LLMs) have demonstrated remarkable capabilities in natural language understanding and generation. However, they remain prone to generating hallucinated or ungrounded content when faced with knowledge-intensive queries. Retrieval-Augmented Generation (RAG) (Lewis et al., 2020b; Guu et al., 2020; Asai et al., 2024) addresses this by incorporating external evidence retrieval into the generation process. Early RAG systems operated in static settings with a fixed corpus as the knowledge base. More recently, research has shifted toward dynamic RAG-based web search (Reddy et al., 2025; Arora et al., 2025; Zhu, 2025), which continuously absorbs
To address these gaps, we introduce RADAR, a robust framework for dynamic RAG. It formulates reliable context selection as a graph-based energy minimization problem, solved exactly via max-flow Min-Cut. RADAR utilizes a Bayesian memory node to recursively update a belief state, enabling the system to weigh historical consistency against new evidence. This design effectively resolves the stabilityplasticity dilemma, balancing stability against attacks with adaptability to legitimate knowledge shifts.
1 School of Intelligence Science and Technology, Nanjing University, Suzhou, China 2 City University of Hong Kong, Hong Kong, China 3 Institute of Automation, Chinese Academy of Sciences, Beijing, China. Correspondence to: Yueming Lyu <[email protected]>, Yi Liu <[email protected]>, Caifeng Shan <[email protected]>.
Our contributions are summarized as follows: • We propose RADAR, which models RAG defense as a Min-Cut problem, delivering exact and efficient inference with superior robustness against corpus-based attacks. • We design a novel dynamic graph construction augmented with a Bayesian memory node. To the best of our knowl-
Proceedings of the 43 rd International Conference on Machine Learning, Seoul, South Korea. PMLR 306, 2026. Copyright 2026 by the author(s).
1
RADAR: Defending RAG Dynamically against Retrieval Corruption
edge, this is the first defensive approach explicitly tailored for continuous time-step attacks. By maintaining a recursive belief state, RADAR achieves an effective balance between historical consistency and newly observed evidence.
robustness. CRAG (Xiang et al., 2024) utilizes lightweight evaluators to trigger corrective actions like web search for reliability, while RA-RAG (Hwang et al., 2025) assesses source credibility and applies weighted majority voting for reliability-aware aggregation.
• We construct a comprehensive dataset for dynamic RAG security, simulating evolving adversarial scenarios. Extensive experiments demonstrate that RADAR achieves superior defense success rates and response quality compared to existing baselines in both static and dynamic scenarios.
Adversarial Defense Strategies aim to mitigate retrieval corruption and ensure reliability. RobustRAG (Xiang et al., 2024) provides certifiable robustness via formal proofs; InstructRAG (Wei et al., 2025) enables retrieval denoising through self-synthesized rationales. AstuteRAG (Wang et al., 2025) consolidates internal LLM knowledge with retrieved data to resolve conflicts, while ReliabilityRAG (Shen et al., 2025) uses MIS algorithm to filter malicious content with provable guarantees. However, extending these static defenses to dynamic settings often incurs high storage overhead and suboptimal performance.
2. Related Work 2.1. Attacks against RAG-based Web Search Retrieval-Augmented Generation (RAG) systems are vulnerable to adversarial attacks (Bagwe et al., 2025; Chaturvedi et al., 2025; Cho et al., 2024; Jiao et al., 2025; Nazary et al., 2025) that exploit their reliance on external retrieval. We focus on corpus-based attacks, which can be commonly grouped into Prompt Injection Attacks (PIA) and Corpus Poisoning Attacks.
3. Background and Defense Goals 3.1. RAG Workflow Static Workflow. A standard RAG system consists of a retriever R and a generator G (typically an LLM). Given a user query q, the retriever searches a corpus C to return a set of top-k relevant documents (or passages):
Prompt Injection Attacks embed malicious instructions in retrieved documents to override system prompts and hijack outputs. For instance, Backdoored Retrievers (Clop & Teglia, 2024) use implanted backdoors to prioritize injectioncarrying passages for link insertion or DoS hijacking. Similarly, Hidden Parrot et al. (Prompt Security, 2025) poisons vector stores to covertly steer generation via similarity search.
D = R(q, C) = {d1 , d2 , ..., dk }.
(1)
The generator then produces an answer a based on the query and the retrieved context: a = G(q, D).
(2)
The goal is for D to provide reliable external knowledge that grounds the LLM’s response and reduces hallucinations.
Corpus Poisoning Attacks inject deceptive documents into knowledge bases to manipulate retrieved contexts and downstream outputs. For instance, PoisonedRAG (Zou et al., 2025) optimizes minimal injections for effective knowledge corruption, while BadRAG (Xue et al., 2024) poisons the retrieval process to induce harmful generations. Furthermore, Topic-FlipRAG (Gong et al., 2025) employs twostage perturbations to reverse topic-specific opinions, and DeRAG (Wang & Yu, 2025) leverages black-box differential evolution to hijack rankings across diverse RAG systems.
Dynamic Workflow. In real-world applications, a RAG system typically relies on web search, so its evidence corpus is a continuously evolving set of documents returned by the search engine rather than a fixed local collection. We consider a dynamic setting over discrete time steps t ∈ {0, 1, . . . , T }. At each step, the retriever returns the top-k documents D(t) = R(q), and the generator produces an updated answer a(t) = G(q, D(t) ) to reflect the most recent information. The key challenge is to maintain both accuracy and robustness when the reliability of D(t) varies over time.
2.2. Defenses RAG systems have inspired a range of robustness-enhancing frameworks, which can be broadly categorized into two classes: document filtering prior to generation and defenses against adversarial attacks.
3.2. Threat Model Attacker’s Goal. The attacker aims to induce the LLM to produce incorrect answers that directly contradict the ground truth. For a factual query like “Who is the CEO of Company X?”, the attacker seeks to mislead the model into outputting a wrong name, which is an adversarial target.
Document Pre-processing and Filtering evaluates and refines retrieved content prior to generation. Self-RAG (Asai et al., 2024) employs reflection tokens for adaptive retrieval and self-critique to boost quality; Chain-of-Note (Yu et al., 2024) generates reading notes to filter noise and enhance
Attacker’s Background Knowledge. In practice, attackers can often infer a target RAG system’s external knowledge 2
RADAR: Defending RAG Dynamically against Retrieval Corruption
Figure 1. Overview of RADAR. It generates an atomic answer for each retrieved document, scores entailment and contradiction using an NLI model, and applies an s-t Min-Cut to select a consistent, reliable subset for final answer generation. The dynamic variant augments the graph with a memory node to balance stability and plasticity across time steps.
sources (e.g., Wikipedia) through repeated interactions, enabling them to craft malicious knowledge artifacts. They also understand standard RAG workflows, common retrieval methods and similarity metrics. However, they only have black-box query access: no model parameters, no retriever or generator modification, and no ability to intercept or manipulate user queries.
RAG (see Figure 1). RADAR first generates an atomic answer for each retrieved document and computes entailment (M ) and contradiction (C) matrices using an NLI model (He et al., 2023). These semantic relations are encoded into an s-t graph, and a Min-Cut partitions the document nodes into source and sink sets; the source-side nodes are retained as reliable evidence for answer generation (§4.1–4.2). In dynamic settings, RADAR introduces a memory node representing the previous answer, with terminal edges updated via Bayesian inference. This enables the system to adaptively retain or discard historical information in response to new evidence, effectively balancing the stability–plasticity trade-off (§4.3).
Attacker’s Capabilities. The attacker can inject and optimize malicious passages in the external corpus C to maximize retrieval likelihood, keeping the attack covert at the system-state level: defenders is largely unaware of whether an attack is happening, how many documents are poisoned (denoted by k ′ or kt ), or which retrieved items are poisoned. Attack Scenarios. We categorize attacks into static and dynamic settings based on whether the adversary can continuously inject malicious documents into the RAG system. In the static setting, the attacker performs a one-time injection into a fixed corpus snapshot, resulting in a constant number of malicious documents in retrieval. In the dynamic setting, the attacker adapts over time, causing the number of malicious retrieved documents kt , and thus the attack scale, to vary across time steps.
4.1. Reliable Subset Formulation Given a user query q and a set of retrieved documents D = {d1 , d2 , . . . , dk }, our goal is to select a subset of reliable documents Drel ⊆ D to generate the final answer. We use binary labeling to annotate whether each document is trustworthy. Let y = {y1 , y2 , . . . , yk } be a label vector, where yi = 1 indicates that the document di is correct and reliable, and yi = 0 indicates it is incorrect and unreliable. To assign a label yi to each document di , we propose to minimize an energy function E(y), formulated as a Markov Random Field (MRF) to find the Maximum A Posteriori (MAP) estimate (Boykov et al., 2002), which balances individual document confidence with pairwise consistency:
3.3. Defense Goals RADAR’s main objective is to sanitize the retrieved context D before feeding it to the generator, thereby ensuring robustness: the RAG system should maintain high utility by correctly answering queries based on Dclean while effectively neutralizing the influence of Dadv , achieving both high response accuracy and low Attack Success Rate (ASR).
min E(y) =
k X i=1
ψu (yi ) +
X
ψp (yi , yj ).
(3)
i,j
Here, unary potential ψu (yi ) represents the cost of assigning a label yi to a document, di and pairwise potential ψp (yi , yj ) represents the penalty for assigning conflicting labels to semantically similar documents. Specifically, ψu (yi )
4. Proposed RADAR Overview. To achieve the above goals, we propose RADAR, a robust defense framework tailored for dynamic 3
RADAR: Defending RAG Dynamically against Retrieval Corruption
is defined as:
documents:
ψu (yi ) = yi · Fi + (1 − yi ) · Si ,
Si = vi · wrank (i),
(4)
to the source side (the “Correct” partition). The denominator serves as a normalization factor.
where Si represents the benefit of labeling di as correct and Fi the benefit of labeling di as incorrect. By minimizing this term, the model assigns yi = 1 whenever Si > Fi , indicating that the document’s reliability exceeds its risk. For ψp (yi , yj ), it is defined using the consistency score Mij : ψp (yi , yj ) = Mij · |yi − yj |.
(6)
where wrank (i) = exp(− ki ). A large Si strongly attracts di
(ii) Sink Edges (di → t). The capacity Fi of a sink edge represents the benefit of filtering document di (i.e., labeling it as incorrect, yi = 0). A higher capacity indicates a stronger push to exclude di from the reliable set, making it costly to cut this edge (which corresponds to retaining the document). We define Fi to quantify the conflict between di and other highly central, and thus presumably reliable, documents in the retrieved set. It is computed as the average contradiction score Cij between di and all other documents dj (j ̸= i), weighted by the centrality vj of dj : P j̸=i Cij · vj Fi = P . (7) j̸=i vj
(5)
This term contributes to the energy cost only when yi ̸= yj , which means one document is labeled correct and the other incorrect, thereby encouraging logical consistency. Thus, this optimization problem is optimized using the MaxFlow Min-Cut theorem (Elias et al., 1956). The proof is provided in Appendix B. By constructing a flow network, the minimum capacity cut directly corresponds to the minimum energy E(y ∗ ). 4.2. Static Defense via Single-Step Min-Cut
Intuitively, if di conflicts with high-centrality documents, Fi becomes large, strongly pushing di towards the sink side (the “Incorrect” partition).
Static Graph Construction. Before static graph construction, we assess the semantic and logical relationships among retrieved documents. For each document di , we prompt an LLM to generate an atomic answer ai and discard di if ai is uninformative. For the remaining documents, we employ an NLI model to compute two matrices: (i) a similarity matrix M ∈ [0, 1]k×k , where Mij quantifies the degree of logical entailment between ai and aj ; and (ii) a conflict matrix C ∈ [0, 1]k×k , where Cij measures their logical contradiction. Details of NLI scoring and atomic answer generation are provided in Appendices D and E. To capture global consensus, we compute the eigenvector centrality v ∈ Rk of M . A higher vi indicates that di is more central to the logical consensus of the retrieved evidence.
(iii) Inter-Document Edges (di ↔ dj ). To enforce consistency between semantically related documents, we connect every pair of document nodes di and dj with a pair of anti-parallel edges, each assigned capacity Mij . This construction emulates an undirected edge with equivalent cut properties: if di and dj are assigned to different partitions, the cut incurs a penalty of Mij , thereby discouraging logical inconsistencies. Here, Mij ∈ [0, 1] is the symmetric consistency score derived from the entailment between the atomic answers of di and dj . Consequently, edges from document nodes to terminals s and t encode the unary potential ψu , while inter-document edges realize the pairwise potential ψp .
Then, we construct a directed graph G = (V, E), where the node set V comprises a source node s, a sink node t, and nodes representing each retrieved document {d1 , . . . , dk }. The edge set E and their capacities are meticulously designed to encode the energy minimization objective from Eq. (3), ensuring an exact correspondence between the graph cut and the target energy E(y). Thus, the edges and their capacities are defined as follows:
Inference via Min-Cut and Answer Generation. Following the graph construction above, we detail the inference and answer generation pipeline: solving the Min-Cut problem, deriving optimal document labels, and producing the final answer from the selected reliable evidence. Any s-t cut partitions the document nodes into a source-side set Vs and a sink-side set Vt , inducing a natural binary labeling: ( 1, di ∈ Vs (correct) yi = . (8) 0, di ∈ Vt (incorrect)
(i) Source Edges (s → di ). The capacity Si of a source edge represents the benefit of retaining a document di (i.e., labeling it as correct, yi = 1). A higher capacity indicates a stronger pull to include di in the reliable set, making it more costly to cut this edge (which corresponds to filtering the document out). We define Si by integrating the document’s eigenvector centrality vi , which reflects its alignment with the global consensus, with a decay function wrank (i) of its original retrieval rank, emphasizing higher-ranked
The total capacity of the cut can be decomposed into three components: P • Pdi ∈Vt Si , corresponding to unary costs ψu (yi = 0); • Pdi ∈Vs Fi , corresponding to unary costs ψu (yi = 1); • di ∈Vs ,dj ∈Vt Mij , corresponding to pairwise penalties ψp (yi ̸= yj ). 4
RADAR: Defending RAG Dynamically against Retrieval Corruption
Thus, the cut capacity is exactly equal to the energy function: Capacity(Cut) = E(y).
Thus, the edge capacities are defined as follows, with edges among retrieved new documents, source, and sink following the same definitions as in Sec. 4.2. The key additions are the edges connected to the memory node a(t−1) :
(9)
The set of reliable documents is defined as those assigned to the source partition: Drel = {di | yi∗ = 1}. To ensure semantic consistency, we post-process Drel by calculating the average pairwise cosine similarity of the selected responses. For each document di ∈ Drel , we compute its average cosine similarity si with the other selected documents and exclude those with low agreement, as determined by a hyperparameter λ. The documents are retained if their average similarity si is greater than or equal to λ: ′ Drel = {di ∈ Drel | si ≥ λ}.
(i) Memory-Source Edges (s → a(t−1) ). The capacity of this (t) edge Sold represents the updated belief that the historical answer a(t−1) remains correct given the new evidence D(t) . We model this using a Bayesian framework since it naturally (t−1) integrates prior beliefs with new evidence. Let πS be the prior probability of correctness, derived from the average consistency of a(t−1) within its previous context at t − 1. (t) The likelihood LS is the average entailment score between the old answer and the new documents, indicating how well the new evidence supports the history: X 1 (t) LS = (t) M (a(t−1) , dk ). (13) |D | (t)
(10)
The details are in Appendix G. The remaining documents in ′ Drel are then concatenated with the original query and used to prompt the LLM to generate the final answer.
dk ∈D
The posterior belief (edge capacity) is computed via Bayes’ theorem:
4.3. Dynamic Defense with Memory Node
(t−1)
As defined in Sec. 3.1, real-world RAG systems operate over continuous time steps t = 1, 2, . . . , T , processing an evolving evidence stream D(t) . Naı̈vely reapplying a static model at each step disregards temporal continuity, often yielding unstable predictions when new evidence is sparse or noisy. Conversely, over-reliance on past answers impedes adaptation to genuine knowledge updates. To resolve this stability–plasticity trade-off, we augment the static graph with a Memory Node that encapsulates the system’s state from the previous time step, enabling coherent integration of historical knowledge and incoming evidence.
X 1 M (a(0) , di ), (0) |D | (0) X 1 C(a(0) , di ). |D(0) | (0)
(t)
(t−1)
· LS + (1 − πS
(t)
) · (1 − LS )
.
(14)
(ii) Memory-Sink Edges (a(t−1) → t). The capacity of (t) this edge Fold represents the updated probability that the historical answer is incorrect (i.e., should be filtered out). (t−1) Similarly, we define a prior conflict πF and a likelihood (t) of conflict LF , which is the average contradiction score between the new documents and the old answer: X 1 (t) LF = (t) C(a(t−1) , dk ). (15) |D | (t) dk ∈D
(t)
The updated capacity Fold is: (t−1)
πF
(t)
Fold =
(t−1)
πF
(t)
(t)
· LF
(t−1)
· LF + (1 − πF
(t)
) · (1 − LF )
.
(16)
If new documents explicitly contradict the old answer, this capacity increases, pushing the memory node a(t−1) towards the “Incorrect” partition.
(11)
di ∈D
(0) πF =
(t−1)
πS
(t)
· LS
A high capacity attracts the memory node to the source side (the “Correct” partition), signaling that the historical answer is validated by the new information.
Dynamic Graph Construction. At the initial time step t = 0, no historical answer exists. In this case, the dynamic mechanism naturally reduces to the static variant. We execute static defense on the initial retrieval set D(0) to generate the first reliable answer a(0) . Then, based on the generated answer and the single-document answers from the current (0) (0) step, we compute the prior probabilities πS and πF for the next round. The priors are obtained by computing the average similarity and conflict: (0) πS =
πS
(t)
Sold =
(iii) Memory-Document Edges (a(t−1) ↔ di ). To enforce logical consistency between history and the present, we add undirected edges between the memory node a(t−1) and every current document di ∈ D(t) . The capacity is set to their pairwise consistency M (a(t−1) , di ). This treats the old answer as a “super-document” that participates in the global consensus. If the old answer is semantically aligned with the majority of valid new documents, these edges reinforce their mutual selection.
(12)
di ∈D
For t > 0, it is necessary to use the dynamic mechanism. The new dynamic graph G(t) = (V (t) , E (t) ) contains all nodes from the static case—source s, sink t, and current retrieved documents D(t) , plus the memory node a(t−1) . a(t−1) represents the reliable answer generated at time t − 1. 5
RADAR: Defending RAG Dynamically against Retrieval Corruption
Algorithm 1 Robust RADAR Defense for Dynamic RAG
Inference via Min-Cut and Answer Generation. With the dynamic graph constructed, we solve the Min-Cut problem to obtain the optimal partition (Vst , Vtt ). The process automatically determines whether the historical information should be retained or discarded. If the memory node a(t−1) remains on the source side (Vs ), the previous conclusion is validated by the new evidence; otherwise, if it is cut to the sink side (Vt ), it indicates concept falsification, and the system removes the historical belief. (t)
(t)
1: Input: query q, retrieval stream {D (t) }T t=0 2: Output: answers {a(t) }T t=0 3: Initialize πS ← 0, πF ← 0 4: for t = 0 to T do 5: A(t) ← AtomicGen(D(t) ) 6: (M (t) , C (t) ) ← NLI(A(t) ), v (t) ← eigcen(M (t) ) 7: G(t) ← BuildGraph(D(t) , M (t) , C (t) , v (t) ) 8: if t > 0 then 9: G(t) ← AddHistory(G(t) , a(t−1) , D(t) , πS , πF ) 10: // Inject Bayesian memory node for temporal
(t)
Let Arel = {a1 , . . . , am } denote the set of reliable atomic answers induced by the source partition, i.e., the atomic answers associated with all selected nodes in Vs , including the memory answer a(t−1) if it is retained. Then we (t) post-process Arel as in Sec. 4.2 by computing their average pairwise cosine similarity and excluding isolated atomic an(t) swers with low similarity to the rest, forming A′ rel . Finally, we prompt the generator G to strictly synthesize a single coherent conclusion based only on these reliable atomic answers, producing the final answer: (t) a(t) = G q, A′ rel . (17)
consistency end if (t) (t) (Arel , Drel ) ← Select(MinCut(G(t) )) (t) (t) 13: DropIsolated(Arel , Drel ) 14: if t = 0 then (t) 15: a(t) ← G(q, Drel ) 16: else (t) 17: a(t) ← G(q, Arel ) 18: // Generate from reliable atomic claims 19: end if P 20: πS ← |D1(t) | di M (a(t) , di ) P 21: πF ← |D1(t) di C(a(t) , di ) 22: // Update belief priors for next time step 23: Return a(t) 24: end for 11: 12:
The coherence of a(t) is then computed and used to update (t) (t) the priors πS and πF for the next time step, with the update formulas being the same as in Eqs. (11) and (12), thereby creating a continuous learning loop. Overall, we present RADAR in Algo. 1.
5. Experiments Baselines. We compare RADAR against a standard Vanilla RAG pipeline, which directly prompts the generator with retrieved documents, and several robustness-oriented baselines: RobustRAG (Xiang et al., 2024), AstuteRAG (Wang et al., 2025), InstructRAG (Wei et al., 2025), and ReliabilityRAG (Shen et al., 2025).
5.1. Experimental Setup Static Evaluation Datasets. We evaluate RADAR on four benchmark datasets: RealTimeQA (RQA) (Kasai et al., 2023) for regular real-time QA snapshots; Natural Questions (NQ) (Lee et al., 2019) for answering via full Wikipedia articles; TriviaQA (TQA) (Joshi et al., 2017) for evidencegrounded trivia; and Bio (Lebret et al., 2016) for generating long-form biographies from Wikipedia infoboxes.
RAG Settings. We employ three LLMs as generators in our RAG: DeepSeek (DeepSeek-AI, 2024), GPT-4o (OpenAI, 2024), and Grok-4-fast (xAI, 2025). We use DeBERTav3 (He et al., 2023) and NLI model to compute M and C. We also conducted experiments under two retrieval settings: top-k = 10 and top-k = 50 retrieved documents.
Dynamic Evaluation Datasets. To evaluate the robustness of RAG systems in dynamic environments, we construct a time-evolving QA benchmark of 500 open-domain questions whose ground-truth answers change over time. For each question and timestamp, we retrieve the top-50 relevant webpages via SerpApi’s Google Search API (SerpApi, LLC, 2026), forming temporally indexed evidence snapshots. Using DeepSeek (DeepSeek-AI, 2024), we inject two types of adversarial artifacts into these snapshots: (i) poisoned documents containing fabricated but plausible claims aligned with specific questions, and (ii) prompt-injection payloads embedded in retrieved text that hijack the generator to disregard the user query and output attacker-specified content. Representative examples are provided in Appendix P, and dataset statistics are provided in Appendix O.
Attack Settings. We evaluate Prompt Injection Attacks (PIA) and Corpus Poisoning Attacks across different retrieval depths: targeting rank 1 (highest-ranked) and rank 10 (lowest-ranked) for k = 10, and ranks 1, 25, and 50 for k = 50. Multi-position attacks are further detailed in Appendix L to simulate comprehensive adversarial scenarios. Metrics. For QA datasets, we employ Answer Accuracy (Acc.) to match time-specific ground truth and Attack Success Rate (ASR) to measure the frequency of attackertargeted outputs. For long-form Bio generation, we use DeepSeek as an LLM-as-a-Judge to score accuracy, rele6
RADAR: Defending RAG Dynamically against Retrieval Corruption Table 1. Performance of RADAR and baseline methods on the RQA dataset using DeepSeek. Scenario
Vanilla RAG
Pos
AstuteRAG
InstructRAG
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
RobustRAG
ASR.↓
ReliabilityRAG
RADAR (Ours)
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Top-k = 10 Benign
–
75.0
–
35.0
–
73.0
–
69.0
–
75.0
–
75.0
–
PIA
Pos 1 Pos 10
25.0 59.0
74.0 28.0
25.0 23.0
1.0 1.0
23.0 66.0
68.0 5.0
64.0 69.0
7.0 4.0
69.0 74.0
15.0 6.0
69.0 75.0
11.0 5.0
Poison
Pos 1 Pos 10
38.0 58.0
57.0 35.0
21.0 36.0
15.0 4.0
29.0 54.0
50.0 14.0
62.0 70.0
13.0 5.0
70.0 75.0
14.0 6.0
70.0 75.0
11.0 6.0
Top-k = 50 Benign
–
75.0
–
41.0
–
62.0
–
71.0
–
75.0
–
75.0
–
PIA
Pos 1 Pos 25 Pos 50
35.0 68.0 60.0
65.0 15.0 23.0
21.0 38.0 34.0
5.0 2.0 2.0
33.0 61.0 63.0
46.0 3.0 4.0
69.0 69.0 71.0
9.0 4.0 4.0
67.0 74.0 76.0
18.0 3.0 3.0
72.0 76.0 76.0
5.0 3.0 3.0
Poison
Pos 1 Pos 25 Pos 50
44.0 65.0 74.0
53.0 26.0 12.0
21.0 37.0 29.0
10.0 3.0 2.0
39.0 57.0 55.0
35.0 21.0 17.0
67.0 71.0 71.0
20.0 5.0 5.0
64.0 70.0 75.0
19.0 7.0 3.0
71.0 76.0 76.0
7.0 5.0 3.0
Table 2. Performance of RADAR and baseline methods on Bio dataset using DeepSeek. Benign Method
Metric
PIA k = 10
Poison k = 50
k = 10
k = 50
k = 10
k = 50
Pos 1
Pos 10
Pos 1
Pos 25
Pos 50
Pos 1
Pos 10
Pos 1
Pos 25
Pos 50
Vanilla RAG
Acc.↑ Rel.↑ Coh.↑
77.2 77.8 85.0
78.4 79.2 84.4
24.8 24.2 28.4
9.6 9.6 13.8
19.0 18.2 22.6
21.2 21.0 24.8
10.2 10.0 12.4
59.6 62.6 72.4
31.0 38.2 48.0
57.6 58.4 70.4
48.2 52.0 57.4
29.2 38.8 46.2
AstuteRAG
Acc.↑ Rel.↑ Coh.↑
87.8 88.2 90.8
86.0 85.2 88.0
54.8 57.8 63.4
63.8 65.2 70.2
67.6 73.0 77.8
68.2 77.2 82.8
73.8 77.8 82.6
66.0 67.6 74.6
68.6 69.8 75.6
65.0 63.0 73.2
70.0 68.2 79.6
65.4 65.0 76.6
InstructRAG
Acc.↑ Rel.↑ Coh.↑
74.2 69.4 78.4
73.8 70.4 78.2
68.6 64.6 73.0
71.8 64.6 75.6
74.0 70.0 78.8
76.6 73.2 81.4
76.4 77.4 82.4
74.4 72.2 80.4
73.2 70.4 78.0
77.4 74.0 80.8
76.6 74.0 81.4
80.2 77.8 84.2
RobustRAG
Acc.↑ Rel.↑ Coh.↑
60.4 51.4 72.4
60.6 62.2 71.6
57.6 49.2 70.2
55.8 47.6 66.2
57.2 57.0 69.0
61.2 62.0 73.0
56.0 57.6 68.0
60.4 53.8 73.4
52.8 47.4 66.6
52.2 55.2 67.6
65.4 67.2 77.0
68.0 68.0 80.4
ReliabilityRAG
Acc.↑ Rel.↑ Coh.↑
70.6 70.6 78.4
75.4 78.4 83.2
66.6 67.6 75.2
67.0 68.0 74.0
71.8 71.2 77.4
74.4 76.0 83.0
74.6 76.4 81.4
65.2 67.0 75.8
75.0 76.8 84.0
68.4 71.4 77.8
80.0 81.8 87.4
73.0 74.6 79.6
RADAR (Ours)
Acc.↑ Rel.↑ Coh.↑
76.6 74.0 81.4
76.8 77.0 83.4
72.0 71.0 79.2
75.6 76.4 83.0
76.8 75.8 83.4
75.8 75.8 83.4
80.6 77.0 84.2
84.4 82.6 88.2
79.0 77.2 84.4
81.2 80.6 85.4
80.4 81.2 85.6
78.6 79.4 85.6
vance, and coherence based on Wikipedia references.
exceeds defense-oriented baselines RobustRAG and ReliabilityRAG in accuracy, relevance, and coherence. Our sanitization mechanism thus avoids the utility loss typical of heuristic filtering.
5.2. Defense Performance in Static Environments Our static experiments highlight two RADAR strengths: (i) preserving utility in benign settings and (ii) enhancing robustness against prompt injection and corpus poisoning without compromising quality.
Robustness under Poisoning Attacks. RADAR yields the best robustness-utility trade-off across datasets and attack positions, achieving low ASR while maintaining the highest accuracy. It remains effective even when Pos 1 is compromised. As shown in Table 1, for top-k = 10 on RQA with PIA at Pos 10, it achieves 75.0% accuracy with 5.0% ASR. And for top-k = 50 on RQA with PIA at Pos 1, it maintains 72.0% accuracy and 5.0% ASR despite increased
Benign Performance. RADAR maintains competitive accuracy, matching Vanilla RAG on RQA (75.0%) as shown in Table 1. In long-form Bio tasks, while AstuteRAG leads due to its specialized noise mitigation, RADAR consistently
7
RADAR: Defending RAG Dynamically against Retrieval Corruption Table 3. Performance under evolving evidence streams with top-k = 50 using DeepSeek under the cumulative snapshot setting. Vanilla RAG
AstuteRAG
InstructRAG
RobustRAG
ReliabilityRAG
RADAR (Ours)
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
–
70.63
–
74.02
–
61.29 66.92 67.43
18.62 9.98 7.87
53.61 67.62 68.71
42.67 9.34 5.95
63.60 70.12 70.05
17.85 8.94 6.01
44.98 66.28 66.92
34.29 11.00 8.64
53.87 67.69 67.88
27.51 7.55 5.25
63.60 69.41 70.37
17.53 7.22 5.95
Attack
Pos
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
Benign
–
70.76
–
73.48
–
73.41
–
67.50
PIA
Pos 1 Pos 25 Pos 50
12.41 29.88 19.32
87.01 67.37 79.40
54.25 62.51 59.18
12.99 9.40 9.66
61.42 65.77 59.69
34.46 28.79 34.68
Poison
Pos 1 Pos 25 Pos 50
25.72 35.44 30.77
53.17 43.44 46.51
47.92 58.41 57.77
16.63 10.62 9.60
53.49 55.34 55.92
24.50 25.46 23.74
Table 4. Performance under evolving evidence streams with top-k = 50 using DeepSeek under the lightweight history setting. Vanilla RAG
AstuteRAG
InstructRAG
RobustRAG
Attack
Pos
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
Benign
–
70.70
–
64.17
–
83.10
–
59.88
PIA
Pos 1 Pos 25 Pos 50
37.68 36.98 14.84
60.72 58.35 82.47
60.08 64.68 62.06
7.74 8.25 9.85
57.38 55.34 42.22
32.69 25.46 49.07
53.49 59.31 59.12
noise and attack surface. Due to space constraints, the test results for NQ and TQA and the test results for GPT-4o and Grok-4-fast are presented in Appendix K.
ReliabilityRAG
RADAR (Ours)
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
–
72.55
–
74.02
–
20.15 12.92 12.80
50.74 66.53 68.45
43.12 10.81 6.78
63.60 70.12 70.05
17.85 8.94 6.01
the no-attack setting, RADAR achieves a peak accuracy of 74.02%, surpassing vanilla RAG in both temporal settings. This is because the cumulative snapshot approach may feed obsolete or incorrect evidence from earlier time steps into the LLM, while the lightweight history approach may mislead the model with previous answers that are no longer valid. These results show that RADAR not only defends against attacks but also improves correctness in dynamic RAG.
Long-form Generation Robustness under Poisoning Attacks. As shown in Table 2, RADAR dominates Bio task performance under PIA and poisoning across most positions. Notably, under PIA attacks at position 50 when top-k = 50, RADAR maintains a high factual accuracy of 80.6%, whereas Vanilla RAG’s performance collapses to 10.2%. Furthermore, in poisoning scenarios when top-k = 10 at Pos 1, RADAR achieves a peak accuracy of 84.4%, outperforming all baseline models. It consistently improves factual accuracy, relevance, and coherence. The method effectively blocks adversarial inputs while maintaining high-quality discourse in long-form outputs.
Performance Under Time-Evolving Attacks. Table 3 presents a comparison between RADAR and other baselines under the cumulative snapshot setting, reporting accuracy and ASR on evolving evidence streams with time-varying attacks. RADAR offers a better robustness–utility trade-off than RobustRAG and ReliabilityRAG, achieving higher accuracy and maintaining lower or stable ASR across injection positions. Notably, under the most challenging Pos 1 PIA attack, RADAR achieves 63.60% accuracy, significantly outperforming RobustRAG (61.29%) and ReliabilityRAG (53.61%). RADAR excels when adversarial content is injected into high-ranked evidence, better protecting critical passages. For mid-rank and tail-rank injections, RADAR sustains about 70% accuracy with low ASR. Table 4 further compares RADAR with baselines under the lightweight history setting, where only the previous answer is appended to the current prompt. Under PIA attacks, RADAR consistently achieves the highest accuracy across injection positions, surpassing the best baseline by 3.52% at Pos 1 and 5.44% at Pos 25, while maintaining low ASR (17.85% and 8.94%, respectively), demonstrating its superior robustness against adversarial injections even under lightweight history adaptation.
5.3. Defense Performance in Dynamic Environments Experimental Protocol. Most existing RAG defenses are designed for static snapshots of retrieved evidence and do not naturally handle time-evolving streams. To enable a fair comparison in dynamic scenarios, we explore two ways to adapt static baselines to the temporal setting: (1) cumulative snapshot: at each time step t, newly retrieved documents are prepended to all previously seen documents {D0 , D1 , . . . , Dt−1 }, forming an expanding evidence pool D≤t ; (2) lightweight history: instead of storing the full document history, only the answer from the previous time step is appended to the current prompt. Both approaches are applied to all baselines. Benign Performance. As shown in Table 3 and Table 4, in
8
RADAR: Defending RAG Dynamically against Retrieval Corruption Table 5. RADAR’s performance on different NLI models under PIA attack on RQA using Deepseek.
Top-k = 10 NLI
DeBERTa-v3 BART ModernBERT
Pos 1
Top-k = 50 Pos 10
Pos 1
Pos 25
Pos 50
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
69.0 69.0 69.0
11.0 11.0 12.0
75.0 75.0 75.0
5.0 6.0 6.0
72.0 72.0 72.0
5.0 7.0 7.0
76.0 76.0 76.0
3.0 4.0 4.0
76.0 76.0 76.0
3.0 4.0 4.0
Table 7. RADAR’s performance under none-adaptive attack and adaptive attack on RQA using Deepseek.
Top-k
Figure 2. Sensitivity of the post-processing threshold λ.
Position
None-Adaptive
Adaptive
Acc.↑
ASR.↓
Acc.↑
ASR.↓
10
Pos 1 Pos 10
69.0 75.0
11.0 5.0
69.0 74.0
10.0 6.0
50
Pos 1 Pos 25 Pos 50
72.0 76.0 76.0
5.0 3.0 3.0
72.0 75.0 74.0
8.0 5.0 5.0
Table 6. RADAR’s performance under random perturbations of NLI with Top-k = 10 under PIA attack on RQA using Deepseek.
Perturbation Rate 0 0.1 0.3 0.5
Pos 1
5.6. NLI Robustness under Adaptive Attack
Pos 10
Acc.↑
ASR.↓
Acc.↑
ASR.↓
69.0 67.0 68.0 64.0
11.0 10.0 12.0 18.0
75.0 74.0 73.0 78.0
5.0 6.0 6.0 7.0
To directly assess whether the NLI-based entailment/contradiction signals remain reliable under adversarially written or stylistically camouflaged injected text, we additionally evaluate RADAR under the adaptive attack setting proposed by ReliabilityRAG. Specifically, besides the standard nonadaptive injection, we consider the adaptive attack that induces ambiguous answers (e.g., “A or B” while the correct answer is A) to bypass NLI contradiction checks. Our results in Table 7 show that RADAR remains largely stable under this stronger attack: across both top-k = 10 and top-k = 50 settings, the performance under adaptive attack is very close to that under non-adaptive attack, with only marginal differences. This suggests that RADAR remains effective even when the injected text is adversarially crafted to camouflage itself against NLI-based defenses.
5.4. Hyperparameter Sensitivity We evaluate the sensitivity of the post-processing threshold λ on RQA under prompt injection attacks using DeepSeek. As shown in Figure 2, varying λ from 0.1 to 0.5 has minimal impact on accuracy and ASR, with performance remaining stable across injection positions. ASR is slightly more sensitive, following a decrease-then-degrade pattern as λ increases. Across retrieval sizes and injection ranks, λ = 0.3 provides the most consistent robustness gains with negligible accuracy loss, so we adopt λ = 0.3 by default.
6. Conclusion In this paper, we present RADAR, a defense framework for dynamic RAG that treats context sanitization as a MinCut problem. By merging graph-theoretic inference with a Bayesian Memory Node, RADAR balances adversarial resilience and knowledge adaptation with minimal storage overhead. We also provide a comprehensive dynamic attack dataset as a benchmark. As AI systems pivot toward real-time data, such mathematically grounded, time-aware resilience is vital for next-generation trustworthy AI agents.
5.5. NLI Sensitivity We ablate different NLI models (DeBERTa-v3 (He et al., 2023), BART (Lewis et al., 2020a), and ModernBERT (Warner et al., 2025)) under PIA on RealTimeQA in Table 5 and observe only minor changes in Acc. and ASR, indicating low sensitivity to the NLI choice. We further perturb NLI outputs by randomly replacing them with probabilities of 0.1, 0.3, and 0.5 in Table 6, and observe only slight accuracy drops, reinforcing this low sensitivity. 9
RADAR: Defending RAG Dynamically against Retrieval Corruption
Impact Statement
Cho, S., Jeong, S., Seo, J., Hwang, T., and Park, J. C. Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations. In Findings of EMNLP, 2024.
This work introduces RADAR, a robust and storage-efficient defense framework for dynamic Retrieval-Augmented Generation (RAG) systems operating in adversarial, timeevolving environments such as web search. By formulating context sanitization as a graph-based energy minimization problem solved via Min-Cut and incorporating a Bayesian memory node, RADAR effectively balances stability against retrieval corruption with adaptability to genuine knowledge updates, without archiving historical documents. This approach significantly reduces storage overhead (from tens of MBs to ∼1 KB per query) while improving robustness and answer accuracy under evolving attacks. As real-time RAG becomes integral to AI assistants, search engines, and decision-support tools, RADAR provides a practical, mathematically grounded mechanism to enhance trustworthiness, mitigate prompt injection and corpus poisoning risks, and promote the safe deployment of LLM-powered systems in dynamic real-world settings.
Clop, C. and Teglia, Y. Backdoored retrievers for prompt injection attacks on retrieval augmented generation of large language models. In arXiv preprint arXiv:2410.14479, 2024. DeepSeek-AI. DeepSeek-V3 technical report. Technical Report arXiv:2412.19437, DeepSeek-AI, 2024. URL https://arxiv.org/abs/2412.19437. Accessed: 2026-01-27. Elias, P., Feinstein, A., and Shannon, C. A note on the maximum flow through a network. IRE Transactions on Information Theory, 2(4):117–119, 1956. Gong, Y., Chen, Z., Chen, M., Yu, F., Lu, W., Wang, X., Liu, X., and Liu, J. Topic-fliprag: Topic-orientated adversarial opinion manipulation attacks to retrieval-augmented generation models. arXiv preprint arXiv:2502.01386, 2025.
Acknowledgements This work was supported by the New Generation Artificial Intelligence-National Science and Technology Major Project (2025ZD0123504), the National Natural Science Foundation of China (Grants 62502200), the Jiangsu Provincial Science and Technology Major Project (Grant BG2024042), and the Natural Science Foundation of Jiangsu Province (Grants BK20251203).
Guu, K., Lee, K., Tung, Z., Pasupat, P., and Chang, M. Retrieval augmented language model pre-training. In Proc. of ICML, 2020. He, P., Gao, J., and Chen, W. Debertav3: Improving deberta using electra-style pre-training with gradientdisentangled embedding sharing. In Proc. of ICLR, 2023. Hu, H., Jiang, Z., Lyu, Y., Zhang, J., Liu, Y., and Chow, K.H. Confundo: Learning to generate robust poison for practical rag systems. In arXiv preprint arXiv:2602.06616, 2026.
References Arora, S., Khan, H., Sun, K., Dong, X. L., Choudhary, S., Moon, S., Zhang, X., Sagar, A., Appini, S. T., Patnaik, K., et al. Stream rag: Instant and accurate spoken dialogue systems with streaming tool usage. In arXiv preprint arXiv:2510.02044, 2025.
Hwang, J., Park, J., Park, H., Kim, D., Park, S., and Ok, J. Retrieval-augmented generation with estimation of source reliability. In Proc. of EMNLP, 2025.
Asai, A., Wu, Z., Wang, Y., Sil, A., and Hajishirzi, H. SelfRAG: Learning to retrieve, generate, and critique through self-reflection. In Proc. of ICLR, 2024.
Jiao, Y., Wang, X., and Yang, K. Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization. In Proc. of SIGIR, 2025.
Bagwe, G., Chaturvedi, S. S., Ma, X., Yuan, X., Wang, K.-C., and Zhang, L. E. Your rag is unfair: Exposing fairness vulnerabilities in retrieval-augmented generation via backdoor attacks. In Proc. of EMNLP, 2025.
Joshi, M., Choi, E., Weld, D., and Zettlemoyer, L. TriviaQA: A large scale distantly supervised challenge dataset for reading comprehension. In Proc. of ACL, 2017.
Boykov, Y., Veksler, O., and Zabih, R. Fast approximate energy minimization via graph cuts. IEEE Transactions on pattern analysis and machine intelligence, 23(11): 1222–1239, 2002.
Kasai, J., Sakaguchi, K., Le Bras, R., Asai, A., Yu, X., Radev, D., Smith, N. A., Choi, Y., Inui, K., et al. Realtime qa: What’s the answer right now? 2023.
Chaturvedi, S. S., Bagwe, G., Zhang, L. E., and Yuan, X. Aip: Subverting retrieval-augmented generation via adversarial instructional prompt. In Proc. of EMNLP, 2025.
Kolmogorov, V. and Zabin, R. What energy functions can be minimized via graph cuts? IEEE transactions on pattern analysis and machine intelligence, 26(2):147–159, 2004. 10
RADAR: Defending RAG Dynamically against Retrieval Corruption
Lebret, R., Grangier, D., and Auli, M. Neural text generation from structured data with application to the biography domain. In Proc. of EMNLP, 2016.
Wang, J. and Yu, F. Derag: Black-box adversarial attacks on multiple retrieval-augmented generation applications via prompt injection. In First International KDD Workshop on Prompt Optimization, 2025.
Lee, K., Chang, M.-W., and Toutanova, K. Latent retrieval for weakly supervised open domain question answering. In Proc. of ACL, 2019.
Warner, B., Chaffin, A., Clavié, B., Weller, O., Hallström, O., Taghadouini, S., Gallagher, A., Biswas, R., Ladhak, F., Aarsen, T., et al. Smarter, better, faster, longer: A modern bidirectional encoder for fast, memory efficient, and long context finetuning and inference. In Proc. of ACL, pp. 2526–2547, 2025.
Lewis, M., Liu, Y., Goyal, N., Ghazvininejad, M., Mohamed, A., Levy, O., Stoyanov, V., and Zettlemoyer, L. Bart: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. In Proc. of ACL, 2020a.
Wei, Z., Chen, W.-L., and Meng, Y. Instructrag: Instructing retrieval-augmented generation via self-synthesized rationales. In Proc. of ICLR, 2025.
Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N., Küttler, H., Lewis, M., Yih, W.-t., Rocktäschel, T., et al. Retrieval-augmented generation for knowledgeintensive nlp tasks. In Proc. of NeurIPS, 2020b.
xAI. Grok 4 fast. Technical report, xAI, 2025. URL https://x.ai/news/grok-4-fast. Accessed: 2026-01-27; API model id: grok-4-fast (and variants grok-4-fast-reasoning / grok-4-fast-non-reasoning).
Nazary, F., Deldjoo, Y., and Noia, T. d. Poison-rag: Adversarial data poisoning attacks on retrieval-augmented generation in recommender systems. In Proc. of ECIR, 2025. OpenAI. Gpt-4o system card. Technical Report GPT-4o System Card, OpenAI, 2024. URL https://cdn. openai.com/gpt-4o-system-card.pdf. Accessed: 2026-01-27. Prompt Security. The hidden parrot: Stealthy prompt injection and poisoning in rag systems via vector database embeddings. GitHub repository, 2025. URL https://github.com/prompt-security/ RAG_Poisoning_PoC. Proof-of-concept for stealthy prompt injection in RAG. Accessed January 2026.
Xiang, C., Wu, T., Zhong, Z., Wagner, D., Chen, D., and Mittal, P. Certifiably robust rag against retrieval corruption. In ICML 2024 Next Generation of AI Safety Workshop, 2024. Xue, J., Zheng, M., Hu, Y., Liu, F., Chen, X., and Lou, Q. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. In arXiv preprint arXiv:2406.00083, 2024. Yu, W., Zhang, H., Pan, X., Cao, P., Ma, K., Li, J., Wang, H., and Yu, D. Chain-of-note: Enhancing robustness in retrieval-augmented language models. In Proc. of EMNLP, 2024. Zhu, Y. From static to dynamic: A streaming rag approach to real-time knowledge base. In arXiv preprint arXiv:2508.05662, 2025.
Reddy, R. G., Dixit, T., Qin, J., Qian, C., Lee, D., Han, J., Small, K., Fan, X., Sarikaya, R., and Ji, H. Winell: wikipedia never-ending updating with llm agents. In arXiv preprint arXiv:2508.03728, 2025.
Zou, W., Geng, R., Wang, B., and Jia, J. {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models. In Proc. of USENIX Security, 2025.
SerpApi, LLC. Google search engine results api. https: //serpapi.com/search-api, 2026. Accessed: 2026-01-10. Shen, Z., Imana, B. Y., Wu, T., Xiang, C., Mittal, P., and Korolova, A. Reliabilityrag: Effective and provably robust defense for rag-based web-search. In Proc. of NeurIPS, 2025. Tunçel, L. On the complexity of preflow-push algorithms for maximum-flow problems. Algorithmica, 11(4):353–359, 1994. Wang, F., Wan, X., Sun, R., Chen, J., and Arik, S. O. Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models. In Proc. of ACL, 2025. 11
RADAR: Defending RAG Dynamically against Retrieval Corruption
A. Overview This appendix provides supplementary technical details, derivations, and experimental results supporting the RADAR method presented in the main paper. The sections are organized as follows: Appendix B derives the submodularity of the proposed energy function and explains its exact minimization via s − t Min-Cut construction. Appendix C justifies the Bayesian update rules used for dynamic capacity adjustment of historical answers. Appendix D-H detail key implementation components: • Symmetric NLI scoring for consistency M and conflict C matrices • Document-wise atomic answer generation • Eigenvector centrality computation for consensus scoring • Post-processing for semantic outlier removal • Constrained LLM synthesis prompt for final answer generation Appendix I-J analyze computational aspects: • Min-cut complexity using HLPP • Runtime and efficiency Appendix K-M add more experimental results: • Extended static PIA & Poison attack results on NQ, TQA, Bio using DeepSeek, GPT-4o, and Grok-4-fast • Multi-position injection attack results • Extended dynamic PIA attack results using GPT-4oand Grok-4-fast Appendix N shows the failure cases of our method. Appendix O-P gives details of our dynamic dataset: • Dataset statistics • Examples of the dataset
B. Min-Cut Solvability of the Energy Under the Markov Random Field (MRF) framework, minimizing the energy function E(y) corresponds to finding the Maximum A Posteriori (MAP) estimate of the document labels. Specifically, we seek a binary labeling y ∈ {0, 1}k by minimizing: k X X E(y) = yi Fi + (1 − yi )Si + Mij |yi − yj |. (18) i=1
1≤i<j≤k
The pairwise term is a weighted Potts model, which is graph-representable when it is submodular for each pair (i, j). Concretely, define Eij (yi , yj ) = Mij |yi − yj |. (19) When Mij ≥ 0, we have Eij (0, 0) = 0,
Eij (1, 1) = 0,
Eij (0, 1) = Mij ,
Eij (1, 0) = Mij . 12
(20)
RADAR: Defending RAG Dynamically against Retrieval Corruption
which satisfies the submodularity inequality Eij (0, 0) + Eij (1, 1) ≤ Eij (0, 1) + Eij (1, 0),
(21)
since 0 + 0 ≤ Mij + Mij holds whenever Mij ≥ 0. Therefore, the overall energy E(y) belongs to the class of submodular binary energies and can be minimized exactly via an s–t Min-Cut (Kolmogorov & Zabin, 2004). Additionally, under the standard s-t graph construction, the unary term yi Fi + (1 − yi )Si is represented by terminal edges (s → di ) and (di → t) with capacities Si and Fi , respectively, while the pairwise term Mij |yi − yj | is represented by an undirected edge between di and dj with capacity Mij . Consequently, the cut cost equals E(y), and the Min-Cut yields the global minimizer y ∗ .
C. Justification of Bayesian Memory Update In dynamic defense, we update the capacity of the memory node based on new evidence. Here, we interpret the capacity (t) Sold as the posterior probability that the historical answer a(t−1) remains correct. We define the binary random variable H ∈ {0, 1}, where H = 1 denotes the hypothesis that a(t−1) is correct. (t−1)
Prior. The prior probability P (H = 1) is given by πS step.
, which is derived from the coherence of the previous generation
Likelihood. Let E be the event of observing the semantic relationship between the old answer and the current retrieved (t) documents D(t) . We use the aggregated entailment score LS as the likelihood of observing such support given that the history is correct: (t) P (E | H = 1) = LS . (22) To make the update tractable, we adopt a Symmetric Likelihood Assumption. We assume that if the historical answer were incorrect (H = 0), the probability of observing high entailment from valid new documents would be the complement of the support score: (t) P (E | H = 0) = 1 − LS . (23) This assumption reflects the intuition that an incorrect answer will contradict or fail to entail the true information present in D(t) . Posterior.
By applying Bayes’ theorem, the posterior probability P (H = 1 | E) is: P (E | H = 1) · P (H = 1) P (E) P (E | H = 1) · P (H = 1) . = P (E | H = 1)P (H = 1) + P (E | H = 0)P (H = 0)
P (H = 1 | E) =
(24)
Substituting the prior and likelihood terms: (t)
(t−1)
LS · πS
(t)
Sold =
(t)
(t−1)
LS · π S
(t)
(t−1)
+ (1 − LS ) · (1 − πS
.
(25)
)
(t)
This recovers the update formula in Eq. 14. The update for the conflict capacity Fold in Eq. 16 follows an identical derivation by defining H = 1 as the hypothesis that the answer is incorrect and using the conflict matrix for likelihood estimation.
D. NLI Scoring for M and C We use a Natural Language Inference (NLI) model to quantify the logical relation between two atomic answers. Given an ordered pair (premise, hypothesis), the NLI model outputs a probability distribution over entailment, contradiction, and neutral. We take the entailment probability as the consistency strength and the contradiction probability as the conflict strength. For any pair (ai , aj ), we denote: Mi→j ∈ [0, 1]
as the entailment strength from ai to aj , 13
(26)
RADAR: Defending RAG Dynamically against Retrieval Corruption
Ci→j ∈ [0, 1]
as the contradiction strength from ai to aj .
(27)
In general, the scores are not symmetric: Mi→j ̸= Mj→i ,
Ci→j ̸= Cj→i .
(28)
However, our graph construction uses undirected document, which requires a symmetric edge weight. Moreover, the contradiction scores used in risk aggregation should not be dominated by a single directional prediction. To remove directional bias, we symmetrize the two directions by the geometric mean. For each pair (i, j), we define the symmetric scores: p Mij ≜ Mi→j Mj→i , (29) p Cij ≜ Ci→j Cj→i . (30) By construction, these satisfy Mij = Mji and Cij = Cji . The geometric mean enforces a conservative agreement-in-both-directions criterion: the symmetric score is large only when both directions are high, and it is strongly down-weighted if either direction is low. This mitigates directional artifacts while keeping the scores in [0, 1] for direct use as graph capacities.
E. Atomic Answer Generation Given the retrieved set D = {d1 , . . . , dk } from the standard RAG workflow, we further decompose the generation step into a set of document-wise responses, referred to as atomic answers. Specifically, for each retrieved document di , we query the generator G with the original user query q and only the single-document context di : ai = G(q, di ),
i = 1, . . . , k.
(31)
Here ai is intended to capture the minimal claim(s) about q that can be supported by di alone, decoupling the influence of other retrieved documents. In implementation, we prompt the LLM to (i) answer q using only the evidence in di , (ii) avoid introducing external knowledge, and (iii) return a concise, self-contained statement. The resulting atomic answers {ai }ki=1 serve as standardized semantic units for subsequent reasoning. We discard documents whose atomic answers are uninformative. For the remaining set, we compute document-level entailment and contradiction relations by applying an NLI model to pairs of atomic answers, which are then used to construct the similarity matrix M and conflict matrix C described in Sec. 4.2.
F. Eigenvector Centrality Computation Given the similarity matrix M ∈ Rk×k , where Mij ∈ [0, 1] measures the semantic and logical agreement between ai and aj , we compute a global consensus score for each document node using eigenvector centrality. Intuitively, a node is considered central if it is similar to other central nodes. To improve numerical stability, we add a small self-loop to each node and define the weighted adjacency matrix A = M + ϵI,
(32)
where I is the identity matrix and ϵ > 0 is a small constant. Eigenvector centrality is defined as the principal eigenvector of A, i.e., the nonzero vector v ∈ Rk satisfying Av = λmax v,
(33)
where λmax is the largest eigenvalue of A. We approximate v using T steps of power iteration with ℓ2 normalization. Starting from the uniform initialization 1 v (0) = 1, (34) k we update ṽ (τ +1) ṽ (τ +1) = Av (τ ) , v (τ +1) = (τ +1) , τ = 0, 1, . . . , T − 1, (35) ṽ +δ 2 14
RADAR: Defending RAG Dynamically against Retrieval Corruption
where δ > 0 is a small constant to avoid division by zero. After T iterations, we take v = v (T ) as the estimated centrality vector. Finally, we rescale v into [0, 1] for downstream use: centralityi =
vi − minj vj , maxj vj − minj vj + δ
i = 1, . . . , k.
(36)
In our implementation, we set ϵ = 0.01, the number of power-iteration steps to T = 10, and use δ = 10−8 as a numerical stability constant. Algorithm 2 Eigenvector Centrality via Power Iteration Require: Similarity matrix M ∈ Rk×k ; iterations T ; constants ϵ > 0, δ > 0 Ensure: Normalized centrality scores centrality ∈ [0, 1]k 1: A ← M + ϵI 2: v ← k1 1 3: for τ ← 1 to T do 4: v ← Av v 5: v← ∥v∥2 + δ 6: end for v − min(v) 7: centrality ← max(v) − min(v) + δ 8: Return centrality
G. Post-processing for Semantic Consistency After Min-Cut inference, we obtain the reliable set Drel = {di | yi∗ = 1},
(37)
together with their corresponding atomic answers {ai }di ∈Drel . To further ensure semantic consistency among the selected evidence, we apply a post-processing step that removes isolated items based on embedding cosine similarity. Let ei = Enc(ai ) denote the embedding of atomic answer ai . For any pair of selected answers, we compute the cosine similarity sim(i, j) = cos(ei , ej ), di , dj ∈ Drel . (38) For each selected document di , we measure its average semantic agreement with the remaining selected set: si =
1 |Drel | − 1
X
sim(i, j),
di ∈ Drel .
(39)
dj ∈Drel j̸=i
Documents whose atomic answers exhibit low agreement with the rest are treated as isolated outliers and excluded: ′ Drel = {di ∈ Drel | si ≥ λ}.
(40)
′ In our implementation, we set λ = 0.3. The remaining atomic answers associated with Drel are then concatenated with the original query to prompt the LLM for the final answer.
H. LLM-based Synthesis from Reliable Atomic Answers in dynamic defense (t)
(t)
(t)
After Min-Cut inference, we obtain a set of reliable atomic answers Arel = {a1 , . . . , am }. We generate the final response via a constrained LLM synthesis step, whose goal is to extract the most consistent and dominant conclusion supported by these atomic answers. 15
RADAR: Defending RAG Dynamically against Retrieval Corruption
To reduce uncontrolled speculation, the generator is explicitly instructed to only use the provided atomic answers as references, and to not add, correct, question, or challenge any information contained in them even if it appears outdated. This turns the synthesis step into a purely aggregative operation over vetted evidence. We concatenate all reliable atomic answers into a single context string context str and use the following prompt: Question: {question} The following are all the reliable reference atomic answers (synthesize strictly based on this content only. Do NOT add, correct, question, or challenge any information in it, even if you believe it may be outdated): {context str} Strictly follow the reference answers provided above and synthesize the most consistent and main conclusion as the final answer. Output only the final answer itself. Do NOT write any explanations, reminders, supplements, or comments about dates. The model must output a single final answer string without rationale, meta-commentary, or auxiliary notes. This ensures that the final response is a direct synthesis of the selected reliable atomic answers.
I. Computational Complexity of Min-Cut By the Max-Flow Min-Cut theorem, the capacity of a s-t Min-Cut equals the value of a maximum s–t flow; hence we recover the optimal cut and thus y ∗ by computing a max flow and reading off the s-reachable set in the residual graph. RADAR contains k document nodes and two terminals, hence n = k + 2.
(41)
Since we connect every document pair with a consistency edge of capacity λMij and add two terminal edges per document, the number of edges satisfies m = 2k + Θ(k 2 ) = Θ(k 2 ) = Θ(n2 ), (42) Therefore, the graph is dense. We compute max flow using the highest-label preflow-push (HLPP) algorithm, which is a push-relabel method that always selects an active vertex of maximum height label and discharges it via a sequence of local push and relabel operations. Unlike augmenting-path methods that repeatedly search for full s-t augmenting paths, HLPP only performs local updates on admissible residual arcs, which is particularly suitable for our dense graph where m = Θ(n2 ). For HLPP, a refined amortized analysis based on a potential function yields the worst-case bound (Tunçel, 1994): √ THLPP = O n2 m . (43) The key idea is to bound the number of non-saturating pushes by splitting them into small and big pushes using a threshold κ: in each phase, there are at most O(κn2 ) small pushes, while the total number of big pushes is bounded by O(n2 m/κ) √ since each big push decreases the potential by at least κ. Balancing the two terms by choosing κ = m gives √ O(κn2 ) + O(n2 m/κ) = O n2 m . (44) In our dense graph m = Θ(n2 ), this further implies THLPP = O(n3 ).
(45)
J. Runtime and Efficiency We measured average per-query runtime on RealtimeQA. Results for top-k = 10 and top-k = 50 are shown in Table 8. The findings indicate that RADAR’s runtime is primarily dominated by atomic answer generation, while NLI scoring and Min-Cut inference introduce only marginal overhead. 16
RADAR: Defending RAG Dynamically against Retrieval Corruption Table 8. Runtime and Performance at Top-k = 10 and Top-k = 50 with attack Pos 1 on RQA using Deepseek. Metric Atomic Gen.(s) NLI(s) Inference(s) Total(s) Acc. ASR
Vanilla RAG
AstuteRAG
InstructRAG
RobustRAG
ReliabilityRAG
RADAR (Ours)
k=10
k=50
k=10
k=50
k=10
k=50
k=10
k=50
k=10
k=50
k=10
k=50
2 25.0 74.0
2 35.0 65.0
6 25.0 1.0
7 21.0 5.0
3 23.0 68.0
4 33.0 46.0
20 0.0365 21 64.0 7.0
86 0.0945 94 69.0 9.0
20 0.32 0.0005 21 69.0 15.0
41 0.40 0.1072 43 67.0 18.0
20 0.32 0.0007 21 69.0 11.0
86 0.52 0.0025 87 72.0 5.0
Table 9. Performance of RADAR and baseline methods with top-k = 10 on NQ and TQA. Dataset
Pos
Vanilla RAG Acc.↑
ASR.↓
AstuteRAG Acc.↑
ASR.↓
InstructRAG Acc.↑
ASR.↓
ReliabilityRAG
RADAR (Ours)
Acc.↑
RobustRAG ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
61.6 60.6
– –
67.4 71.0
– –
67.0 71.6
– –
Benign NQ TQA
– –
70.2 76.2
– –
27.4 45.2
– –
57.4 64.2
– –
NQ
Pos 1 Pos 10
15.0 32.2
83.6 61.0
23.0 22.2
4.4 1.6
15.8 57.2
76.4 3.8
55.6 60.2
6.8 2.2
65.2 67.8
15.0 6.0
63.4 64.8
7.8 6.4
TQA
Pos 1 Pos 10
13.2 53.6
88.2 44.0
35.6 39.6
5.4 1.8
19.4 60.0
73.6 6.4
59.6 66.4
21.0 13.2
60.0 69.6
35.8 17.4
61.4 69.6
32.2 16.0
NQ
Pos 1 Pos 10
57.0 66.0
26.8 13.4
24.2 31.2
5.4 1.8
38.6 49.8
23.6 5.2
57.2 60.0
7.4 2.4
64.8 65.2
11.4 5.6
62.0 64.8
9.8 6.4
TQA
Pos 1 Pos 10
34.8 57.8
60.2 38.6
37.0 45.8
10.4 4.4
34.0 54.8
48.4 13.6
57.4 67.0
24.8 14.0
60.4 69.0
32.4 16.2
61.6 70.0
32.0 16.0
PIA Attack
Poison Attack
At top-k = 10, RADAR (21 s) matches RobustRAG and ReliabilityRAG in runtime, while achieving the best Acc./ASR under attacks. At top-k = 50, RADAR (87 s) is faster than RobustRAG (94 s) but slower than ReliabilityRAG (43 s), as it preserves more comprehensive evidence coverage rather than relying on aggressive subsampling. Vanilla RAG, AstuteRAG, and InstructRAG are more efficient but significantly less robust. Overall, RADAR strikes a favorable robustness–efficiency trade-off, with its additional cost mainly stemming from more complete evidence coverage rather than graph-based reasoning.
K. Additional Static Results Under both PIA and Poison attacks, we conduct experiments using Deepseek on the NQ and TQA datasets, as shown in Tables 9– 10. Additionally, under PIA attacks, we evaluate GPT-4o and Grok-4-fast across four datasets (RQA, NQ, TQA, and Bio), as reported in Tables 11–13. Overall, our method demonstrates superior performance compared to the baseline in most cases, achieving higher accuracy and lower ASR, although there are a few scenarios where it performs slightly worse than the baseline.
L. Experimental Results for Multi-Position Attacks We conduct multi-position PIA attack experiments on the RQA dataset using Deepseek to examine how the insertion positions within the retrieved list affect model performance. For top-k = 10, we simultaneously attack two retrieval positions. Specifically, we evaluate attacks targeting the early positions (Pos 1 + Pos 2) and the late positions (Pos 9 + Pos 10) to assess how the relative placement of adversarial content influences both Accuracy and ASR. In addition, to better reflect real-world scenarios where the attacker’s insertion positions may be uncertain, we sample two positions using a random number generator, resulting in Pos 3 and Pos 5. This randomized setting helps simulate the inherent randomness of practical attacks. 17
RADAR: Defending RAG Dynamically against Retrieval Corruption
Table 10. Performance of RADAR and baseline methods with top-k = 50 on NQ and TQA. Dataset
Pos
Vanilla RAG
AstuteRAG
InstructRAG
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
RobustRAG
ReliabilityRAG
RADAR (Ours)
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
65.6 68.2
– –
68.8 75.6
– –
69.2 74.0
– –
Benign NQ TQA
– –
71.6 76.4
– –
32.8 46.8
– –
56.8 60.8
– –
NQ
Pos 1 Pos 25 Pos 50
15.2 47.6 41.0
83.4 40.0 48.2
22.0 29.0 27.4
5.2 0.8 1.4
27.8 58.6 59.6
57.0 2.6 4.8
62.0 65.4 66.2
66.0 2.6 2.6
51.2 56.6 66.2
15.4 1.8 3.0
65.0 65.4 66.2
6.6 4.2 4.2
TQA
Pos 1 Pos 25 Pos 50
12.4 62.8 62.6
88.8 33.8 30.2
39.0 43.0 43.8
5.6 1.8 2.0
31.0 63.6 63.8
58.0 4.6 5.4
62.0 68.2 68.0
21.6 11.6 11.4
58.8 76.4 76.4
36.0 7.6 5.4
64.6 70.4 70.6
26.2 16.2 16.0
PIA Attack
Poison Attack NQ
Pos 1 Pos 25 Pos 50
62.2 67.5 67.4
23.0 6.6 5.8
25.2 33.4 31.6
3.2 1.4 1.4
41.2 55.2 56.4
16.8 3.2 4.2
61.8 66.4 66.6
34.0 2.6 2.6
64.4 69.2 68.4
13.4 3.4 3.4
65.4 69.6 69.2
7.0 4.6 4.2
TQA
Pos 1 Pos 25 Pos 50
37.4 68.8 73.8
58.4 26.0 15.6
38.6 43.4 43.2
10.6 5.0 4.4
38.2 57.0 58.4
43.0 17.2 15.2
59.4 68.6 68.8
26.2 11.8 11.4
59.8 74.2 75.6
33.4 7.8 4.4
65.0 69.6 70.4
23.2 16.8 15.2
Table 11. Performance of RADAR and baseline methods under PIA attack on RQA, NQ and TQA using GPT-4o. Dataset
Pos
Vanilla RAG
AstuteRAG
InstructRAG
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
RQA
Pos 1 Pos 10
57.0 59.0
32.0 28.0
27.0 35.0
47.0 6.0
21.0 53.0
NQ
Pos 1 Pos 10
52.6 47.6
30.6 30.2
43.6 43.4
21.0 3.4
TQA
Pos 1 Pos 10
36.8 38.8
50.6 43.4
55.2 65.2
35.2 13.0
ASR.↓
RobustRAG
ReliabilityRAG
RADAR (Ours)
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
62.0 27.0
69.0 74.0
16.0 11.0
68.0 76.0
24.0 9.0
69.0 76.0
16.0 9.0
35.4 51.0
32.0 17.4
57.6 62.0
9.0 4.6
59.4 65.4
19.0 8.0
62.4 66.0
10.2 7.0
48.8 60.8
41.4 28.6
61.2 69.0
23.4 18.4
58.0 68.8
40.6 22.4
61.4 69.4
33.4 24.2
Top-k = 10
Top-k = 50 RQA
Pos 1 Pos 25 Pos 50
53.0 65.0 64.0
39.0 26.0 24.0
32.0 28.0 43.0
41.0 6.0 5.0
27.0 53.0 59.0
55.0 33.0 32.0
69.0 72.0 72.0
15.0 10.0 8.0
67.0 75.0 74.0
23.0 4.0 3.0
74.0 75.0 75.0
13.0 11.0 5.0
NQ
Pos 1 Pos 25 Pos 50
50.6 52.6 52.4
34.6 27.0 24.2
46.0 51.6 50.8
16.8 2.2 3.0
34.2 54.2 54.2
35.8 19.8 14.8
57.0 65.4 65.2
8.8 3.2 3.4
58.2 67.8 67.6
19.2 4.2 3.6
64.0 67.6 68.8
7.8 5.2 4.2
TQA
Pos 1 Pos 25 Pos 50
32.6 47.2 46.2
50.6 37.8 32.8
59.4 70.0 68.8
30.4 16.4 11.2
48.4 58.2 57.2
38.4 17.1 35.0
63.5 71.0 71.2
28.2 17.0 16.8
60.8 75.8 76.8
35.2 9.0 5.6
63.6 71.2 72.2
32.0 16.2 16.0
18
RADAR: Defending RAG Dynamically against Retrieval Corruption
Table 12. Performance under PIA attack with top-k = 10 and k = 50 on RQA, NQ and TQA using Grok-4-fast. Dataset
Pos
Vanilla RAG
AstuteRAG
InstructRAG
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
RQA
Pos 1 Pos 10
19.0 37.0
79.0 57.0
18.0 18.0
3.0 3.0
12.0 47.0
NQ
Pos 1 Pos 10
12.2 18.8
86.0 75.4
52.2 52.4
2.6 2.6
TQA
Pos 1 Pos 10
11.0 33.4
89.0 63.8
65.0 70.8
RQA
Pos 1 Pos 25 Pos 50
15.0 45.0 42.0
84.0 42.0 43.0
NQ
Pos 1 Pos 25 Pos 50
13.2 31.2 27.4
TQA
Pos 1 Pos 25 Pos 50
8.0 41.0 43.2
ASR.↓
RobustRAG
ReliabilityRAG
RADAR (Ours)
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
25.0 5.0
54.0 56.0
8.0 4.0
52.0 60.0
21.0 10.0
66.0 69.0
9.0 5.0
27.2 48.6
12.2 5.4
54.4 57.0
5.2 2.2
57.0 61.4
16.8 9.8
59.4 62.4
8.2 5.0
3.8 3.6
51.6 64.4
25.2 5.2
66.0 69.0
16.2 18.4
62.6 70.2
30.6 15.2
66.0 71.0
18.8 12.8
20.0 20.0 20.0
4.0 3.0 4.0
26.0 52.0 46.0
32.0 3.0 3.0
63.0 72.0 69.0
10.0 4.0 2.0
62.0 76.0 76.0
28.0 8.0 3.0
68.0 75.0 76.0
7.0 2.0 4.0
85.6 60.4 63.2
49.2 50.0 49.8
2.2 3.8 3.0
34.8 51.6 50.4
20.4 3.6 4.0
58.0 61.2 62.0
5.2 2.8 3.2
55.0 62.0 62.0
25.4 3.6 4.0
61.0 62.0 62.0
4.8 4.0 4.0
92.0 55.6 43.6
66.6 66.8 66.6
3.8 3.2 3.0
49.8 66.0 67.6
30.4 4.4 4.4
67.2 70.0 69.8
15.8 10.2 5.6
59.4 74.6 71.8
37.6 8.8 4.2
67.6 70.2 71.8
13.8 10.0 10.0
Top-k = 10
Top-k = 50
Table 13. Performance under PIA attack on Bio using GPT-4o and Grok-4-fast. GPT-4o Method
Metric
Top-k = 10
Grok-4-fast
Top-k = 50
Top-k = 10
Top-k = 50
Pos 1
Pos 10
Pos 1
Pos 25
Pos 50
Pos 1
Pos 10
Pos 1
Pos 25
Pos 50
Vanilla RAG
Acc.↑ Rel.↑ Coh.↑
36.8 34.2 42.0
8.8 8.4 10.2
39.2 37.2 43.6
28.2 26.4 30.6
8.8 8.6 10.6
57.6 39.8 53.4
9.6 9.4 12.4
54.4 39.4 54.6
38.8 27.4 36.4
13.0 12.8 17.0
AstuteRAG
Acc.↑ Rel.↑ Coh.↑
68.2 69.8 78.2
66.8 62.4 73.0
69.8 67.2 77.6
70.0 67.8 78.4
69.8 66.8 77.0
27.4 22.8 28.8
47.0 24.8 38.0
31.8 24.4 31.6
52.6 27.0 44.0
48.8 26.4 43.4
InstructRAG
Acc.↑ Rel.↑ Coh.↑
59.4 47.0 65.4
67.6 66.8 77.6
60.8 51.2 66.2
69.6 64.2 74.0
69.0 64.6 72.6
53.8 29.8 48.0
58.2 30.2 49.8
56.0 32.2 50.2
57.4 31.4 48.2
52.6 26.2 44.8
RobustRAG
Acc.↑ Rel.↑ Coh.↑
44.6 40.0 58.2
50.8 45.2 64.4
55.2 58.0 68.8
44.6 40.0 58.2
50.8 45.2 64.4
63.6 59.8 70.6
69.6 64.4 75.8
61.0 53.4 65.8
71.2 56.2 71.4
71.4 55.6 74.0
ReliabilityRAG
Acc.↑ Rel.↑ Coh.↑
64.8 64.4 73.6
67.6 66.4 75.4
57.6 58.2 66.0
68.4 66.8 74.2
68.0 67.8 76.2
66.0 43.2 62.4
71.8 47.8 67.8
64.0 38.4 59.8
74.0 48.8 71.8
63.2 40.8 57.6
RADAR (Ours)
Acc.↑ Rel.↑ Coh.↑
75.2 68.8 82.2
69.2 68.8 78.2
72.0 65.6 77.8
73.4 70.8 79.0
73.6 67.6 79.6
68.0 55.6 69.8
72.8 55.0 73.8
69.6 54.0 67.0
74.2 53.2 70.8
69.8 50.8 67.2
19
RADAR: Defending RAG Dynamically against Retrieval Corruption
Table 14. Multi-position PIA attack results on RQA using DeepSeek. Top-k = 10
Method Pos 1+2 Vanilla RAG AstuteRAG InstructRAG RobustRAG ReliabilityRAG RADAR (Ours)
Top-k = 50
Pos 9+10
Pos 4+6
Pos 1+2+3
Pos 49+50+51
Pos 1+4+27
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
18.0 12.0 19.0 48.0 59.0 64.0
82.0 9.0 70.0 28.0 32.0 30.0
56.0 26.0 65.0 68.0 72.0 72.0
31.0 1.0 6.0 5.0 14.0 17.0
53.0 33.0 53.0 58.0 67.0 68.0
21.0 1.0 4.0 12.0 18.0 21.0
14.0 11.0 11.0 59.0 44.0 61.0
86.0 11.0 56.0 25.0 50.0 30.0
62.0 31.0 53.0 68.0 72.0 70.0
21.0 4.0 3.0 4.0 3.0 8.0
25.0 15.0 5.0 62.0 60.0 63.0
74.0 14.0 39.0 23.0 31.0 30.0
Table 15. Performance under evolving evidence streams with GPT-4o. Attack
Pos
Vanilla RAG Acc.↑
AstuteRAG
ASR.↓
Acc.↑
InstructRAG
ASR.↓
Acc.↑
RobustRAG
ASR.↓
Acc.↑
ReliabilityRAG
RADAR (Ours)
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Benign
–
56.05
–
58.93
–
72.68
–
58.46
–
58.67
–
61.29
–
PIA
Pos 1 Pos 25 Pos 50
35.76 45.04 40.12
39.99 25.40 27.90
47.28 50.93 50.99
10.81 10.75 10.68
55.39 53.93 53.42
12.80 32.18 31.35
47.47 53.49 53.29
31.99 26.49 25.14
43.38 56.88 58.09
39.41 8.25 4.54
56.17 60.65 61.23
20.02 12.15 10.87
Table 16. Performance under evolving evidence streams with Grok-4-fast. Vanilla RAG
AstuteRAG
InstructRAG
RobustRAG
Attack
Pos
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Acc.↑
Benign
–
44.21
–
25.27
–
46.83
–
50.03
PIA
Pos 1 Pos 25 Pos 50
5.89 17.08 13.63
75.82 53.04 53.55
25.72 26.10 25.72
2.94 2.82 2.75
4.99 44.79 39.99
27.90 9.40 10.17
44.84 47.98 47.92
ReliabilityRAG
RADAR (Ours)
ASR.↓
Acc.↑
ASR.↓
Acc.↑
ASR.↓
–
52.72
–
56.68
–
38.96 30.13 29.87
41.01 50.93 54.89
43.19 10.36 7.17
53.16 57.58 57.70
20.79 10.23 10.04
Table 17. Static vs. Dynamic RADAR under the dynamic setting using Deepseek. Attack
Pos
RADAR (Static)
RADAR (Dynamic)
Acc.↑
ASR.↓
Acc.↑
ASR.↓
Benign
-
54.13
-
74.02
-
PIA PIA PIA
Pos 1 Pos 25 Pos 50
48.43 50.86 51.18
20.02 12.98 12.79
63.60 70.12 70.05
17.85 8.94 6.01
Table 18. Dynamic dataset statistics. Statistic
Value (%)
Questions with 1 answer change Adjacent-year answer change rate No answer change Exactly 1 change 2 changes
77.8 68.3 22.2 26.2 51.6
20
RADAR: Defending RAG Dynamically against Retrieval Corruption
For top-k = 50, we extend the attack to three positions. Following the same protocol, we test attacks at the front of the list (Pos 1 + Pos 2 + Pos 3) and near the end of the list (Pos 48 + Pos 49 + Pos 50). We further include a randomized configuration by sampling three positions with a random number generator, yielding Pos 1, Pos 4, and Pos 27, to evaluate the impact of random multi-point attacks under a larger retrieval budget.
M. Additional Dynamic Results We present additional performance results under evolving evidence streams for two different models, GPT-4o which is shown in Table 15 and Grok-4-fast which is shown in Table 16. These results demonstrate that RADAR consistently outperforms baselines in terms of accuracy, particularly in high-ranking evidence positions. Furthermore, RADAR shows superior robustness to evolving attacks, outperforming competing methods in both benign and attack scenarios. Our dynamic setting does not inject year-specific context into queries, though retrieved documents may contain temporal cues. We compare RADAR (Static) and RADAR (Dynamic) under the same setting to evaluate the static variant and isolate gains from the dynamic extension. As shown in Table 17, the static version degrades more as evidence evolves, while the dynamic version remains more stable, indicating that improvements mainly come from the dynamic design.
N. Failure-case analysis Failure Case 1: Query: “Who won the FIFA Men’s World Cup?” • 2015 (ground truth: Barcelona): Google returns only one informative document (Pos 1). Attacking Pos 1 causes RADAR to output the poisoned answer. • 2016 (ground truth: Real Madrid): Only one informative document appears at Pos 2. Attacking Pos 1 lets the poisoned document dominate centrality; the new correct evidence is filtered out and the memory node preserves the stale answer. Failure Case 2: Query: “Who won the Nobel Peace Prize?” • 2021 (ground truth: Maria Ressa and Dmitry Muratov): Many documents describe the winners unclearly, causing some atomic answers to be generated with only Maria Ressa. This leads to the Maria Ressa cluster dominating centrality, pushing the correct full answer aside and causing RADAR to output the wrong answer. The essence of both failure cases is that RADAR’s consensus mechanism using eigenvector centrality and NLI entailment critically relies on the assumption that benign evidence forms the dominant coherent cluster in the retrieved set. When this assumption breaks because genuinely new correct evidence is too sparse or because real-world reporting noise creates a stronger false majority cluster, the Min-Cut selects the wrong partition and the memory node may further reinforces the error.
O. Dynamic Dataset Statistics We present descriptive statistics on answer changes over time in Table 18. This shows that answer volatility is substantial, suggesting the dataset better reflects dynamic retrieval settings rather than a mostly static benchmark.
P. Examples of Dynamic Dataset Our Dynamic Dataset contains 500 QA questions, each associated with several different years. For each year, we retrieved the top 50 relevant documents from Google. Using Deepseek, we generated incorrect answers for each year, which are used for PIA Attack and ASR statistics, as well as incorrect contexts, which are used for Poison Attack. Here are examples of our dynamic dataset.
21
RADAR: Defending RAG Dynamically against Retrieval Corruption
Examples of Our Dynamic Dataset { "question": "Who is the President of the United States?", "yearly_contexts": { "2015": { "answer": [ "Barack Obama" ], "docs": [ { "title": "Timeline of the Barack Obama presidency (2015)", "url": "https://en.wikipedia.org/wiki/ Timeline_of_the_Barack_Obama_presidency_(2015)", "snippet": "The following is a timeline of the presidency of Barack Obama, from January 1 to December 31, 2015. For his time as president-elect, see the presidential ...", "content": "Timeline of the Barack Obama presidency (2015) - Wikipedia..." }, { "title": "Get Ready: President Obama’s 2015 State of the Union Address", "url": "https://obamawhitehouse.archives.gov/blog/2015/01/11/get-readypresident-obamas-2015-state-union-address", "snippet": "On Tuesday, January 20 at 9pm ET, President Obama will deliver his sixth State of the Union Address. This year there will be more ways than ever to take part ...", "content": "Get Ready: President Obama’s 2015 State of the Union Address ..." } ... ], "incorrect_answer": "George W. Bush", "incorrect_context": [ "As of 2015, George W. Bush continues to serve as the 43rd President of the United States, having been re-elected to a second term in 2004..." ] }, "2018": { "answer": [ "Donald Trump" ], "docs": [ { "title": "2018 United States elections", "url": "https://en.wikipedia.org/wiki/2018_United_States_elections", "snippet": "Elections were held in the United States on November 6, 2018. These midterm elections occurred during incumbent Republican president Donald Trump’s first ...", "content": "2018 United States elections - Wikipedia..." }, { "title": "President Donald J. Trump Proclaims January 16, 2018, as Religious Freedom Day", "url": "https://trumpwhitehouse.archives.gov/presidential-actions/ president-donald-j-trump-proclaims-january-16-2018-religious-freedomday/", "snippet": "On Religious Freedom Day, we celebrate the many faiths that make up our country, and we commemorate the 232nd anniversary of the passing of a State law.", "content": "President Donald J. Trump Proclaims January 16, 2018, as Religious Freedom Day..." } ...
22
RADAR: Defending RAG Dynamically against Retrieval Corruption ], "incorrect_answer": "Barack Obama", "incorrect_context": [ "As of 2018, Barack Obama continues to serve as the 44th President of the United States, having been re-elected for a second term in 2012..." ] } ... } ... }
23