Can you protect an AI's knowledge base from planted fake documents without retraining the AI itself?

This explores whether a RAG system can be protected against someone planting poisoned documents in its knowledge base using defenses added around the system rather than by retraining the model. The corpus says yes, at least partly, and the direct evidence comes from one line of work. RAGPart and RAGMask are two lightweight defenses that work at the retrieval layer. RAGPart limits how much any single poisoned document can influence the results. RAGMask flags suspicious documents by masking some of their tokens and checking whether their similarity to the query suddenly collapses. A planted document that only looks relevant tends to give itself away this way. Can we defend RAG systems from corpus poisoning without retraining?

The attack is hard to stop at the source because of how retrieval works. The corpus describes embeddings as measuring association, not true relevance, and says that is a structural weakness rather than something tuning fixes. Where do retrieval systems fail and why? If that is right, an attacker only needs a document that looks close enough to the query to get retrieved. That makes it sensible to defend at the retrieval step, where the poison enters, instead of hoping the model sorts it out later.

The model itself is a shaky last line of defense. One note shows that language models often ignore what is in their context when their training-time associations are strong, and that prompting alone cannot override those priors. Why do language models ignore information in their context? This suggests that adding an instruction like 'be skeptical of retrieved documents' will not reliably protect you. Nor will it reliably make the model use good evidence over bad. A related idea is grounded refusal, where the system answers only when it has supporting evidence. That worked well against noisy, OCR-damaged newspaper archives, at the cost of covering fewer questions. Can RAG systems refuse to answer without reliable evidence? That note is about noise, not attackers. A well-crafted poisoned document is confident evidence, so refusal on its own would probably not catch it.

The corpus also covers two neighbouring threats. The first is a corpus that poisons itself. Bidirectional RAG lets a system add its own generated answers back into the knowledge base, but only after they pass entailment verification, source attribution and novelty checks. Those gates stop hallucinations from becoming future retrieval results, and they are the same kind of inexpensive, retraining-free filter. Can RAG systems safely learn from their own generated answers? The second is a threat class where hidden advertisements or propaganda are injected into outputs while accuracy stays untouched, so ordinary accuracy checks miss it. For that class the notes report that self-inspection defenses can detect the injected content without retraining. Can language models be hijacked to embed hidden advertisements?

The corpus has only one note directly on RAG poisoning defenses, and it does not say how they hold up against an attacker who knows the defense and designs around it. What the notes do show is a pattern: the cheap defenses sit at the retrieval and write-back gates, and the model's own judgment is the weakest place to put them.