SeCon-RAG: A Two-Stage Semantic  Filtering and Conflict-Free Framework for Trustworthy RAG
Authors: Xiaonan si
Meilin Zhu
Simeng Qin
Lijia Yu
Lijun Zhang
Shuaitong Liu
Xinfeng Li
Ranjie Duan
Yang Liu
Xiaojun Jia
Venue: NeurIPS 2025 poster ()
Keywords: RAG
Prompt of LLMs
Defense against RAG attack
Primary area: deep_learning
TL;DR: A defense method against RAG corpus attacks that combines semantic of document.

Abstract: Retrieval-augmented generation (RAG) systems enhance large language models (LLMs) with external knowledge but are vulnerable to corpus poisoning and contamination attacks, which can compromise output integrity. Existing defenses often apply aggressive filtering, leading to unnecessary loss of valuable information and reduced reliability in generation.
To address this problem, we propose a two-stage semantic filtering and conflict-free framework for trustworthy RAG. 
In the first stage, we perform a joint filter with semantic and cluster-based filtering  which is guided by the Entity-intent-relation extractor (EIRE). EIRE extracts entities, latent objectives, and entity relations from both the user query and filtered documents, scores their semantic relevance, and selectively adds valuable documents into the clean retrieval database. 
In the second stage, we proposed an EIRE-guided conflict-aware filtering module, which analyzes semantic consistency between the query, candidate answers, and retrieved knowledge before final answer generation, filtering out internal and external contradictions that could mislead the model.
Through this two-stage process, SeCon-RAG effectively preserves useful knowledge while mitigating conflict contamination, achieving significant improvements in both generation robustness and output trustworthiness.
Extensive experiments across various LLMs and datasets demonstrate that the proposed SeCon-RAG markedly outperforms state-of-the-art defense methods.

SeCon-RAG: A Two-Stage Semantic Filtering and Conflict-Free Framework for Trustworthy RAG
Xiaonan Sit", Meilin Zhu 7hu2.3,.Smengg Simeng Qin Lijia Yust, Lijun Zhang Shuaitong Liu", Xinfeng Li², Ranjie Duan Yang Liu", Xiaojun Jia"
Institute of Software, Chinese Academy of Sciences, Beijing, China Key Laboratory of System Software (Chinese Academy of Sciences) and State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences, Beijing, China
Univeesiity of Chinese Academy of Sciences, Beijing, China Northeast University, China iInstitute of Ai For industries, Nanjing, China "Nanyang Technological University, Singapore *Alibaba, China
"Southwest University, China
Abstract
Retrieval-augmentee generation (RAG) systems enhance large language models (LLMs) with external knowledge but are vulnerable to corpus poisoning and con- tamination attacks, which can compromise output integrity. Existing defenses often apply aggressive filtering, leading to unnecessary loss of valuable information and reduced reliability in generation. To address this problem, we propose a two-stage semantic filtering and conflict-free framework for trustworthy RAG. the first stage, we perform a joint filter with semantic and cluster-base filtering which is guided by the Entity-intent-reltton extractor (EIRE). EIRE extracts entities, latent objectives, and entity relations from both the user query and filtered documents, scores their semantic relevance, and selectively adds valuable documents into the clean retrieval database. In the second stage, proposed an EIRE-guided conflict-aware filtering module, which analyzes semantic consistency between the query, candidate answers, and retrieved knowledge before final answer generation, filtering out internal and external contradictions that could mislead the model. Through this two-stage process, SeCon-RAG effectively preserves useful knowl- edge while mitigating conflict contamination, achieving significant improvements in both generation robustness and output trustworthiness. Extensive experiments across various LLMs and datasets demonstrate that the proposed SeCon-RAG markedly outperforms state-of-the-ar defense methods.
Introduction
Large Language Models (LLMs) |5
12 32
have demonstrated remarkable capabilities across wide However, they still suffer from critical security vulner- 29], jailbreak attacks 21 19 46 and other alignment
range of natural language tasks [51 abilities, including adversarial attacks challenges. Moreover, their knowledge is fundamentally limited by their training data, which can lead outdated hallucinated information. Retrieval-Auge Auggeeted Generation (RAG) addresses this issue by dynamically incorporating external documents during generation, improving factual accuracy and However, due to the reliance on external corpora, RAG systems are susceptible to corpus poisoning and retrieval contamination attacks, which involve injecting adversarial content into the retrieval database manipulate the model's output 31 49
15
14
48
timeliness 25 3
'These authors contributed equally. The code is available here 1 "ooressponding authors: Simeng Qin ginsimeng @ neuq.edu.cnt Lijia Yu (ljyu@iain aa..@iiiii....)).)) Lijun Zhang (zhanglj @ios.iissoc.. .n.n.. Xiaojun Jia (jiaxiajuuqqqq com)
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Recent defense strategies have attempted to address this by employing adversarial training, retrieval filtering and reasoning- based conflict resolution 44 [4]] These methods primarily use Coarse- grained filtering or voting to remove malicious documents, and the inference phase does not consider what information the RAG should select when confronted with conflicting content, which can result in two limitations. (1) Coarse-Grained filtering will removes both harmful and useful content. (2) Failure to resolve conflicts between retrieved and the LLM's internal knowledge, which leads to untrustworthy results.
To address these issues, our framework first integrates semantic information into the RAG filtering method. We extract intrinsic semantic signals from each document to allow for fine- tineggrined filtering while also facilitating the resolution of conflicting evidence during inference. Building on this insight, we propose SeCon-RASe RAG, two-stage framework that combines semantic and cluster- filtering with conflict-filtering retrieval- augmented generation.
We first design a semantic extraction module called EIRE Eenniiy-Intent-Relaann Extractor). It makes future modules easier use by extracting entities, hidden intentions, and relationships between entities from document information. In the first stage, we propose a Semantic and Clustering-Bad -aased Filtering module (SCF) based on EIRE. On the one hand, it filters the intensive incorrect documents based on their cluster in the embedding space. On the other hand, using EIRE, the semantic structure graph of candidate documents and verified correct documents can help to exclude more hidden poisoned documents. The implementation of this dual filtering mechanism can ensure that the majority of malicious and poisonous documents are filtered out while also preventing potentially valuable documents from being wasted.
In the second stage, propose an EIRE-guided conffict-aware filtering (CAF) module that checks the semantic consistency of the query. the candidate context, and the model's internal knowledge. CAF uses EIRE to extract semantic information from the final input information, judge different information based on semantic knowledge, and remove misleading information caused by internal and external knowledge conflicts or omissions before generating the final response. This ensures that the final generations are not only factually accurate, but also semantically consistent across internal and external knowledge sources.
In comparison to previous work, our work makes significant advances. Our approach is the first to incorporate semantic information into the retrieval and inference phases of RAG defenses. We propose a two-stage defense framework that employs semantic reasoning to ensure robust during retrieval (SCF) and generation (CAF). The proposed framework implements structured semantic filtering by extracting entity-intent relationships and using them to filter poisoning documents which may evade clustering-based defenses.
We evaluate SeCon-RAS on three QA benchmarks Natural Questions, HotpotQA, and MARCO across five different LLMs including LLaMA-3.1-20 1--BB [13, Mistral- 12B (2). GPT-4o [Л]. DeepSeck-Rl [8], and Qwen- 7B [20]. Our method consistently improves robustness, consistency, and resistance to corpus poisoning across all settings. Our main contributions are summarized as follows:
(a) We are the first to incorporate structured semantic information into RAG defense filtering by the proposed EIRE module, allowing for fine-grained understanding of entity, intent, and relation structures to improve the precision of poisoned content detection. (b) Building on EIRE, we propose SeConRAG, two-stage defense framework that combines semantic and cluster-based filtering with conflict-aware filtering to improve retrieval robustness and answer consistency. (c) Extensive experiments on variety of datasets and LLMs show that SeConRAG consistently achieves high factual accuracy, low attack success rates, and high generalizability. demonstrating its practical effectiveness and alug-and-play capabilities.
2
Related Works
2.1 Retrieval-Augmenned Generation
-uggeetal-Augmenteed Generation improves large language models by supplementing them with external knowledge extracted from large corpora, thereby addressing limitations in factual recall
and knowledge coverage [25 43. While RAG's generation quality has improved, continues to suffer from retrieval errors, hallucinations, and poor content integration. To address these issues,
2

---

previous research has focused on query rewriting, index optimization, and memory- based retrieval
52
28
Recent -augmented methods include Insight-RAG [33]. SURE [23] and PIKE-RAG
40
which use L.Mss to improve task comprehension, retrieval relevance, and data decomposition
Reinforcement learning has also been applied optimize retrieval generation pipelines [50].
However, these methods are primarily applicable in benign environments and do not explicitly address
poisoning threats or semantic inconsistencies caused by conflicting retrieved content.
2.2 Adversarial Attacks on RAG
Recent research indicates that RAG systems are extremely vulnerable to adversarial manipulation both the input and corpus levels. Attack strategies include: (1) Corpus Poisoning Attacks, which inject adversarially crafted documents into the retrieval corpus and manipulate downstream outputs 9 45 533 B1. (2) Prompt Injection Attacks, which use imperceptible instructions embedded in user queries retrieved content to hijack LLM behavior without altering the underlying corpus [35 22 26 (3) Backdoor Attacks, in which hidden triggers are implanted into the corpus or model and activated only under certain conditions (27 [0]. These attacks destroy the reliability of RAG outputs and expose the system to silent failure scenarios.
49 (7 55 36
2.3 Defenses Against poisoning RAG
A variety of defense strategies have been proposed to counter adversarial threats. Perplexity- baased based de- tectors seek to identify anomalous generations, whereas RevPRAG examines LLM activation patterns to detect poisoned inputs [36] 38). RobustRAG introduces an isolate- sellate-then-agee then-aggregatt framework to im- prove robustness by decoupling retrieval paths, while AstuteRAG adaptively fuses internal knowledge with retrieved content using heuristic selection [4 39]. InstructR AG enhances Retrieval-Augmennte
Generation by employing self-synthesized rationales, guiding the retrieval process to improve the relevance and coherence of generated outputs 42 TrustRAG filters out malicious content using clustering over document embeddings and introduces conflict resolution mechanism based on document consistency [54] Although promising, these approaches have two major limitations: Majority-voting often fails under high poisoning, while heuristic and aggressive filtering may lose relevant content under low poisoning.
In contrast to previous work, we propose OcCon-RAG, a robust two-stage framework for fine- fine-graing grained semantic filtering and conffict-aware inference. SeCon-RAG improves robust against both high and low poisoning setting by leveraging intrinsic semantic signals and reasoning over document-level consistency, while preserving valuable information for reliable generation.
3 Preliminary
This section provides a brief overview Aetrieval-Augmentee Generation and introduces the threat model of corpus poisoning attacks that underpins the defense strategies proposed in this paper.
3.1 Retrieval-Augmeente Generation
Retrieval-Augmented Generation a widely used paradigm for augmenting large language models with external knowledge obtained from a document corpus. Given a user query and a corpus D = {d.}. where d, represent the documents in D. The standard RAG framework has three primary stages. In the first stage, compress the query g and the documents d, in D into E(g) and E(d,) using the embedding model E. In the second stage, select the top-k documents with the highest similarity to the problem in the document to form set (g). The similarity is determined by given function sim(.,) :,, as follows:
(x Top-k ((d)
Finally, the retrieved documents D& are combined with the original query q to create augmented input prompt. The augmented input processed by generative model F, such as a large language model. ie. F(g. (g))), to generate the final output.
3

---

3.2 Threat Model: Corpus Poisoning Attacks
We examine threat model that tries to trick a RAG system into producing incorrect answers by inserting carefully crafted malicious documents into its retrieval corpus. The attacker chooses M target queries Q {91. 92..... ................................ 9aí } and matches each query qi with a poisoning target answer ry For example, for q: = "Who is the president of America?", the adversary may want the RAG system to produce r; "The president of America Harris". To achieve this, the attacker injects N poisoning documents per query. Let pa denote the j-th poisoned document for query qi where The total set of injected documents is:
j ,,,..,.. N.
r {rl i= 1...., M; = 1,...,, N}
The attack aims to create so that, for each query qi E Q, RAG system retrieves documents from the poisoned corpus D' D U' that lead the generative model F to produce the incorrect response ry:
F(q: D'u (9.)) rs, Vi E [M].
This threat model consistent with previous research on corpus poisoning and informs our design of filtering-based defense strategy. In the following sections, we present our proposed SeCon-RAG framework, which combines two-stage filtering protect against corpus poisoning attacks.
4 The Proposed Defense Method for Corpus Poisoning A Attacks
To protect Retrieval-Augmented Generation systems from corpus poisoning attacks, propose RAC,, a robust two-stage filtering framework designed to detect and suppress poisoning documents. The first stage eliminates poisoned content statistically and semantically, while the second stage ensures factual consistency from semantic reasoning perspective. This design ensures robustness without unnecessary knowledge loss. To enable fine-grained semantic understanding and aid in the detection of potentially poisoned content, we propose Entity-Intent- Relation Extractor in section [4. a semantic structure extraction module that serves as the foundation for our two-stage filtering framework. Before the retrieval stage, we propose Semantic and Cluster-Based Filtering shown section creates a semantic graph from the information extracted by EIRE, allowing for dual-channel filtering based on both clustering structure and semantic relevance. During the inference stage, we introduce the Conflict-Aware Aware Filtering module shown in section 4.3] CAF performs cross- source semantic consistency checks using both EIRE on the retrieved content and the model's 's internal knowledge representations. Figure [ shows an overview of the full Secon-RAG framework. The appendix A.3 shows the pseudocode for the overall algorithm.
4.1 EIRE: Entity-Intent-Relatee Extractor
To enable fine- fine-grained semantic understanding and aid in the detection of potentially poisoned content, we propose EIRE (Entity-Intent-Relll
Extractor), a semantic structure extraction module that serves as the foundation for our two-stage filtering framework. EIRE intended capture the high-level meaning of a document by breaking it down into three core structural components:
Entities: Key entities explicitly or implicitly mentioned in the text.
Intent: The underlying purpose or objective conveyed by the passage.
Relations: Semantic relationships between extracted entities, such as beat or followed by.
To extract these components, EIRE employs prompt- based large language model. Given document d, we create structured prompts that direct the LLM to generate a structured triple. Appendix I contains example of the prompt and its output. For document d, EIRE generates structured triple (Fa, Ja, Ra), where E. is the set of extracted entities, Ta is the identified intent, and RL the set of semantic relations between entities. By grounding document analysis in interpretable semantic frames, EIRE provides a robust and explainable foundation for downstream filtering.
4.2 Semantic and Clustering-Basee Filtering
To reduce the risk of retrieving poisoned or adversarial documents, we introduce dual filtering mechanism in the retrieval stage called Semantic and Clustering- Based Filtering (SCF). SCF applied before selecting D& in the RAG pipeline.

---

(wwii--aaiin--tcallee Estrattrr
Secen R Framowork
Fibrraag Decamaan
Palocing DeCEENIES
Instreet
User Query
User
Correc Respeme
Afterke
SCPocceaste Clsttr Hering
CAFoCanlian for Filteing!
Bllertng
Bastmntio:: Use EIBE seriene marrabll inferunce
Fitciing
Figure I: Overview of the SeCon-RAG. A two-stage defense in which SCF filters poisoning corpus during retrieval and CAF eliminates residual conflicts during inference, guided by semantic informa- tion obtained through EIRE.
4.2.1 Clustering-Basee Filtering
Adversarially generated poisoning documents often exhibit highly similar phrasing or templated structures, especially when crafted to target the same query. As result, they naturally form tight
clusters in the embedding space [54] mitigate this, we first apply clustering- detect poisoning document groups. Given potentially poisoned corpus D Dur, we embed each
filter to
document E D' into the vector representation m(d) and apply K-means clustering to obtain K
clusters C = .c......e CK }, each with centroid [e: Ed,ec, m(d,), U = D' 30) We
then define the filtered set as:
Deluster
U (d E sim(m(d)) (b)) < Teluster i=1
(4)
where sim(:;-) denotes the cosine similarity normalized to [0, 1]. and Teluster E (0, 1) is an adjustable filtering threshold. This operation effectively exclude documents that cluster tightly around centroid, which are likely to be maliciously inserted poisoning documents.
4.2.2 Semantic Craph-Based Filtering by EIRE
However, clustering- based methods rely solely vector similarity in the embedding space, which can lead to false negatives by discarding valuable documents like topic overlap. To address this, we propose semantic filter based EIRE that extracts semantic structures from individual documents and generates corresponding semantic graphs. Specifically, for document d, we construct a semantic relevance graph G. (V,, Egy) by using information extracted from EIRE simulate the semantic coherence and connectivity of the document d as follows:
Vy: Each node Vi in the Ga corresponds to the embedding representation of an entity extracted from document d;
Eay: edge eij between two nodes 0z; byy denotes semantic relation extracted by EIRE connecting the two entities.
Figure visualizes semantic graphs generated by EIRE for correct and poisoned documents under the query: "Which French ace pilot and adventurer flew L' L'Oiseau Blanc?". As demonstrated, correct documents produce densely connected semantic graphs with high coherence, whereas poisoned documents have sparse or fragmented structures. From a graph-theoretic perspective, the correct document displays densely connected semantic graph, with the correct answer node well integrated into the EIRE conceptual structure, resulting in semantic graphs with high structural connectivity
5

---

Greay
adavrtuuus iqueaaiie
Nulation bocwour node
World Mert
(a) Correct document
(b) Poisoned document
Figure 2: Semantic graph comparison using EIRE, more textual details has shown in AppendixA.1.2 A.1.2
and semantic coherence. In contrast, poisoning content often introduces isolated or deceptive claims lacking semantic support from the surrounding context. Consequently, their semantic graphs exhibit abrupt or unnatural connections, with isolated nodes or disconnected subgraphs, in sharp contrast to the coherent clusters in correct documents. This structural distinction underpins our semantic filtering strategy.
To use these structural properties, we first construct set of semantic graphs Gour = [G from small collection of verified correct documents Deor = {deor.s) } and use the semantic graphs Geor as a benchmark. Geve used for semantic reference are small set of samples chosen manually from the dataset. For any candidate document d E 'D', we generate its semantic graph Ga using EIRE and assess its similarity to the G Rather than relying on rigid graph similarity metrics, employ large language models' semantic reasoning capabilities to compare graph structures a more flexible and context-aware way. For any candidate document d, compute its semantic similarity score ssG by comparing generate Ga to Gdzur, using a prompt-based LLM as shown in appendix A.I
ssG(d, D L.M, G
(5)
To facilitate downstream filtering, we limit the I.L derriieeed semantic similarity score ssG(d, D [0, 1]. The higher the similarity score, the closer the semantic graph of d and baseline Gvor. Using this score, we define the semantically filtered document set as:
Deemantic = {d D' sdG(d, D S Tsemamtic
where Tsemantic is the adjustable threshold that controls the strictness of semantic filtering. It is worth noting that, while vector projections are used to visualize and shape semantic graphs, the real inputs to the LLM in Equation (5) are natural language descriptions of the graphs serialized as structured triples.
4.2.3 Joint Filtering Decision: Robust AND Logic
To increase robustness while reducing the risk of discarding valuable information, we use conserva- tive AND-based filtering strategy. Only documents that have been flagged by both clustering and semantic filters are filtered. We define the final set of filtered documents as Dínal = Deluster O D seeaanii- Accordingly, the final retained corpus is:
D' Pinall
By the joint filter, the SCF module combines unsupervised clustering and semantic reasoning to detect poisoning documents from multiple perspectives. This layered approach improves the quality of retrieved documents and provides a robust first line of defense in the SeCon-RAC -AG framework.
4.3 Conflict-Aware Filtering (CAF)
Although the SCF module effectively reduces adversarial content, it may retain documents that are not malicious but semantically irrelevant or internally inconsistent. These residual conflicts, such as documents that contradict the query, other retrieved evidence, or the model's internal knowledge, can reduce the factual reliability the final answer. address this limitation, we propose Conflict-Aware Filtering (CAF), semantic inference module used at the inference stage of the RAG. CAF aims to refine retrieved set Dz by identifying and removing documents that don't 't meet semantic and factual consistency criteria.

---

For each candidate document E (g),), CAF generates structured semantic information using EIRE, which is divided into three components: Entities capable of determining whether facts align with the model's internal knowledge; Intent to evaluate query alignment; Relations that can evaluate logical coherence across documents and detect contradictions or omissions. In the final inference process, we prompt the LLMs as shown in appendix 1..1j to determine which information from the retrieve documents is reliable from three dimensions using the semantic information extracted by EIRE:
Q(Query Consistency): Does the document semantically aligned with the user query q. based on intent and entities?
C(Corpus Consistency): Is the document consistent with the other retrieved documents (x( \ dd based on shared relations and context?
M(Model Consistency): Is the document factually compatible with the LLM's internal knowledge, considering key entities?
The LLMs will render judgment whether the information is poisoned, conflicting, irrelevant, or trustworthy, which will be used to make final decisions. Finally, the LLMs extracts the final answer A(g) to query y from documents that perform well in these three dimensions:
A(q) Fqg DCAF) DCAF = [d E (x()) CAF(d, Q, M) trustable}
Figure shows the operation of CAF. Following filtering by SCF, each document is evaluated by the LLM based on EIRE-derived semantic structure. Information from documents have been identified as poisoned, confficting, irrelevant is discarded, leaving only trustable information for final generation. This ensures that the generation module operates on a semantically coherent, query relevant, and factually aligned knowledge base, thereby increasing robustness and factual faithfulness.
CAF enhances SCF by providing fine-grained semantic validation. While SCF removes broad outliers based on statistical semantic graph anomalies, CAF ensures that documents generated have coherent intent, correct facts, and logical consistency. This layered design increases the final output's 's robustness as well as its factual accuracy.
5
Experiments
5.1
Setup
This section describes the experimental setup. We evaluate the effectiveness and robustness of SeConRAG under various adversarial scenarios. All reported results averages of multiple runs with an error of + 1%.
Datasets. We test three popular open-domain question-answering benchmarks: Natural Questions (NQ) (24. HotpotQA [47), and MS-MARCO 6 Each dataset corresponds to a large-scale corpus. Attack Settings. To test robustness under poisoning scenarios, evaluate representative types of attacks against RAG systems: (1) Corpus Poisoning Attack, following PoisonedRAG [53,, which inserts adversarial passages into the corpus; (2) Prompt Injection Attack (PIA) (53 17 which adversarial prompts are created by perturbing discrete tokens to closely resemble training queries, thereby misleading the model during inference. It ensures comprehensive evaluation of SeCon-RAG under both input and retrieval adversarial threats.
Evaluation Metries. We use standard metrics from previous research evaluate model robustness and answer quality: (1) Accuracy (ACC) is the percentage of generated answers that exactly match the ground truth. (2) Attack Success Rate (ASR): The percentage of poisoning queries documents that cause the model to produce incorrect results.
Verified Correct Documents. To create the semantic reference set Deor, we manually selected 10 clean documents from each dataset.
Model. We tested five LLMs from both open and closed source families: Mistral-12BB Qwen-7B, LLaMA-3. 1 1-8, GPT-40, and DeepSeek-R1. RAG backbones are maintained in accordance with the corresponding L.M.s. Appendix [..]]ro detailed prompts for EIRE, semantic similarity, and CAF modules. All experiments carried out using NVIDIA 100-SXM4-40GB GPUs.
7

---

Table I: Performance comparison of SeConRAG and baseline methods across three QA datasets and five LLMs under PIA, 20% and 100% corpus poisoning, and clean settings. Best values (highest accuracy lowest ASR 1) are highlighted in bold.
Mixld
BetpaiQA
NO
MISMARCO NDC/
ACCIASR
ACCIASR
ACC7
ACCIASR
ACC ASR
ACC/ ASR
ACC/
ACCY
ACC
$100/400
B.9 MS.2
28 55.1
15.0
67.6/773
822/900
242/4482
56.0
M.1/BM
448/
13.6 (11.5
15.0
/412
156/82-7
S1811400
56.0
615//3122
15-9/78-2
57:32 16.4
31.0
IreeitAl: [S]
13.5/15
13:5/36
715-145
14.5
$1.0
68.27 0.5
62.7/15
66./131
13.0
50.0/ RuB
91.8:10.
67.3211.8
850
72.5/08
76.7/86
72.7/455
$5.0
72.57 1.8
638/2.
54./1182
K5.0
91.5/68
10:22/14
/9.1/991
9881
Instm::kr [1]
56.7/163
76.57764
05 03.5:55.8
67.0
54.2/4555
25.5/76.4
47.5/433
61 03.8
49:1:48.5
750
Qu 11 B
ASTUTTRAAG ti
$138/79.1
45.9744.1
65.0
56.711333
63.5/552
00:5/733
56.0
43:37554
56.9:7010
7000
TiveRAri
632/00
5823-36-4 26-3
31.0
600/1-3
645/245
57.0
06:7/18
04.57313 31.8
56-923211
7600
SaiitaRAG
31.87631
3.5736 4.
56.45573
10.0
35.2/5655
T0L
54.5 5636
9.1158.3
54.5740.
$3.0
IrstrwuR.MG NG 3M
61.8/30
27.3/71.8
07.3-9000
76.0
07.3/241
32.72073
50./31.5
T00
08 (-55
45.5/51.8
72.7/32.5
81.0
MaMM-31-40
17.5185
TreeRAG [4]
72.7/0L5
6555-181
54.5162
79:1/60
$6.4/1.5
56.516.4
85.4/.11
840
736/0.5
73.87
07.4/184
$1.0
851/5T
$63/11
$6.948
90.0
$7.3/133 0.3
30.1/10.
36.2/9.1
98.1
AaniialAAG
57.3/40.0
11.9/818
3200
209/442
22.3/8822
2302/5411
12:32 18.4
340
[n]
cari-4a i1
ASTUTIKAL by
7227 14.
6/31/34.1
22.5-118
$1.0
836745
15.51142
19.176.1
$1.0
SOL5/10 133
75.4
52.716.
99.1
DISIIAL [S]
6185/0.
819/27
79.1/54
$5.0
12.7/8L5
$18718
16.0
19.1713
19L1-1.8
$4.766
85.11
K36/0.3
836/24
79.155
36.9
961105
$18/69
$45/1.
$5.0
936/08
89.1/L
99.1/3.
9401
Aa
901/1227
100//6.1
51 40:0-00
$1.0
123/SL5
510/441
KILD
71 7185255
11.3/118
83.0
61.87 36.
37:3/13.3
61 353
$3.0
961/7582
65.5/337
$2.0
755/152
$1.824755
72.773964
87.0
DerpBodko11
ASTIFTIRAA
2367143
61.7/35.5
77.5
790
WID:1K
81.8 10.9
19.1/80
K7.0
873//45
885182
W8.1/55
890
845/30
818/80
$5.655
35.0
9../699
96.169
96.408
96.0
9237350
94.5118
94.5/3.5
94.1
5.2 Main Results
We evaluate the robustness and effectiveness of SeconRAGE against four representative Retrieval- Augmented Generation (RAG) defense baselines VanillaRAG, InstructRAG 42), AstuteRAG (39], and TrG (54), across three datasets and five LLMs. To verify that our method can handle both high and low poisoning rates simultancously, each model is tested under four settings: Clean, Prompt Injection Attack, PoisonedRAG-200
and PoisonedRAG-IIe 100%% with results reported in terms of Accuracy and Attack Success Rate. Table | summarizes the key findings. More detailed PoisonedRAG results at different poisoning levels can be found in Appendix A..41
Results in Table demonstrates that SeConRAG outperforms in almost all datasets, LLMs, and attack scenarios. Under high poisoning DoisonedRAAG-1009) it consistently maintains high accuracy and low ASR. For example, on HotpotQA with GPT-4o, SeConRAG achieves 83.6% accuracy and 2.4% ASR, outperforming TrustRAG (80.9% / 2.7%) and ASTUTERAG (67.3% 22.1%%) A Similar trends hold under low poisoning (20%), where SeConRAG consistently improves robustness compared with baselines. SeConRAG also performs well against Prompt Injection Attacks, which target the input layer rather than retrieval. On MS AS-MARCO with GPT-4o, it achieves 93.6% accuracy and 0.0% ASR, slightly surpassing TrustRAG and ASTUTERAG. Even with smaller models such Qwen-7B, SeConRAG retains competitive performance (67.3% / 0.5%), demonstrating the effectiveness of CAF in mitigating prompt-level inconsistency.
Importantly, SeConRAG continues to perform well on clean corpora. On MS-M -S-MO with 1e,,Seek-R1, it reaches 94.0% accuracy, and on NQ with Mistral- it achieves 82.0%, out- performing TrustRAG (73.0%) and ASTUTERAG (70.0%). This demonstrates that the defense mechanisms do not degrade benign performance. Overall, SeConR AG consistently outperforms or equals existing defenses across datasets, LLMs, and threat scenarios. Across both large models models (Qwen-7B, Mistral- 12B), it consis-
(GPT-4o, DeepSeek-RII and smaller instruction-tunm tently delivers reliable and generalizable robustness against both corpus poisoning and prompt-level adversaries, making it viable defense for real-world RAG deployments.
5.3 Ablation Study
We conduct an ablation study on the Mistral-12B model to evaluate the contributions of SeCon-RAG's components. We concentrate on two key areas: (i) the core SCF and CAF modules, and (ii) an ablation study that includes the SCF subcomponents, EIRE, and the verified Correct Document Set.
5.3.1 Core Modules (SCF and CAF).
To evaluate the impact of SCF, we remove this module and compare performance with three QA datasets. SCF uses clustering and semantic graph filtering to eliminate documents that are semantically irrelevant poisnnng.. Figure 3 shows that disabling SCF consistently decreases accuracy and
8

---

increases ASR across all datasets. In the 100% poisoning setting on HotpotQA, accuracy drops from 74.0% 71.0%, and ASR increases from 8.0% 25.0%. Under prompt injection attacks. accuracy decreases from 92.0% to 85.0%. These findings support SCF's effectiveness in increasing retrieval precision and resisting semantically attacks. We then assess the CAF module, which filters semantically conflicting evidence using EIRE-based consistency checks. Removing CAF leads to more severe degradation. When using HotpotQA with 100% poisoned data, accuracy drops to 68.0% and ASR rises to 56.0%. ASR increases to 47.6 .,0% on NQ, while accuracy decreases from 92.0% to 46.0% on PIA. These findings highlight CAF's critical role detecting and filtering conflicting or misleading documents that SCF alone may miss.
Accuracy Comparison
ASR Comparison
Alne Suctenstt
SSCOAAAL wi
core
Figure 3: Ablation results accuracy and attack success rate (ASR) across three datasets using Mistral-12B. From left to right are HotpotQA, NQ. MS-MARCO.
5.3.2 Evaluation of SCF Subcomponents, EIRE, and the Verified Correct Document Set.
To examine whether clustering and semantic filtering are complementary, we test each individually. As shown in Table A.4.I their combination yields the strongest robustness, achieving lower ASR in several cases, which conhrms the necessity of combination.
In addition, we assess the standalone effectiveness of the Intity-Intent-Reell verified correct document set (door). Table [A.4.2 in appendix summarizes the results. EIRE improves the fine-grained reasoning capability of both SCF and CAF. With EIRE enabled, the model consistently achieves higher factual accuracy while significantly lowering ASR, especially under high poisoning conditions. Similarly, small, Sigh-quality deor set can significantly improve semantic filtering performance and reduce noise from poisoned documents. as well improve robustness under high-poisoning conditions (c.g., ASR + on MS-MARCO 100% poisoning).
Extractor and the
The ablation results show that both SCF and CAF critical for protecting against poisoning attacks. SCF performs coarse filtering of anomalous content, while CAF ensures semantic and factual consistency. Their collaboration allows SeCon-RAG to maintain strong performance in high-poisoning and adversarial scenarios.
5.4 Runtime Analysis
Instruc- IRAG, AstuteRAG, and TrustRAG-on three QA benchmarks: HotpotQA, NQ. and MS-MARCO. The methods are evaluated in three adversarial settings: Prompt Injection Attack and PoisonedRAG with 100% or 20% poisoning. Figure 4 depicts the full results. Although SeConRAG achieves
We compare SeConRAG's runtime cost to four representative RAG
Runtime Analysis
Time
Pasentp
Prouneg
VanilaRAG
InstructKAA
StiloRAG
TTTISRAG
SeconRAG
Figure The average runtime per batch (in minutes) for three datasets and adversarial settings. From left to right are HotpotQA, NQ, MS-MARCO.

---

the highest robustness in all settings, it has moderate runtime overhead. It takes between 1.21 and 1.45 minutes per batch, depending on the dataset and the severity of the attack. This cost is due to its multi-stage semantic filtering, consistency checks, and conflict filtering, which protects against poisoned documents. Despite the additional cost, SeConRAG maintains a practical runtime range. Deeper semantic understanding requires the use of LLMSs for semantic structure extraction and graph similarity calculation. Despite the additional cost, SeConRAG has a reasonable runtime range. This trade-off is acceptable for many real-world RAG applications that need both robustness and correctness. For example, on NQ with 100% poisonnng it completes in 1.06 minutes, only 10 seconds slower than TrustRAG (0.67 min) AstuteRAG (0.70 min), but it offers significantly more reliable answers. Overall, the asymptotic overhead is moderate relative to standard retrieval. This trade-off is acceptable for many real-world RAG applications that require robustness and correctness.
5.5 Embedding Models
We further evaluate SeConRAG with four widely used embedding models: M11 (66) BERT and 8 These encoders are integrated into the retrieval and two-stage filtering pipelines, with Mistral-12B 12B serving as the primary LLM. Table 2 displays results from three datasets with various poisoning ratios. Across different embedding model, SeConRAG maintains high accu- racy (> 75%) and low ASR (< 10%) under 100% poisoning. For example, on MS-MARCO, BGE achieves 90.0%/0.0%% while MiniLM yields 77.3% These findings confirm that SeConRAG's defense framework perform well across embeddings and avoids reliance on a single model.
Table 2: Comparison of SeConRAG performance under different embedding models (MiniLM, SimCSE, BERT, BGE) across varying poisoning ratios three datasets. highest accuracy or lowest ASR
Mald
bettin
AISATARDO
ACCVARE
ACCY ASR
NOO ARR
MYTARR
ACE ARR
AECFASR
NECIARR
ACTVARR
AECHASK
ACCHARE
13h
SecCE
113740
M55TEn
312733
533183
661/00
918718
QURIED
4037E2
GE0/ER 403/00
#dred 17a.
TERIDE
(611
33/11
918/13
RSR.
1T3/40
2:5200
688/E0
660/61
www.d
707766
955/55
108136
(61/18
(61/15
VIRIED
412200
996.00
5.6 Sensitivity Analysis of Filtering Thresholds
We investigate the impact of two primary thresholds, Teluster and Tsemantics on LLaMA-3.1 1--BB and GPT-4o. As shown in Table A.4444 performance remains stable across reasonable ranges (Teluster [0.86, 0.90), Tsemantic 10.2, 0.4)), with accuracy variations within +2% and low ASR. This robustness is due to the conservative AND-logic in joint filtering, which ensures that only documents flagged by both filters are removed. As a result, SeConRAG is not overly sensitive to precise hyperparameter tuning, making it useful in real-world deployment.
6 Conclusion
We propose SeCon-RAG, robust augmenedl-aummeeted generation framework that protects against corpus poisoning. It combines two complementary modules: Semantic and Cluster-Based Filtering, which removes poisoned content using clustering and semantic similarity, and Conflict-ware Filtering, which filters out contradictory or misleading evidence using structured semantic reasoning. Experiments with multiple datasets and poisoning scenarios show significant improvements in answer accuracy and reduced attack success rates. SeCon-RAG RAG provides a scalable and interpretable defense for RAG systems in adversarial environments by combining coarse- -raiind statistical pruning and fine-grained semantic validation. The Impact Statement of our paper is shown in the appendix.
Limitations. While SeCon-RAM RAG demonstrates strong robustness against range of poisoning attacks, several limitations remain. First, BeCon-RAG introduces moderate inference latency due to multiple LLM calls (EIRE extraction, semantic similarity, and CAF decision decision-making). Second, the framework relies on high-quality semantic extraction; Finally, a small set of manually verified documents D D is required. Future Future research could reduce runtime overhead by replacing EIRE with smaller models and exploring lightweight graph similarity metries. These changes will make SeCon-R RAG better suited for aitency-sensitie real-time RAG applications.
10

---

Acknowledgments and Disclosure of Funding
This work is supported by CAS Project for Young Scientists in Basic Research, Grant No. YSBR- 040, ISCAS New Cultivation Project ISCAS-PYFX-202200 ISCAS Basic Research ISCAS-JCZD- 202302, National Natural Science Foundation of China General Project (No. 71971051, No. 72371067) National Research Foundation, Singapore, and DSO National Laboratories under the AI Singapore Programme (AISG Award No: AISGA-GCC-203--08- 1B): by the National Re- search Foundation Singapore and the Cyber Security Ageney under the National Cybersecurity and by the Prime Minister's s Office. Singapore under the Campus for Research Excellence and Technological Enterprise (CREATE) Programme. Any opinions, findings and conclusions, or recommendations expressed in these materials are those of the author(s) and do not reflect the views of the National Research Foundation, Singapore, Cyber Security Agency of Singapore, Singapore.
R&D Programme
References
[1] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint 2331123033008774, 2023.
[2] Mistral AL
https://hugcinffaeeccc/miititttt
Mistral Nemo- Instruct 2407| 2024.
[3] Muhammad Arslan, Hussam Ghanem, Saba Munawar, and Christophe Cruz. A survey rag with Ilms. Procedia Computer Science, 246:3781-3790 2024.
[4] Omer Aydin, Enis Karaarslan, Fatih Safa Erenay, and Nebojsa Bacanin. Generative ai in academic writing: A comparison of deepscek, qwen, chatgpt, gemini, Ilama, mistral, and gemma. arXiv preprint arXiv:2503. 04765, 2025.
[5] Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, al. Qwen technical report. arXiv preprint arXiv:2309. /6609, 2023.
[6] Payal Bajaj. Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, et al. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv: 161 1.09268, 2016.
[7] Zhiyuan Chang, Mingyang Li, Xiaojun Jia, Junjie Wang, Yuekai Huang, Ziyou Jiang, Yang Liu, and Qing Wang. One shot dominance: Knowledge poisoning attack on retrieval-augmented generation systems. arXiv preprint 1cXiv:2505.1154: 2025.
[8] Jianly Chen, Shitao Xiao, Peitian Zhang, Kun Luo, Defu Lian, and Zheng Liu. Bge m3-embeeding: Multi-lingual, fulti-ifnnciionalityy grauulgranularity text embeddings through self-knowledge distillation. arXiv preprint 2402::2000.02//6 2024.
[9] Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming Ilm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:1 37:130185-330113 2024.
[10] Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. Trojanrag: Retrieval augmented generation can be backdoor driver in large language models. arXiv preprint arXiv:2405. 13401, 2024.
[11] Jacob Devlin, Ming-Wer Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidi- rectional transformers for language understanding. In Proceedings the 2019 conference the North American chapter of the association for computational linguistics; human language technologies, volume (long and short papers), pages 4171-4186, 2019.
[12] Ranjie Duan, Jiexi Liu, Xiaojun Jia, Shiji Zhao, Ruoxi Cheng, Fengxiang Wang, Cheng Wei, Yong Xie, Chang Liu, Defeng Li, et al. Oyster-i: Beyond refusal- construivvv safety alignment for responsible language models. arXiv preprini arXiv:2509.01909 2025.
[13] Abhimanyu Dubey, Abhinay Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The lama 3 herd of models. arXiv e-prints. pages arXiv-2444 2407, 2024.
11

---

[14] Xiang Fang. Wanlong Fang, Wei Ji, and Tat-Seng Chua. Turing patterns for multimedia: Reaction-diffusion multi-modal fusion for language-guided video moment retrieval. In ACM International Conference on Mullimedia, 2025.
[15] Xiang Fang, Wanlong Fang, and Changshuo Wang. Hierarchical semantic-angmented navigation: Optimal transport and graph-driver reasoning for vision- language navigation. In Advances in Neural Information Processing Systems, 2025.
[16] Tianyu Gao, Xingeheng Yao, and Danqi Chen. Simese: Simple contrastive learning of sentence embeddings. arXiv preprint arXiv:2104.0888 104.08821, 2021.
[17] Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you've 'v signed up for: Compromising real-world lIm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security, pages 79-90, 2023.
[18] Daya Guo, Dejian Yang. Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang. Xiao Bi, et al. Deepseek-rl: Incentivizing reasoning capability in Ilms via reinforvement learning. arXiv preprint 2..iv:25001129455 2025.
[19] Yihao Huang, Chong Wang, Xiaojun Jia, Qing Guo, Felix Jucfei-Xu, Jian Zhang, Geguang Pu, and Yang Liu. Semantic guideed prompt organization for universal goal hijacking against llms, arXiv e-prints, pages arXiv- 2005,240,222 2024.
[20]
Binyuan Hui, Jian Yang. Zeyu Cui, Jiaxi Yang, Dayiheng Liu, Lei Zhang, Tianyu Liu, Jiajun Zhang, Bowen Yu, Keming Lu, et al. Qwen2. 5-coder technical report. arXiv preprint arXiv:2409. 12186, 2024.
[21] Xiaojun Jia, Tianyu Pang, Chao Du, Yihao Huang, Jindong Gu, Yang Liu, Xiaochun Cao, and Min Lin. Improved techniques for optimization- jailbreaking on large language models. arXiv preprint m:Xiv:2405.2100 2024.
[22] Yang Jiao, Xiaodong Wang, and Kai Yang. Pr-attack: Coordinated prompt-rag attacks retrieval- augmented generation in large language models via bilevel optimization. arXiv preprint arXiv:2504.07717, 2025.
[23] Jaehyung Kim, Jachyun Nam, Sangwoo Mo. Jongjin Park, Sang-Woo Lee, Minjoon Seo, Jung- Jung-Woo Ha. and Jinwoo Shin. Sure: Summarizing retrievals using answer candidates for open-domain qa of llms. arXiv preprint arXiv:2404. 13081, 2024.
[24] Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. Natural questions: a benchmark for question answering research. Transactions of the Association for Compudational Linguistica, 7:453-466. 2019.
[25] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieval- -ugmeette generation for knowledge- intensive nlp tasks. Advances in neural information processing systems, 33:9459-9477 2020.
[26] Xuying Li. Zhuo Li. Yuji Kosuga, Yasuhiro Yoshida, and Victor Bian. Targeting the core: A simple and effective method to attack rag-based agents via direct Ilm manipulation. arXiv preprint 15X14:2412.04415, 2024.
[27] Quanyu Long, Yue Deng, LeiLei Gan, Wenya Wang, and Sinno Jialin Pan. Backdoor attacks on dense passage retrievers for disseminating misinformation. arXiv e-prints, pages arXiv-2402, 2024.
[28] Xinbei Ma, Yeyun Gong, Pengeheng He, Hai Zhao, and Nan Duan. Query rewriting in retrieval-augmente large language models. In Proceddings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 5303-5315, 2023.
[29] Ian R McKenzie, Oskar Hollinsworth, Tom Tseng, Xander Davies, Stephen Casper. Aaron D Tucker, Robert Kirk, and Adam Gleave. Stack: Adversarial attacks Ilm safeguard pipelines. arXiv preprint arXiv:2506.24065 2025.
[30] Shi Na, Liu Xumin, and Guan Yong. Research on k-means clustering algorithm: An improved k-means clustering algorithm. In 2010 Third International Symposium on intelligent information technology and security informatics, pages 63-67. Iece, 2010.
12

---

[31] Fatemeh Nazary, Yashar Deldjoo, and Tommaso di Noia. Poison-rag: Adversarial data poisoning attacks retrieval-augmeeted generation in recommender systems. In European Conference on Information Retrieval, pages 239-251. Springer, 2025.
[32] OpenAL. Chatgpt (gpt-5). https: // http://chaat..paa....o com/ 2025. Accessed: 2025-09-30.
[33] Pouya Pezeshkpour and Estevam Hruschka. Insight-rag: Enhancing Ilms with insight-driven augmentation. arXiv preprint arXiv:2504.0011: 00187, 2025.
[34] Hongjin Qian, Peitian Zhang, Zheng Liu, Kelong Mao, and Zhicheng Dou. Memorag: Moving towards next-gen rag via memory -ennorr-nnspired knowledge discovery. arXiv preprint arXiv:2409. 055991, 1. 2024.
[35] Ayush RoyChowdhury, Mulong Luo, Prateek Sahu, Sarbartha Banerjee, and Mohit Tiwari. Confusedpilot: Confused deputy risks in rag-based llms. arXiv preprint 048800 2024.
[36] Avital Shafran, Roei Schuster, and Vitaly Shmatikov. Machine against the rag: Jamming retrieval- augmented generation with blocker documents. arXiv preprint (tf1::20060087700 2024.
[37] Runqi Sui. Ctrirag: Black-hox adversarial attacks based on masked language models in retrieval- -augmented language generation. arXiv preprint arXiv:2503.0695 2025.
[38] Xue Tan, Hao Luan, Mingyu Luo, Xiaoyan Sun, Ping Chen, and Jun Dai. Knowlcdge databasc or poison basc? detecting rag poisoning attack through IIm activations. arXiv preprint 1..112241 2024.
[39] Fei Wang. Xingchen Wan, Ruoxi Sun, Jiefeng Chen, and Sercan Ô Ank. Astute rag: Overcoming imperfect retricval augmentation and knowledge conflicts for large language models. arXiv preprint arXiv:4410.07176, 2024.
[40] Jinyu Wang, Jingjing Fu, Rui Wang, Lei Song, and Jiang Bian. Pike-rag: specialized knowledge and rationale augmented generation. arXiv preprint arXiv:2501. 11551, 2025.
[41] Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. Minilm: Deep self-attention distillation for tank-sgi compression of pre-trained transformers. Advances in neural information processing systems, 33:5776-5777 -5788, 2020.
[42] Zhepei Wei, Wei-Lin Chen, and Yu Meng. Instructrag: Instructing retrieval-augmeenté generation with explicit denoising. arXiv e-prints, pages arXiv-2406, 2024.
[43] Shangyu Wu, Ying Xiong. Yufci Cui, Haolun Wu, Can Chen, Ye Yuan, Lianming Huang, Xue Liu, Tei- Wei Kuo, Nan Guan, et al. Retrieval- Retrieval-augmente augmented generation for natural language processing: A survey, arXiv preprint arXiv:2407. 13193, 2024.
[44] Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateck Mittal. Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405. 15556, 2024.
[45] Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. Badrag: Identifying vulner- abilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083 2024.
[46] Haoming Yang, Ke Ma, Xiaojun Jia, Yingfei Sun, Qianqian Xu, and Qingming Huang. Cannot see the forest for the trees: Invoking heuristics and biases elicit irrational choices 1lms, arXiv preprint arXiv:2505.02862 2025.
[47] Zhilin Yang, Peng Qi. Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhutdinov, and Christopher D Manning. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. arxiv preprint Xiv: I 1809.80999900 09600, 2018.
[48] Weichen Yu, Kai Hu, Tianyu Pang. Chao Du, Min Lin, and Matt Fredrikson. Infecting 1lm agents via generalizable adversarial attack. In Red Teaming GenAl: What Can We Leamn Adversaries?, 2025.
[49] Baolei Zhang, Yuxi Chen, Minghong Fang, Zhuqing Liu, Lihai Nie, Tong Li, and Zheli Liu. Practical poisoning attacks against retrieval-augmentee generation. arXiv preprint arXiv:2504.0395: 2025.
[50] Hanning Zhang, Juntong Song. Juno Zhu, Yuanhao Wu, Tong Zhang, and Cheng Niu. Rag-reward: Optimizing rag with reward modeling and rlhf. arXiv preprint arXiv:2501. 2025.
[51] Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Be- ichen Zhang, Junjie Zhang, Zican Dong, et al. A survey of large language models. arXiv preprint 182223300.. 1(2), 2023.
13

---

[52] Huaixiu Steven Zheng, Swaroop Mishra, Xinyun Chen, Heng-Tze Tze Cheng, Ed H Chi. Quoc V Le. and Denny Zhou. Take step back: Evoking reasoning via abstraction in large language models, arXiv preprint 17Xiv:2310.00117.222 2023.
[53] Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. arXiv preprint arXiv:2310.19156 2023.
[54] Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, Zhenhao Li, Zhaoyang Wang. Hamed Had- dadi, and Emine Yilmaz. Trustrag: Enhancing robustness and trustworthiness rag. arXiv preprint arXiv:2501.0087/ 2025.
[55] Wei Zou. Runpeng Geng, Binghui Wang, and Jinyuan Jia. Poisonedrag: Knowledge corruption attacks to retrieval-augmenteed generation of large language models. arXiv preprint wxXiv2240.00887, 2024.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: SeConRAG introduces a dual-filtringg framework to defend against corpus poisoning in lateevaa-uggmeetedd generation (RAG) systems, as clearly stated in both the abstract and introduction. The stated contributions are consistent with the work's 's scope, and no over-claims or unsupported generalizations are made. Therefore, the abstract and introduction accurately reflect the paper's contributions and findings.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes].
Justification:
In the conclusion section, we discussed the limitations of the proposed method.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
15

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [No]
Justification:
The formulas in the paper are simple to understand, and there is no theoretical
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
The paper provides detailed descriptions of all experimental settings, including datasets, model variants, poisoning rates, evaluation metrics, and hardware configurations. Key implementation details for SeConRAG, such as filtering modules and embedding choices, are explicitly described. This information is sufficient to reproduce the main results supporting the paper's claims.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often good way to accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, other means that appropriate to the research performed.
also be provided via detailed
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
16

---

(d)
The authors should provide scripts to reproduce all experimental results for the new reproducible, they We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: The code and data are not yet publicly released, but we plan to provide open access with full instructions upon acceptance
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
wublic//uiides/ooeSuuuun
wwt.ssswwwssssosssssoooooo onPolicy) for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips. ctajps.cc/puulic/guiiee guw.///ieee//eee/ Codeeubmii ssi ssionPolicy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Answer: [Yes]
The paper provides comprehensive experimental details, including dataset splits, poisoning ratios, evaluation metries, and backbone model configurations. Since the method is inference-basee no model training is required, and optimizer settings are not applicable. All key implementation and runtime details are included either in the main text or supplemental material to ensure clarity and reproducibility.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
17

---

We do not report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments.
Justification:
Guidelines:
The answer NA means that the paper does include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We introduce the details setup of experiment.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https:
Answer: [Yes]
Justification: This work complies with the NeurIPS Code of Ethics. It does not involve human subjects, personally identifiable information, or unauthorized data usage.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
18

---

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We have added "Impact Statement" paragraph at the end of the submitted manuscript to discuss the broader impacts.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deg.lymmlm of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA].
Justification:
We do not release the model or dataset.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We use the open-sourced dataset.
Guidelines:
19

---

The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: There is no new assets.
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details the dataset/code/mooel as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer:[NA]]
Justification:
The paper does not involve Research with Human Subjects.
20

---

Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality of the research, declaration is not required.
Answer:[Yes)
Justification: In this work, large language models (LLMs) employed in two ways. First, LLMs (e.g., GPT-based models) are integrated as functional components of our proposed framework, mainly for semantic understanding and entity-intent-rlltioon extraction. In addition, an L.MM was used to assist with language polishing and clarity improvement of the manuscript. The scientific content, experimental design, and analysis were entirely conducted by the authors.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to LLM policy httt::///earrrggeecc////o/eeeee/ for what should or should not be described.
21

---

A Appendix supplemental material
Impact Statement
ScCon-RAG" effectiveness is dependent on the quality its semantic parser (EIRE), which may perform poorly on domain-specini texts. The methods proposed in this paper will not have negative impact the community.
A.1 Prompt and Example
A.1.1 EIRE (Entity-Intent Relattoo Extractor)
We provide the prompt template used in our system extract the intent, key entities, and entity relations from a given documents.
Prompt for FIRE
Please extract both the key entities, intent and relations of entities of the documents, using the following criteria:
Extract specific entities (such as terms, names, data, and locations) that are explicitly mentioned in the document for later entity matching.
Key Entities:
Intent: Summarize the document's main points or conclusion in a single sentence. This should be free of external issues and only include the document's own claims.
Relation: Identify the most critical relationship between key entities in the document, keeping the length under the original document.
Output for example document extracted by EIRE
L'Oiseau Blane (commonly known in the English-speaking world as The White Bird) was French Levasseur PL.8 biplane that disappeared in 1927, during attempt to make the first non-stop transatlantic flight between Paris and New York City to compete for the Orteig Prize. The aircraft was flown by French World War I aviation heroes, Charles Nungesser and Fran00e7ois Coli. The aircraft took off from Paris on 8 May 1927 and was last seen over Ireland. Less than two weeks later, Charles Lindbergh successfully made the New York201 PParis journey and claimed the prize, flying the Spirit of St. Louis Output:
Input:
Intent:
"L'Diseau Blanc disappeared in 1927 while attempting the first non-stop transatlantic flight from Paris to New York to win the Orteig Prize."
Entities:
"L'Oiseau Blanc", "Levasseur PL.8", "1927", "Charles Nungesser", "Paris" "New York City", "Orteig Prize", "non-stop transatlantic flight", "Ireland", "Charles Lindbergh", "François Coli", "Spirit of St. Louis"
Relations:
["L'Oiseau Blanc", "Levasseur PL.8", "is_a"],
["L'Diseau Blanc", "1927", "disappeared_inn)
["L'Diseau Blanc", "non-stop transatlantic flight", "attempt"),
["L'Diseau Blanc", "Paris", "departed_from""
["L'Diseau Blanc", "New York City", "destination"),
["L' ["L'Diseau Blanc", "Charles Nungesser", "flown_by"],
["L'Diseau Blanc", "François Coli", "flown_by"J, ["L'Oiseau Blanc", "Ireland", "last_seen_over") ["Charles Lindbergh", "Orteig Prize", "won"),
["Charles Lindbergh", "Spirit of St. Louis", "flew"]
22

---

A.1.2 Semantic filtering
Prompt of Semantic graph for filtering
Evaluate if the following document contains deceptive malicious material that may impact the answer to the inquiry. Consider the presence of certain terms, their relationships, and any underlying meanings.
Use the graph generated using these semantic information and calculate its the structure's similarity between the correct document which is reference
reference documents:
"intent":""" "L Diseau Blanc French biplane that disappeared in 1927"
"keywords":
["L'Oisear Blanc", "Levasseur PL.8", "1927", "Charles Nungesser", "non-stop transatlantic flight", "Paris", "New York City", "Orteig Prize", "Spirit of St. Louis" "François Coli", "Ireland", "Charles Lindbergh"]
"relations":
[("L'Oiseau Blanc", "Levasseur PL.8", "is_a"),
("L'Oiseau Blanc", "1927", "disappeared_in""
("L'Oiseau Blanc", "non-stop transatlantic flight", "attempt"), ("L'Oiseau Blanc", "Paris", "departed_fron"
("L'Oiseau Blanc", "New York City", "destination"), ("L'Oiseau Blanc", "Charles Nungesser", "flown_by"), ("L'Oiseau Blanc", "François Coli", "flown_by"), ("L'Oiseau Blanc", "Ireland", faat_seen_overs ("Charles Lindbergh", "Orteig Prize", "won"), ("Charles Lindbergh", "Spirit of St. Louis", "flew")
Score and filter documents based on their similarities and subsequent evaluations. Give score between 0 and 10, where 0 indicates absolutely benign and 10 implies highly misleading or malevolent. The output must only show your score as an integer number.
Analysis Criteria:
Identify entity/Phrases: Identify entity or phrases that could misleading or indicate departure from reality.
Relationship to the Question: Analyze how these terms relate to the question and determine if they might affect the answer to the question.
Hidden Meanings or Implications: Consider if the document suggests fictional or inaccu- rate information without clear indication. Context: Consider how the document might be interpreted in the context of the question. Assess whether it could mislead someone seeking factual information.
Intent and Impact: Evaluate if the misleading information appears intentional and whether it could cause harm or spread misinformation.
Ambiguity and Clarity: Assess the document's clarity. Vague or misleading presentations can be more harmful.
Fiction vs. Reality: Determine if the document clearly distinguishes between hypothetical scenarios and reality.
Relevance to the Question: Evaluate if the misleading information directly impacts the question's answer.
Scoring Guidelines: 0-3: Likely benign. The document contains little to no misleading or harmful information related to the question. 4-6: Potentially misleading. The document contains some elements that may confuse mislead, but they are not the primary focus or are clearly indicated as hypothetical or fictional. 7-10: Likely malicious or mislcading. The document actively presents information that could mislead, deceive, significantly impact the answer to the question. Considerations for Scoring: Final Score: Provide your score based on the above analysis, Provide your number only.
integer
23

---

The distribution of the semantic graphs produced from semantic information in vector space is depicted in the image below. We utilize PCA reduce the vector's dimension to dimensions and demonstrate it. Figure 5 6 visualize semantic graphs generated by EIRE for correct and poisoned
documents under the query: "Which French ace pilot and adventurer flew O'sisauu Blanc?".
We employ the prompt of Semantic graph for filtering 1.1.2 to direct the Ilms in evaluating, scoring and filtering documents based semantic information and correspoding graphs
Correct Document
Ori Prine
L'Owet Blane
Ston by foom by
gesser
Spirk
Lowan edn
detination
Cha tps L Sobargghh
Ind
Entity Correct Answer
Incorrect Answer Relition Label
Figure 5: schematic graph of the correct document's semantic structure in two dimensions. Blue indicates the correct response, orange nodes stand for entities, and the edges connecting nodes show the connections between entities.
Example for correct document
Input:
"Can't Help Falling in Love\" is a pop ballad originally recorded by American singer Elvis Presley and published by Gladys Music, Presley's publishing company. It was written by Hugo Peretti, Luigi Creatore, and George David Weiss. [2] The melody based on \"Plaisir d' a'mouur(", [4] a popular romance by
Martini (1784) The song was featured
Presley's 1961 film, Blue Hawaii. During the following four decades,
it was recorded by numerous other artists, including Tom Smothers, Swedish pop group A-Teens, and the British reggae group UB40, whose 1993 version topped the U.S. and UK charts."
Output:
Semantic Content: Factually accurate, false claims.
Graph Similarity: Completely unrelated (topic is music, not aviation). Misleading Risk: Low although off-topic, it doesn't mislead facts.
Final Score: 2
24

---

Incorrect Document
adventurer
demonstrated
Diknnan Blanc
Trench aee pilot
George ynveeer
Entity Correct Answer
Incorrect Answer
Relation Label
Figure 6: A schematic graph of the incorrect document's semantic structure in dimensions. Red indicates the poisoning response, orange nodes stand for entities, and the edges connecting nodes show the connections between entities.
Example for correct document
Input:
"Frank Sinatra, the iconic crooner, recorded an unforgettable rendition of the song \"I Can't Help Falling Love With You\", enrapturing audiences with his soulful interpretation."
Output:
Semantic Content: Highly confident and emotional false claim.
Graph Similarity: No overlap with reference. Misleading High persuasive wording increases belief in a falsehood.
Final Score: 8
A.2 Conffict-Aware Filtering
In the final inference process, we prompt the L.MSs determine which information from the retrieve documents is reliable from three dimensions using the semantic information extracted by EIRE.
25

---

Output for example document extracted by FIRE
You must evaluate the document information you retrieve, which includes internal knowledge, external knowledge, and query.
To answer this question, consider intent, key entities, and relationships to determine which knowledge provides the best, most accurate, and error-free support.
The external information may not be reliable. Use combination intent and key entities from external information. as well as the intent of the original question, to make self- judgments about the reliability external information. Then, based on both your assessment and your personal knowledge, provide the best possible answer.
Incorrect Document
adventuro oputation
Gert memmer
Franc plot
Fetily Correct Answer
Incorrect Answer Relation Label
Figure 7: A schematic graph of the incorrect document's 's semantic structure in two dimensions. Red indicates the poisoning response, orange nodes stand for entities, and the edges connecting nodes show the connections between entities.
A.3 Pseudocode of SeCon-RAG
Provide formally written pseudocode (see Algorithm T for the full SeCon-RAG pipeline, including SCF and CAF. This helps clarify the implementation logic for reproducibility.
A.4
Experiments
A.4.1
Experiments of Different Poisoning Ratio
HotporQA Table 3 compares SeConRAG's
performance four baseline methods (VanillaRAG, In- structRAG, ASTUTERAG, and TrustRAG) across five backbone LLMs on the HotpotQA dataset with varying corpus poisoning ratios (0% to 100%). Across all models and poisoning levels, SeConRAG consistently achieves or approaches the highest accuracy while maintaining low attack success rates (ASR), demonstrating strong robustness and generalizability. Notably, On Mistral- 12B SeConRAC achieves 75.7% accuracy with only 3.6% ASR under 100% poisoning, outperforming TrustRAG and significantly surpassing ASTUTERAC AG and InstructRAG. On GPT-4o, SeConRAG achieves the highest accuracy (83.6%) and lowest ASR (2.4%) under full poisoning, indicating its effectiveness
26

---

Algorithm SeCon-RAG: Two-Stage Semantic Filtering and Conflict-Aware Generation
Require: Query q, Retrieval corpus D, Verified clean documents Door. Pretrained LLM of RAG
Ensure: Trustworthy answer A(q)
Stage 1: Semantic and Cluster-Based Filtering (SCF)
Embed each document d D into vector m())
2: Apply K-Means clustering to obtain clusters C = :cI,...,ck]
3: for all d E D do
4: Compute similarity to cluster centroid: Scluster (d) t- sim(m(d), Me)
5: Extract semantic structure (Ed, Id, Ru) : < EIRE(d)
6: Construct semantic graph Ga from (Ea, la, Ray)
7: Compute semantic similarity score 8sem (d) + LLM(Ga; Gcor)
8: end for
9: Filter documents where Scluster (d) > Teluster and soo (d) < Tsem
10: Define filtered corpus D +- D Dittered
Stage Conflict-Aware Filtering (CAF)
Retrieve top-k documents (g) from D based on embedding similarity
12: for all d E (x) do
Extract semantic structure (Fa, Ja, Ra) < FIRE(d)
14:
Evaluate:
Query consistency Q(d,g)
Corpus consistency (d, (q))
Model consistency (d,, F)
15:
if CAF(d, Q, C.M) trustable then
16:
Add d to DCAF
17:
end if
18:
end for
19:
Generate final answer: A(g) + Fgg, DCAF)
return A(q)
even with strong LLMs.On smaller models such as Qwen-7B and LLaMA-3.1-2 1--BB SeConRAG maintains competitive performance, outperforming all baselines under medium and low poisoning. demonstrating its scalability across model sizes. Under clean settings (0% poisoning). SeConRAG performs well and achieves high accuracy, indicating that the two-stage filtering does not overly suppress useful content.
Natural Questions (NQ) Table compares SeConRAG's performance to baseline methods across five language models the Natural Questions (NQ) benchmark, with six poisoning levels ranging from 0% (clean) to 100% Through all LLMS and poisoning levels, SeConRAG consistently outperforms baseline methods in terms of answer accuracy and attack robustness. On Mistral-12B, SeConRAG outperforms TrustRAG and ASTUTERAG in both metrics, achieving up to 82.0% accuracy on clean data and maintaining high performance under attack (74.5% 20% poisoning with only 10.2% ASR). Even with smaller model, SeConRAG shows significant improvement. It achieves 78.0% accuracy on clean data and more robust 100% poisoning (66.4% / 2.4%) than TrustRAG (60.0%
2.7%% and ASTUTERAG (42.3% / 53.2%). SeConRAG achieves 90.0% accuracy on clean data and 90.0% under 60% poisoning with 0.0% ASR, outperforming baselines almost every poisoning level on LLaMA-3. 10MMA-3.18BB 1-8B. On GPT-4o or DeepSeek-R1. SeConRAG outperforms at low-to-medium poisoning levels while maintaining low ASR across all ratios. SeConRAG outperforms TrustRAG and ASTUTERAG by achieving 100.0% accuracy with 0.0% ASR at 40% poisoning and over 96% accuracy with 0.0% ASR under full (100%) poisoning. These findings demonstrate SeConRAG's ability maintain high factual accuracy while resisting poisoning attacks. Its consistent performance both clean and adversarial environments demonstrates the effectiveness of the two-stage SCF and CAF filtering mechanisms.
MS-MARCO Table 5 compares the performance of SeConRAG and baseline RAG defense meth- ods on the MS-MARCO dataset different corpus poisoning ratios (0% 100%). SeConRAG consistently delivers the best near-best performance in all settings. Mistral- 12B: SeConRAG
27

---

Table 3: Performance comparison of SeConRAG and baseline methods HotpotQA using different Poisoning RAG ratios (highest accuracy 1 or lowest ASR J).
HotpotQA 47
Model
Method
100%
80%
60% (ACC1 /ASR))
40%
20%
0%
(ASR))
(ACCT/ASRL)
(ACC1/ASRJ)
(ACC1 /SS.)
(ACCT)
VanillaAAs
0.9/9822
9.10
118/864 M6.4
21.8/24.5
36.2
75.0
InstrcctAAG 12
13.6/83.5
23.6/7188
25.5/70.0
37.3
45.5 19.1
75.0
Mistral1288
ASTUTERAG
32.7/61.1
47.3/
55.5/35.5
TrasRAG
54
75.5
74.5
78./445
74.36644
7L8/145
$1.0
ScomnAGGouus)
73.6
7,.3/4.5
75.5
7L8/8.2
72.74.5
83.0
VanillaRAG
1889882
9.1/90.0
14.5 85.5
23.6/75.5
32.7/68.5
67.0
InstruciRAGi
24.5
10.91699.1
31.81
35.5/63.6
45.//518
67.0
Qwen-78
ASTL/EERAG 39
48.5/44.1
24.5/43.
46.4/44.7
50.7 35.5
38.6 25.4
65.0
TraiRAG [:
56.2/2.7
64.514.5
69.1
63.5/336
$8.2 26.4
73.0
ScconRAGGounng
6..6/2.3
6..3/118
3.66/
VanillaRAG
4.5/
25.5/
30.0 68.2
62.7/63.6
36.4
70.0
InstmectRAG AG 42
27.3/713
42.7 1.54.5
51.8 46.4
49.1/48.2
47.3/50.
76.9
1LMMA-31-8B
ASTUTERAG
46.8
$2.7
53.6 38.2
62.7/29.1
65.5 20.9
68.0
TraitAAG
67.3/3.0
718/55
19.1
72.0
(cconR)G
72.0/ 10.9
7..2
75.5 3.6
77.3/18
67.4 18.4
84.0
VanilkRAG
11,9/888
32.7 22.7157.3
46.1 50.0
43.2/443.6
15.5 30.5
$1.0
InstructRAG
27.3/71.8
GPT-4o
ASTUTERAG
67.3/24.1
73.6 15.5
77.3 12.7
78.2/10.0 10.0
77.37 11.8
$1.0
TrastR AG [4
80.9
3.66/366
8
81.6/36
79.1 664
85.0
SeconRAGlouss)
83.6/2.4
82.714.5
83.6/4.5
83.6 1.8
79.1
$6.0
VanillaRAG
31.8
35.5
55.
46.4
81.0
InstructRAG 12
22.7
48.2/518
4
56.4/42.7
688/38.2
80.0
DeepSeckRR S
ASTUTERAG
39
65.5
66,4/24.5
72.7 18.2
17.3/17.3
77.3 14.5
79.0
ArasRRAG
(ecenRAG
8.8/330
8..6/3.6
8..
82.7
83.6/5.5
36.0
Table 4: Performance comparison of SeConRAG and baseline methods on NQ using different Poisoning RAG ratios (highest accuracy lowest ASR 4).
Model
Method
100% (ACC ASRJ)
80%
60%
40% (ACC1/ ASRL)
20% (ACC1/ ASR.)
0%
(ACC1/ ASRJ)
(ACC) / ASR.)
(ACC1)
80.9/87.3
InstrueiR
42
13.6 82.7
17.3/78.2
26.47 70.0
38.2/ 56.4
51.87 40.0
66.0
Misral-128
ASTUTERAG
39
43.67 38.2
$0.9
$3.61 28.2
60.01 20.0
63.71 11.8
70.0
SeconRACt(ours)
63.6/2.5
66.4
67.3
74.5 10.2
VanillRAAG
5.5/93.6
10.0/
14.5 /
69.
39.1/518
56.0
InstmecR
4
25.5/76.4
33.6.165.
33.6 65.5
34.5/62.7
47.3
64.0
@wen-7B
Truii AG:
54
6..
64.5
62.71 3.6
65.5/227
64.5/245
67.0
ScconRAG(ouss)
6..4/2.4
70.0 4.5
67.31
68.2 3.6
70.9 21.8
78.1
VanillRAG
InstructRAAG
4g
32.7/67.3
44.5
53.6/
44.1
56.4/44.5
70.0
LLaMA-1.1-BB
[8
ASTUTERAG
39
58.2/3188
/0.5
64.5
70.0 18.2
77.5/8.2
$1.0
TraIRAG
54
79.1 /0.0
83.67 2.7
8.75/2.7
83.6/1.8
79.1 10.9
$4.0
SeconRAG(ouss)
VanilaRAG
27.3 68.2
/
4 /99.1
50.0 36.4
$2.7/3188
74.0
InstructAAG 1
43.6/51.1
$1.8 4-0.9
53.6/
/9.1/
66.4 25.5
74,0
ASTUTERAG
TraiRAG
50.0/0.1
8L.8
82.7 0.99
82.7
$18//L L.0
35.0
ScconRAGrous))
818/ 0.0
BL.8 0.9
83.6 0.9
85.5 0.0
84.5
$8.0
VanillaRAG
17.3 84.5
/
34.5 64.5
43.67 54.5
$1. $1.01 43.6
80.0
InstrucRRAG
39,1 62.7
50.9 (18.148822
12.7/47.3
$7.3/41.8
6/.5/
82.0
DeepSeck-R1
1k
ASTUTERAG 30
81.8 10.9
80.9 11.8
W7.3/7.3
/5.5
89.1 0.0
87.0
TraiRAG 51
88.2/ 0.0
90.0/
89.1 10.1/00.0 0.0
90.0 0.0
9..0/3.66
91.0
ScconRAG(vurn)
96.4/0.0
outperforms ASTUTERAG and InstructRAG, achieving 91.8% accuracy with 0.0% ASR under 60% poisoning and 98.0 38.0% accuracy in clean settings. Qwen-7B: Despite being smaller model, SeConRAG achieves 84.0% accuracy in the clean setting and maintains low ASR (e.g., 4.5% at 100% poisoning), outperforming TrustRAG by significant margin. LaMA-3.1 1------.1--BB- SeConRAG achieves 90.0% accuracy in the clean setting and demonstrates strong robustness even under high poisoning (e.g., 89. 1 0.0% 100%). GPT-4o: SeConRAG matches or slightly outperforms TrustRAG for all poisoning levels. It achieves 94.0% accuracy clean data and maintains 89.1% accuracy with only 1.8% ASR under 100% poisoning. DeepSeek-R1: SeConRAG outperforms other tested methods in terms of robustness. It achieves 94.5% accuracy with 0.0% ASR under 60% poisoning
28

---

and maintains strong performance even at 100% poisoning (94.5%/1.8%) outperforming TrustRAG (89.1%/3.6%). These findings confirm that SeConRAG is not only effective resisting large-scale corpus poisoning attacks, but it also excels at maintaining answer quality in both adversarial and clean environments.
Table 5: Performance comparison of SeConRAG and baseline methods on MS using different Poisoning RAG ratios (highest accuracy 1 or lowest ASR J).
Model
Method
MS-MARCO 6
100%
80% (ACCT/
60% (ACCT/ASRL)
40%
20% (ACC1 ASR.)
0%
(ASR))
(ACC1/ASRJ)
(ACCT)
VanillaRGG
9.1/
18.5/818
79.1
34.5/60.0
50.0/45.
84.0
InstrucRRAG 4
15.5
17.3/77.3
24.57 70.0
35.5/57.3
57.3/36 36.4
81.0
Mistal-128
ASTUTERAG
52.7
13.6/58.2
46.4/45.5
61.87 30.0
18.8
81.0
TraiRAG
91.8/00
8188
86.4 1-4.5
$6.4
87.3/118
35.0
ScconRAGiouung)
88.2
91.8/1 1.8
91.8000
90
89.1/9.1
98.0
VanilleRAG
87.3
13.6/84.5
22.7/75.5
69.2/69.1
43.6 46.4
75.0
InstricR
47.67
19.1
49.12
49.1/45.5
75.0
Qwen-7B
ASTUTERAG 39
42.31 54.5
43.6/51.8
49.1 4-2.7
60.91 26.4
65.5/
74.0
ThaiR
14
61.5/1188
65.5/145
66.47 10.0
67.31 11.8
66.4/22.7
78.01
SeconRAGGours)
71.8//4.5
7..8/6.4
75./6.4
17.5
84,0
VanillaRAG
98,2
20.0/77.3
28.2 66.1
36.1/60.0
$4.5 10.9
$3.0
InstructR 42
51.8
45.57
$2.61 42.7
63.7
22.3
$1.0
LLMMA-3.1-BB
ASTUTERAG
38.6
63.6
63.67 26.4
73.6/218
82.3/ L3.6
89,0
ThasRAGG
84.5
SeconRAG(our))
89.1/0.0
89.1
85.3
87.3/ 3.6
86.2/9.1
90.0
YanilaRAG
30,01
46,4 44.4
56.47 34,5
59.1 25.5
72.3/ 16.
$4.0
GPT-4o
ASTUTERAG
76:11
78.2
80.0/ 6-1
80./
82.7/6.4
36.0
TrasRAAG 5q
8
90.9 1.8
8 3.6
$8.2 3.6
8
$8.0
ScconRAGlous)
89.1/18
90,9/
90.0 1.8
89.1 1.8
8
94,0
VanillaRAG
39.1
50.9/4277
InstrucRAGG 1
51,8
$4.5 1-445
37.3
67.3/
72.7 26.4
$7.0
DeepSeck-R1
K
ASTUTHRAG
39
85.5
80.9/153
80.9 10.0
87.3/7.3
89.1
88.0
TrasRAGG
ScconRAGiours)
94.5/
94.5/
94.5 0.0
96,4/00 0.0
94.5/5.5
94,0
A.4.2 Impact of SCF Subcomponents
To demostrate the necessity of combining two filtering processes, evaluating each subcomponent independently. As shown in while each module provides moderate improvements its own, when combined, they result in significantly increased robustness (for example, 0% ASR in several settings). These results confirm that the combination of clustering and semantic filtering is complementary. yielding the strongest robustness overall.
Table 6: Ablation of SCF components on Mistral- 12B
Setting
HotpoQQA + HASRL
MS-MARCO (
ACC MASKL
ACCHASKI
ACCHASRL
ACCHASKI
ACCNASRI
ACCHASK
ACC
ACC1ASK
mistsl-125
75/9 24/11
65/3
85/7
mistal-125
Semantic unly
75/4
60/2
64/3
86.55
86/8
miwwl--33 126
Both
77.5/03
75.7/36
72.7/45
63.6/25
74.5/10.2
91,870
/9.1
A.4.3 Impact of of EIRE Module
To better understand the standalone contribution of the proposed Entity- Entity-nneet-Relattoo Extractor (EIRE) to SeCon-RAG's overall robustness, We specifically compare SeCon-RAG's performance with and without EIRE under various poisoning scenarios and three datasets, with Mistral- serving as the backbone model. The results are summarized Table 77] With EIRE enabled, the model consistently achieves higher factual accuracy while significantly lowering the ASR, particularly under high poisoning conditions. For example, on MS-MARCO dataset under 100% poisoning attack, enabling EIRE reduces ASR from 5% to 0% while increasing accuracy from 85% to 88.2%. These show that EIRE critical for enabling fine- mraiggai semantic reasoning which increases the accuracy of the final answer generation process.
29

---

Table 7: Ablation of the EIRE module Mistral-12B across three datasets and poisoning scenarios.
Model
Setting
PIA ACCT/ASR
HorpotQA di
100% ACCHVSRI
2016 ACCTASRI
PIA ACCHASRI
100A ADCTASRI
NQ 22
20% ACCHASRI
PIA AACH
MS-MARCO 6
1004
205 ACCH/SSI
ACCHASRI
mistral-12b
Wilhout EIRE
76/5
75/4
73/13
69/3
6314
72/16
N7/5
8515
83/11
mistall 126
Was EIRE
77.5/0.
75.7/36
72.74455
72.3/13
63.6/255
10.5/1022
91.570
88.200
89.1/9.1
A.4.4 Impact of the Verified Correct Document Set
To evaluate the effectiveness the efficacy of deors we conduct an ablation study without deor and measure the performance drop across three datasets under three poisoning scenarios, with Mistral- 12B serving the baseline. As shown in Table 8 removing D consistently reduces accuracy while increasing the attack success rate, particularly in high-poisoning settings. For example, on MS-MARCO with 100% poisoning, enabling D reduces ASR from 5% 0% while increasing accuracy from 85% to 88.2%. These results demonstrate that even a small, high-quality deor set can significantly improve semantic filtering performance and reduce noise from poisoned documents.
Table 8: Ablation of the verified correct document dear.
Model
Setting
PLA ACCT/ASLI
HelporQA 47
100TS ACCHASRI
20%5 ACCIASR
PLA ACCT/SSII
NQ 34 1005S ACCHASKI
20% ACCTASRI
PIA ACCIASR]
MI-MARCO 6
100%
20%
ACCHASK.
ACCTASRI
mistal-12) 12h
Without dl...
76.7 10 7..5/0.8
80/6 75.7/36
73/13 72.7445
7216 72
63/3
71/ 10 74.5 10.2
8579
81/6
8578
mistal-12h
Wilh
636/25
91.8/0
86.200
89.1
A.4.5 Sensitivity Analysis of Filtering Thresholds
To assess the robustness of SeCon-RAM in relation its key hyperparameters, perform sensitivity analysis on the two primary filtering thresholds: Teluster: the similarity threshold used in clustering- based filtering. T the semantic similarity threshold used in EIREE-based semantic graph filtering. We vary each threshold across a reasonable range (Feluster E [0.86, 0.90). Tsemantic E [0.2, 0.4) and evaluate SeCon-RAG's performance under three poisoning intensities on two representative models (LLaMA-3.1-8D and GPT-4o) and three datasets.
Table 9: Sensitivity analysis of Teluster on LLaMA-3.1-8DD and GPT-4o under different poisoning intensities.
Mode
PIA ACCHASS]
Holpot(A 477
100% ACCH/ASR
20% ACCHASRI
PIA ACCVASRR
NO 24
100FS
20%
PLN ACC-ASRR
MS-MARCO 6
100%
20%
ACC1/AS]]
ACCHASRI
ACCH/SRI
ACC1/ASR)
LLMMA 5.1---
0.36
72/4
68/4
72/4
67/19
83/2
7914
56/12
83/6
8574
LLMM 3.1 3B
0.90
72/4
6913
74/4
65 65/119
83/2
8074
56/2
$4/6
8574
GPT-4a
0.36
80/3
81/2
$1/3
82/66
82/1
81/1
$3/1
$1/33
9073
GPT-40
0.90
81
81/3
$474
81/9
82/2
83/1
$4/2
83/1
8574
Table 10: Sensitivity analysis of Tsemantic LLaMA-3.1-8B and GPT-4o under different poisoning intensities.
Model
HolpotQA 100%
244 1001S
201 ACCMASR.
MS-MARCO 20%
100%
ACCH/ASIL
ACCTAASI
ACC1/ASRI
ACCHASRI
ACCHASRJ
ACC"VASR
ACC1/ASRI
ACC1/SRI
HLMA- 1-88
0.2
68.7
6715
7674
66/
82/2
50/4
86/2
83.7
8674
HLMA- 1-88
0.4
68.77
70/3
7414
667
82/72
8074
85/2
83.7
89/6
GPT-4o 0.2
81/3
8473
84/77
81/2
83//2
82.11
$4/1
89/4
GPT-0 0.4
30/4
82/3
8374
82/99
81/1
83//2
82.11
83/1
89/2
Tables and 10 show that ScCon-RAG' performance remains stable even when both thresholds are changed slightly. This is primarily due to the conservative AND-logic used in the joint filtering mechanism, which ensures that only documents flagged by both filters are excluded. These findings show that our framework is not overly sensitive to precise threshold tuning, which makes it easier to use practice.
30


Reviews:
[{"review_id": "GrGa3SH00e", "reviewer": "Reviewer_Djzt", "summary": "The main objective of this paper is to identify and remove harmful documents from the knowledge base, thereby improving the reliability of the RAG system's output. First, this paper develops an EIRE method to identify the intent, entities, and relations in each document. Then, this papercombines clustering method with the EIRE method to eliminate harmful documents from the repository. Finally, after retrieval based on the filtered repository, this work further refines the retrieved documents using the EIRE method to ensure that only those documents that are both relevant to the query and factually consistent are retained as augmentations.", "questions": "1. In line 168 of the paper, it is mentioned that \"Due to the semantic similarity of malicious documents, they cluster in embedding space.\" What is the basis or evidence supporting this claim?\n2. Similarly, in line 188, it is stated that \"poisoning documents generate sparse or fragmented graphs.\" While this is illustrated in Figure 2, what is the underlying reasoning behind this phenomenon?\n3. In line 194 of the paper, it is mentioned that the similarity between the graph of a candidate document and some verified correct documents is used to evaluate the candidate document. Is the effectiveness of this operation supported by experiments?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths \n1. This work focuses on the task of removing corpus poisoning, which is highly important for improving the reliability of RAG systems.\n2. This work employs a new approach, using EIRE to analyze and statistically evaluate documents at the semantic level to identify harmful ones.\n3. The experiments in this work cover multiple large models and diverse datasets, with the results demonstrating the overall effectiveness of the proposed method.\nWeaknesses\n1. The explanation of the principles behind some key steps in this work's methodology is unclear, making it somewhat difficult to understand why this method is effective.\n2. There is a lack of some key analysis experiments. For example, the paper mentions that SCF includes two filtering processes but does not employ experiments to explain why both must be used together.\n3. The proposed method in this work introduces higher inference latency, which somewhat limits its practical applicability.", "was_revised": true, "final_justification": "I have thoroughly reviewed the authors' rebuttal and appreciate their comprehensive responses to my initial concerns, which strengthen the empirical foundation of their methodology. While these clarifications partially address the weaknesses noted, fundamental concerns regarding the inherent latency trade-offs (W3) and the explanatory depth of core mechanisms (W1, Q1-Q2) persist. Consequently, I will maintain the rating of Borderline Accept.", "rebuttal": "We sincerely thank the reviewer for the thoughtful and constructive comments.  We address the remarks in Weaknesses (W) and Questions (Q) below.\n\n---\n\n**W1. The explanation of the principles behind some key steps in this work's methodology is unclear, making it somewhat difficult to understand why this method is effective.**\n\n---\n\nThank you for this feedback. We clarify that the success of our strategy is derived from a two-stage semantic filtering framework: (1) To conservatively filter poisoned documents, SCF use both clustering and semantic graph matching (via output from our EIRE module); (2) CAF further filters retrieved content by ensuring semantic coherence between the query, retrieved documents, and the model’s internal knowledge. This layered design ensures robustness while minimizing information loss.  We have offered clarifications and examples in the appendix to assist the reader in understanding.\n\n---\n\n**W2. Lack of ablation for the necessity of combining both SCF components**\n\nThank you for this feedback. We agree that a more explicit evaluation of SCF's two subcomponents—the clustering-based and semantic graph-based filtering modules—is beneficial. While Figure 4 in Section 5.5 already shows an ablation study comparing SCF and CAF as a whole, it does not separate the contributions of the two SCF submodules.\nTo address this, we carried out additional experiments, evaluating each subcomponent independently. The findings are summarized in the table below.\n\n|    Module   |      PIA   |      100%  |     20%     | PIA      |      100% |  20%     |    PIA   |     100%  |   20%    |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|   Clustering only    |   78 / 5    |  81 / 2     |  78 / 9     |   \t68 / 3    |    65 /3\t   |    70 / 10   |    \t85 / 7\t\t   | \t82 / 7\t     |     \t82 / 12  |\n|   Semantic only  |    79 / 4   |   80 / 2    |   74 / 11\t    |   \t69 / 2    |   64 / 3    |  73 / 8     |   86 /5    |  82 / 6\t |   86  /8   | \n|   Both (SCF)  |    77.5 / 0.8   |   75.7 / 3.6    |   72.7 / 4.5|   \t72.3 / 1.8    |   63.6 / 2.5    |  74.5 / 10.2     |   91.8 / 0    |  88.2 / 0\t |   89.1 / 9.1    | \n\nPreliminary results show that combining both filters provides the best overall balance of clean accuracy and attack suppression. Specifically, while each module provides moderate improvements on its own, their combination results in significantly increased robustness (e.g., 0% ASR in several settings) with minimal effect on clean performance. This demonstrates the complementary nature of clustering and semantic-based filtering. These ablation results will be included in the revised appendix to support the empirical design choices underlying SCF.\n\n---\n\n**W3. Inference latency may limit real-world applicability**\n\nThank you for the feedback. We acknowledge that SeCon-RAG uses LLMs in several components (EIRE, semantic similarity scoring, and CAF's final judgment), resulting in a moderate runtime overhead. The need for deeper semantic understanding that conventional symbolic or sparse methods cannot offer drove our design decision to use LLMs for semantic structure extraction and graph similarity. We do agree, though, that this adds overhead. Also, we notice the following:\n\n- As shown in Section 5.4 and Figure 3, the additional runtime introduced by SeCon-RAG remains within a reasonable range (<1.5 minutes per batch). One query only requires an acceptable cost, which we believe is acceptable for many real-world applications that require robustness.\n\n- We also showed in Section 5.3 (Table 2) that SeCon-RAG performs well across various lightweight embedding models (e.g., MiniLM, SimCSE), indicating that the framework is adaptable to lower-cost alternatives. For future work, we are looking into more lightweight techniques to replace EIRE, reducing the reliance on full-scale LLM inference at runtime. We will clarify these points more explicitly in the revised version, as well as include additional discussion of scalability trade-offs in deployment scenarios.\n\n---\n\n**Q1. Basis for the claim: \"malicious documents cluster in embedding space\" (line 168)**\n\nThank you for the feedback. This insight is based on empirical observations that adversarially generated poisoning documents frequently use highly similar phrasing or templated structures, particularly when targeting the same query. Due to their similarities, they form tight clusters in the embedding space. This phenomena has previously been examined in past work, like as the paper \"TrustRAG\" which mentioned a similar viewpoint.\n\n---\n\n**Q2. Reasoning behind: \"poisoning documents generate sparse or fragmented graphs\" (line 188)**\n\nThank you for the feedback. This phenomenon arises for two reasons.\n- On the one hand, it is owing to the attack mechanism described in the paper, \"poisoning RAG\" settings, which require a lower cost to attack.\n- Poisonous content, on the other hand, frequently introduces isolated or deceptive claims that are not adequately supported by the surrounding semantic context. When EIRE extracts entities and their relationships from such documents, the resulting semantic graphs frequently include abrupt or unnatural relationships, as well as isolated nodes or disconnected subgraphs. This behavior differs from clean documents, which have well-structured, coherent semantic graphs. We demonstrate this qualitatively (Figure 2) and quantitatively (semantic similarity scores). \n\nWe will elaborate on this reasoning and provide additional examples in the appendix.\n\n---\n\n**Q3. Is there experimental support for semantic graph similarity filtering? (line 194)**\n\nThank you for the feedback. To assess the impact of  \"candidate document and verified correct documents\" (D_cor) , we conducted ablation experiments that compared performance with and without this Dcor subset. As shown in the table below (with and without cor), enabling Dcor (\"Y\") consistently improves  accuracy or reduces ASR across PIA and different poisoning intensities (100%, 20%) on three datasets (Hotpot 、NQ、MS) .\n﻿\n| W/O Dcor | PIA | 100%  | 20% | PIA | 100% |  20% |PIA | 100%  |20% |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| N  | 76 / 10 | 80 / 6  |  73 / 12 | 72  / 6 |63 / 3| 73 / 10 | 85 / 9| 82 / 6 |  85 / 8  |  \n| Y | 77.5 / 0.8 | 75.7 / 3.6  |72.7 / 4.5 |72.3 / 1.8 | 63.6 / 2.5  |74.5 / 10.2 |91.8 / 0 | 88.2 / 0 |89.1 / 9.1 | \n﻿\n\nWe will include representative examples in the appendix and investigate the effects of including or excluding this candidate set on the experimental results."}, {"review_id": "IpAPQXdHwL", "reviewer": "Reviewer_N6z7", "summary": "This paper presents SeCon-RAG, a two-stage framework to make Retrieval-Augmented Generation (RAG) systems more trustworthy and resistant to data poisoning attacks. Existing defenses can often remove useful information or fail to resolve knowledge conflicts. SeCon-RAG tackles this with two core modules: 1) Semantic and Cluster-Based Filtering (SCF): This module uses clustering and an Entity-Intent-Relation Extractor (EIRE) to perform fine-grained filtering, removing poisoned documents while preserving valuable ones. 2) This module uses EIRE to analyze semantic consistency between the query, retrieved documents, and the model's internal knowledge, filtering out contradictions before generating an answer. The contributions include introducing structured semantic analysis to RAG defense via EIRE and the proposed framework itself. Experiments show SeCon-RAG outperforms baseline methods in accuracy and attack resistance across various LLMs and datasets.", "questions": "- In line 168 \"Due to the semantic similarity of malicious documents, they cluster in embedding space\". This statement is too strong without any supporting evidence. I can imagine different attacking approaches would change this statement easily\n- In line 184 \"Correct documents produce densely connected semantic graphs with high coherence, whereas poisoned documents have sparse or fragmented structures.\" Again, one can simple flip an edge or rename an entity in Figure 2 (a) to produce a poisoned document, so this claim does not hold as well.\n- In line 192, where do these verified documents come from?\n- In equation (5), graphs are inputs to the LLM. However, in line 178-181, the graph node v is defined as \"projection of embedding vector\". Does that mean numerical vectors are sent to LLM as inputs? This does not make sense to me. In addition to that, how does the projection computed is not clear at all.", "limitations": "Yes, in the conclusion section.", "rating": 3, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n- Trustworthy RAG against malicious attacks is an interesting and important topic\n- Results are shown on multiple LLMs of different categories and sizes\n\nWeakness (please see questions for more details):\n- The methodology is relatively heuristic, lacking motivations in design choices\n- Technical details are not clear enough\n- Complexity analysis. It is appreciated that Figure 3 shows an empirical comparison under a specific initiation of hyperparameters of the proposed approach. However it is better to include a formal complexity analysis in the paper, for example, in terms of number of total documents, retrieved documents, average document token length, etc.\n- The method heavily relies on prompt engineering in most components, therefore ultimate limited by the inherent capability of LLMs used.", "was_revised": true, "final_justification": "Although the authors additional experiments cleared some of my concerns, the contribution of this work still looks quite incremental to TrustRAG (https://arxiv.org/abs/2501.00879), so I keep my score towards borderline reject.", "rebuttal": "We sincerely thank the reviewer for the thoughtful and constructive comments. We address the remarks in Weaknesses (W) and Questions (Q) below.\n\n---\n\n**W1. Heuristic Nature and Lack of Motivation for Design Choices**\n\n---\n\nThank you for this feedback.  Previously approaches for removing poisoned documents relied on filtering or voting, which disregarded semantic information.  And we feel that the semantic information contained in papers is particularly useful for LLM.  As a result, we decided to develop filtering methods from a semantic standpoint in order to improve the whole system's robustness and resistance to attacks. \n\nMore specifically, the use of clustering and semantic graph filtering in SCF is motivated by the observation that poisoned documents cluster frequently (captured via embeddings) while lacking coherent semantic structure (captured via EIRE).  CAF ensures factual consistency from semantics by comparing retrieved documents to both the query and the LLM's own knowledge, making the final response more reliable.\n\n---\n\n**W2. Technical Clarity**\n\nThank you for this feedback.  We recognize that some of the core mechanisms, particularly how semantic structure graphs are constructed and evaluated, could benefit from more explicit explanation. In the revised version, we will:\n\nInclude a step-by-step example of EIRE's output and how semantic graphs are created (see also Appendix A.3.1).\nProvide a more understandable figure that shows the difference between clean and poisoned documents in the semantic and embedding space.\nExtend Sections 4.2.2 and 4.3 to explain the reasoning behind using semantic similarity as a filtering signal. These additions will assist readers in understanding not only how the method works, but also why it is effective.\n\n---\n\n**W3. Lack of Formal Complexity Analysis**\n\nThe first stage of our proposed defense framework is the filtering phase, which includes cluster-based filtering on the retrieval database and semantic filtering on retrieved candidates.  Before final inference, the Consistency-Aware Filtering (CAF) module performs additional checks on both the retrieved documents and the inference output.  The pseudocode in the appendix provides a more detailed implementation and complexity analysis. In terms of complexity, the retrieval and inference processes are executed only once, whereas the additional filtering steps require two lightweight detection operations. This design ensures that overall computational overhead is minimal. Figure 3 illustrates a specific time comparison. \n\n---\n\n**W4. Heavy Reliance on Prompting and LLM Capabilities**\n\nThank you for the feedback.  We recognize the reviewer's apprehension about the dependence on LLMs in foundational elements like ssG and EIRE. Our design decision is based on the observation that LLMs are currently the most effective tools for capturing deep semantic structures in natural language which  traditional symbolic or sparse methods struggle to accomplish. Even when using smaller or less powerful models, the semantic signals extracted are sufficiently informative to allow our framework to function properly.\n\nWe also showed in Section 5.3 (Table 2) that SeCon-RAG performs well across various lightweight embedding models (e.g., MiniLM, SimCSE), indicating that the framework is adaptable to lower-cost alternatives. For future work, we are looking into more lightweight techniques to replace EIRE, reducing the reliance on full-scale LLM inference at runtime. We will clarify these points more explicitly in the revised version, as well as include additional discussion of scalability trade-offs in deployment scenarios. \n\n---\n\n\n**Q1. Line 168 – Clustering of malicious documents in embedding space**\n\nThank you for your feedback.  Acturally Clustering of malicious documents in embedding space may not be universally applicable across all attack types, but in this paper, we will focus on the poisoned RAG, which will result in Clustering of malicious documents in embedding space. Furthermore, because poisoned documents frequently contain identical or very similar content, their embedding distributions tend to cluster tightly together when retrieved. Clean content, on the other hand, has a broader range of semantic representations and thus does not cluster as tightly. This phenomena has previously been examined in past work, like as the paper \"TrustRAG\" which mentioned a similar viewpoint. Furthermore, the characteristics of the poisoning attack strategy amplify this effect.  We will include a visualization (PCA) in the appendix to back up this point.\n\n---\n\n**Q2. Line 184 – Sparse or fragmented semantic graphs**\n\nThank you for your feedback.  As shown in Figure 2, correct documents generate densely connected semantic graphs, whereas  adversarial documents produce noticeably sparser structures. We use embedding model to project documents into vector space, and the resulting semantic graphs for both correct and incorrect documents are shown in Appendix Figures 1–3.\n\nThis difference in semantic graph structure stems from the inherent characteristics of common attack methods. Although an adversary could create a poisoned document by simply flipping an edge or renaming an entity in Figure 2(a), such changes often reduce the attack's effectiveness or increase its cost. As a result, our defense approach, which takes advantage of these semantic and structural differences, proves particularly effective in such attack scenarios.\n\n---\n\n**Q3. Line 192 – Source of verified documents**\n\nThank you for this feedback.   The \"Verifying Correct Documents\" (D_cor) used for semantic reference are a small set of samples chosen manually from the dataset. These documents are only intended to provide the large model with accurate semantic structures for reference. To assess the impact of Dcor, we conducted ablation experiments that compared performance with and without this Dcor subset. As shown in the table below (with and without cor), enabling Dcor (\"Y\") consistently improves  accuracy or reduces ASR across PIA and different poisoning intensities (100%, 20%) on three datasets (Hotpot 、NQ、MS) .\n\n| W/O Dcor | PIA | 100%  | 20% | PIA | 100% |  20% |PIA | 100%  |20% |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| N  | 76 / 10 | 80 / 6  |  73 / 12 | 72  / 6 |63 / 3| 73 / 10 | 85 / 9|82 / 6 |  85 / 8  |  \n| Y | 77.5 / 0.8 | 75.7 / 3.6  |72.7 / 4.5 |72.3 / 1.8 | 63.6 / 2.5  |74.5 / 10.2 |91.8 / 0 | 88.2 / 0 |89.1 / 9.1 | \n\nWe will include representative examples in the appendix and investigate the effects of including or excluding this candidate set on the experimental results. \n\n---\n\n\n**Q4. Equation (5) and Graph Input to LLM**\n\nThank you for this feedback.   We appreciate the reviewer's observation that the description in lines 178-181 and Equation (5) is unclear.  To clarify, the input to the large language model is natural language not raw numerical vectors.  The compressed vectors are used solely for visualization and relationship construction purposes, but are not directly fed into the LLM.  Instead, we use EIRE outputs (e.g., structured triplets, triplets like \"Entity A—[Relation R]→ Entity B\") to construct semantic graphs using LLM. The LLM then uses these serialized representations to compare candidate and reference documents.We will update Equation (5) and the appendix text to reflect this process and avoid confusion about LLM input types."}, {"review_id": "5r2rCurfUj", "reviewer": "Reviewer_bSmW", "summary": "This paper introduces SeCon-RAG, a two-stage framework designed to defend Retrieval-Augmented Generation (RAG) systems against corpus poisoning and contamination attacks. Traditional defenses often use aggressive filtering, which can lead to the loss of useful information. To counter this, the proposed method first employs a Semantic and Cluster-Based Filtering (SCF) stage. This stage is guided by an Entity-intent-relation extractor (EIRE), which extracts key semantic information like entities, intents, and relations from documents. SCF combines filtering based on document clusters in the embedding space with filtering based on a semantic structure graph generated by EIRE. The second stage introduces an EIRE-guided conflict-aware filtering (CAF) module that operates before the final answer is generated. This module analyzes the semantic consistency between the user's query, the retrieved knowledge, and the candidate answers to filter out internal and external contradictions. This two-stage process aims to preserve valuable knowledge while mitigating the impact of malicious content, thereby improving both the robustness and trustworthiness of the generated output. The authors provide extensive experimental results across various large language models and datasets, showing that SeCon-RAG outperforms current state-of-the-art defense methods.", "questions": "1.Could you provide more details on the LLMs used for the sub-tasks within SeCon-RAG (EIRE, semantic graph similarity, CAF decision-making)? Are these general-purpose models or smaller, specialized models? If general-purpose, how is the prompting engineered for robustness?\n2.Could you elaborate on the \"Supervise\" aspect for EIRE mentioned in Figure 1?\n3.How were the thresholds τcluster​ and τsemantic​ determined for the experiments? Was a validation set used, and how sensitive is the performance to variations in these thresholds?\n4.Regarding the \"small collection of verified correct documents Dcor​\" for semantic graph benchmarking: How large is this set, how is it curated, and how does its composition affect the semantic filtering performance?\n5.The CAF module checks for consistency with the LLM's internal knowledge (\"Model Consistency\" ). How is this \"internal knowledge\" accessed or queried for consistency checking, especially to avoid reinforcing existing biases or hallucinations in the base LLM?", "limitations": "see above questions.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The primary strength of this work lies in its novel and comprehensive approach to a timely and critical problem. The paper is the first to integrate structured semantic information into the RAG defense process through its proposed EIRE module, allowing for a more fine-grained detection of poisoned content. The two-stage framework, which combines the pre-retrieval SCF module with the inference-time CAF module, presents a robust and layered defense strategy. The evaluation is another significant strength; the authors conducted extensive experiments on three different QA benchmarks using five prominent LLMs and tested against multiple attack scenarios, including corpus poisoning and prompt injection attacks. The results are empirically strong, with SeCon-RAG consistently demonstrating high factual accuracy and low attack success rates, outperforming several baselines across nearly all settings. This is further supported by a thorough ablation study that validates the contribution of each individual component to the framework's overall effectiveness.\nDespite these strengths, the work has some weaknesses. A notable concern is the method's reliance on large language models for multiple core functions, including the EIRE extractor, the semantic graph similarity scoring, and the final judgment in the CAF module. This dependency introduces a moderate runtime overhead, with processing times reported between 1.21 and 1.45 minutes per batch, which may not be practical for latency-sensitive applications. Furthermore, the framework's performance is intrinsically tied to the quality of the EIRE parser, meaning any inaccuracies in the initial semantic extraction could propagate and degrade the performance of subsequent filtering stages. Finally, while the paper mentions that experimental results were statistically validated through multiple averages, the main results tables do not include error bars or other measures of statistical significance, making it more difficult to ascertain the true margin of improvement over the baseline methods.", "was_revised": true, "final_justification": "I have read all the reviews and rebuttals, most address my concerns, and I will raise my score by 1.", "rebuttal": "We appreciate your insightful review and recommendations. We address the remarks in Weaknesses (W) and Questions (Q) below.\n\n---\n\n**W1: Dependency on LLMs and Runtime Overhead.**\n\nThank you for the feedback.  We acknowledge that SeCon-RAG uses LLMs in several components (EIRE, semantic similarity scoring, and CAF's final judgment), resulting in a moderate runtime overhead.  The need for deeper semantic understanding that conventional symbolic or sparse methods cannot offer drove our design decision to use LLMs for semantic structure extraction and graph similarity. We do agree, though, that this adds overhead. Also, we notice the following: \n- A single query incurs only a reasonable computational cost, which we believe is acceptable for many real-world applications that require robustness against retrieval-time attacks—such as  business consulting, legal or medical information Q&A, and other high-stakes domains where resistance to poisoning is critical.\n\n- We also showed in Section 5.3 (Table 2) that SeCon-RAG performs well across various lightweight embedding models (e.g., MiniLM, SimCSE), indicating that the framework is adaptable to lower-cost alternatives. For future work, we are looking into more lightweight techniques to replace EIRE, reducing the reliance on full-scale LLM inference at runtime. We will clarify these points more explicitly in the revised version, as well as include additional discussion of scalability trade-offs in deployment scenarios. ﻿\n\n---\n\n**W2. Reliance on EIRE Quality.**\n\nThank you for the feedback.  You are correct in stating that the quality of EIRE affects downstream modules. The dual-layer design of SCF and CAF helps to reduce this dependency. So we evaluating EIRE's standalone impact is critical for better understanding its contribution to overall performance. Table contains a more detailed ablation analysis in which we compare performance with and without EIRE across PIA and multiple poisoning intensity levels (100%, 20%) and datasets (Hotpot, NQ, MS) use  Mistral-12B. The results clearly demonstrate the efficacy of EIRE as a standalone defense component.\n\n| W/O EIRE | PIA | 100%  | 20% | PIA | 100% |20% | PIA | 100%| 20%|\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|N | 76 / 5  |  75 / 4 | 73 / 11 |  69 / 3 | 63 / 4| 72 / 16 |  87 / 5 | 85 / 5 | 83 / 11 |\n|Y| 77.5 / 0.8 |75.7 / 3.6 |72.7 / 4.5 | 72.3 / 1.8 | 63.6 / 2.5 | 74.5 / 10.2 |91.8 / 0 |88.2 / 0|89.1 / 9.1| \n\nThe table shows Accuracy (ACC↑) on the left and Attack Success Rate (ASR) on the right. When EIRE is enabled (\"Y\"), the model consistently achieves higher or comparable accuracy across all settings than when EIRE is turned off (\"N\").  More importantly, EIRE significantly lowers the ASR, particularly in high-poisoning scenarios. For example, in dataset ms, ASR drops from 5% to 0% when Poisoned is set to 100%. \n\nThese findings confirm that EIRE alone makes a significant contribution to the defense mechanism, both in terms of preventing attacks and maintaining model performance. \n\n---\n\n**W3. Missing Error Bars.**\n\nThank you for the feedback. We averaged our experimental results across multiple runs, but we did not include confidence intervals due to space constraints. This will be addressed as follows: The revised version now includes standard deviation/error bars in key tables and figures.In the appendix, we report the number of runs as well as details about our random seed and evaluation protocol.\n\n---\n\n**Q1: LLMs used within SeCon-RAG: Are they general-purpose or specialized? How is prompting designed?.**\n\nThank you for the feedback.  The benchmark RAG model determines whether we use open or closed-source LLMs. When the RAG  component is instantiated with model A, the resulting instruction model is also A, eliminating the need for a separate open or closed-source LLM. Our method is effective whether the LLM is accessed via external APIs or deployed locally, as demonstrated by the consistent performance across both settings in Table 2. And prompting was carefully designed for robustness and consistency, as shown in the appendix.\n\n - EIRE extracts entities, intents, and relations using structured prompts (refer to Appendix A.3.1).\n\n - For semantic graph comparison, we ask the LLM to compare a candidate document's semantic graph to reference graphs and return a normalized similarity score (see Appendix A.3.2).\n\n - In CAF, we use explicit semantic criteria to assess trustworthiness across query, corpus, and model dimensions (see Appendix A.4).\n\n---\n**Q2. Clarification on “Supervise” in Figure 1 for EIRE**\n\nThank you for noticing the ambiguity. The \"Supervise\" label in Figure 1 indicates that EIRE guides both SCF and CAF.  \n\n- In SCF, EIRE structures a semantic graph and compares it to a reference set.\n- In CAF, EIRE's outputs serve as the semantic foundation for consistency checks.\n\nThe term \"supervise\" does not refer to supervised learning, but rather semantic guidance. We will change the figure caption and legend to avoid confusion.\n\n---\n\n**Q3. How were τ_cluster and τ_semantic determined? Sensitivity?**\n\nThank you for the feedback.   For example, the value of τ_cluster is set to 0.88, which was empirically determined based on our own experimental results.. In contrast, τ_semantic is determined using the semantic similarity scores we created from predefined prompt words (as shown in the appendix). Notably, τsemantic is set independently and does not rely on a validation set.\n\nSpecifically, we varied τ_cluster and τ_semantic independently across a reasonable range and evaluated the impact on both model accuracy (ACC↑) and attack success rate (ASR↓) under different poisoning intensity levels (PIA: 100%, 60%, 20%) on datasets(Hotpot、NQ、MS). The findings show that SeCon-RAG is relatively resistant to small variations in these thresholds, owing to the conservative AND-logic used in joint filtering. Changing τ_cluster from 0.86 to 0.90 maintains accuracy and ASR stability across both LLaMA-3.1-8B and GPT-4o backbones. Similarly, changes in τ_semantic between 0.2 and 0.4 cause only minor fluctuations in performance.\n\n| Model | τ_cluster | PIA | 100% | 60% | 20% | PIA  | 100% | 60%  | 20% | PIA  | 100%  | 60% | 20% |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| LLaMA-3.1-8B  |0.86|72 / 4|68 / 4|72 / 4|67 / 19|83 / 2|79 / 4|86 / 2|83 / 6|88 / 4|88 / 4|84 / 7|86 / 4|\n| LLaMA-3.1-8B| 0.90 |72 / 4 |69 / 3 |74 / 4 | 65 / 19 | 83 / 2 | 80 / 4  | 86 /2 |84 / 6| 88 / 4 | 88 / 4 | 84 /7 |87 / 5 |       \n| GPT-4o | 0.86 | 80 / 3 |81 / 2 |81 / 3 |82 / 6 | 82  / 1| 81 / 1 | 83 / 1 | 81 / 3 | 90 / 3 |90 / 2 | 88 / 3 | 87 / 6  |\n|  GPT-4o  |0.90| 81 / 3  |81 / 3 | 84 / 4 |81 / 9 | 82 /  2 | 83 / 1 |84 / 2| 83 / 1| 88 / 4  |86 / 4 |90 / 4 |  85 / 6 |\n\n| Model  | τ_semantic | PIA | 100% | 60% | 20% | PIA  | 100% | 60% | 20% |  PIA  | 100%  | 60% | 20%  |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|LLaMA-3.1-8B | 0.2 |68 / 7 | 67 / 5 |74 / 4 | 66 / 19| 82 / 2| 80 / 4| 86/.2 | 83./7| 88./4 | 88 / 4 | 86 / 5| 89 / 4|\n| LLaMA-3.1-8B |  0.4 |68 / 7 | 70 / 3 |74 / 4 | 66  / 19 | 82 / 2 |80 / 4 | 85 / 2 | 83 / 7 | 88 / 4 | 88 / 4| 86 / 5  | 89 / 6|\n| GPT-4o | 0.2 | 81 / 4  | 81 / 3| 84 / 3 |84 / 7 |81 / 2 | 82 / 2 | 82 / 1  | 84 / 3 | 89 / 4 | 90 / 3 | 87 / 3 |88 / 8|\n| GPT-4o | 0.4 | 80 / 4 | 82  / 3 | 83 / 4 |82 / 9 | 81 / 1|  82 / 2 | 82 / 1 | 83 / 1 | 89 / 2 | 88 / 4 | 88 / 1 | 84 / 7 |\n\n---\n\n**Q4. Composition and size of Dcor (verified correct documents)**\n\n\nThank you for the feedback.  The Dcor subset is a small collection of documents that have been manually verified as relevant and accurate to the query.  These documents were human-verified from datasets to ensure high semantic relevance and correctness. Dcor guides the semantic filtering and CAF process, especially in the construction of the semantic graph used to identify poisoned or inconsistent documents. Its primary function is to provide a reliable semantic anchor for calculating similarity scores.\n\nTo assess the impact of Dcor, we conducted ablation experiments that compared performance with and without this Dcor subset. As shown in the table below (with and without cor), enabling Dcor (\"Y\") consistently improves  accuracy or reduces ASR across PIA and different poisoning intensities (100%, 20%) on three datasets (Hotpot 、NQ、MS) .\n\n| W/O Dcor | PIA | 100%  | 20% | PIA | 100% |  20% |PIA | 100%  |20% |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| N  | 76 / 10 | 80 / 6  |  73 / 12 | 72  / 6 |63 / 3| 73 / 10 | 85 / 9|82 / 6 |  85 / 8  |  \n| Y | 77.5 / 0.8 | 75.7 / 3.6  |72.7 / 4.5 |72.3 / 1.8 | 63.6 / 2.5  |74.5 / 10.2 |91.8 / 0 | 88.2 / 0 |89.1 / 9.1 | \n\nFor example, when Dcor is used at 100% poisoning intensity in MS, the ASR falls from 5% to 0% and accuracy improves from 85 to 88. These findings show that even a small, high-quality Dcor set can significantly improve semantic filtering performance by anchoring the semantic space and reducing noise from poisoned documents. In conclusion, while Dcor is small in size, its careful curation adds significantly to the robustness of our filtering mechanism.\n\n---\n\n**Q5. How is the base LLM’s “internal knowledge” used for model consistency in CAF?**\n\n---\n\nThank you for the feedback.  In CAF's model consistency check, we ask the LLM to determine whether a document's semantic content corresponds to its internal knowledge.  At this stage, reinforcement learning was not used, nor was its bias towards knowledge reinforced.\n\nImportantly, the LLM is expected to reason based on extracted entities and relations, not memorized facts. We reduce hallucination risk by comparing multiple retrieved documents and relying on consistency across sources.Only documents marked \"trustable\" across all dimensions are used in the final generation, including those that support or confirm the LLM's own prior knowledge."}, {"review_id": "qpWmPPj3gZ", "reviewer": "Reviewer_do5K", "summary": "This paper introduces SeCon-RAG, a two-stage framework to enhance the trustworthiness and robustness of RAG systems against corpus poisoning and contamination attacks. The core problem addressed is the vulnerability of RAG systems to malicious data, where existing defenses often suffer from aggressive filtering that removes valuable information, or fail to resolve conflicts between retrieved content and the LLM's internal knowledge. Experiments demonstrate that the effectiveness of SeCon-RAG.", "questions": "1.See weekness\n\n2.The semantic distinction between clean content and toxic content is not clearly explained", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n- SeCon-RAG addresses multiple aspects of RAG vulnerabilities. The combined use of clustering and semantic graph-based filtering in SCF, followed by CAF, provides a robust and layered defense.\n\nWeaknesses:\n\n- Dependency on LLMs. EIRE and ssG rely on extra LLMs.  It introduces concerns regarding the cost, latency, and bias of the LLM used for these foundational components.\n\n- The effectiveness of EIRE standalone in extracting semantic structures and identifying poisoned content is not evaluated in ablation study.\n\n- The paper mentions adjustable thresholds (two \\tau), but lacks a study on the sensitivity of performance to these thresholds.\n\n- EIRE and ssG rely on LLMs. This has impact on the overall system's robustness and efficiency. This paper lacks discussion on real-world deployment challenges.\n\n- The fontsize in table 1, table 2, figure 1-4 are too small. The tables should be re arranged.\n\n-", "was_revised": true, "final_justification": "Thanks for your reply. I have raise my rating. Good luck.", "rebuttal": "We appreciate your insightful review and recommendations. We address the remarks in Weaknesses (W) and Questions (Q) below.\n\n---\n\n**W1:Dependency on LLMs: EIRE and ssG rely on additional LLM calls, raising concerns about cost, latency, and bias.**\n\nThank you for the feedback.  We recognize the reviewer's apprehension about the dependence on LLMs in foundational elements like ssG and EIRE. The need for deeper semantic understanding that conventional symbolic or sparse methods cannot offer drove our design decision to use LLMs for semantic structure extraction and graph similarity. We do agree, though, that this adds overhead. \nAlso, we notice the following: As shown in Section 5.4 and Figure 3, the additional runtime introduced by SeCon-RAG remains within a reasonable range (<1.5 minutes per batch). One query only requires an acceptable cost, which we believe is acceptable for many real-world applications that require robustness.\n\nWe also showed in Section 5.3 (Table 2) that SeCon-RAG performs well across various lightweight embedding models (e.g., MiniLM, SimCSE), indicating that the framework is adaptable to lower-cost alternatives.\nFor future work, we are looking into more lightweight techniques to replace EIRE, reducing the reliance on full-scale LLM inference at runtime. We will clarify these points more explicitly in the revised version, as well as include additional discussion of scalability trade-offs in deployment scenarios.\n\n---\n﻿\n**W2:Lack of standalone evaluation for EIRE in ablation study.**\n\nWe agree that evaluating EIRE's standalone impact is critical for better understanding its contribution to overall performance.To address this, Table (shown below) contains a more detailed ablation analysis in which we compare performance with and without EIRE across PIA and multiple poisoning intensity levels (100%, 20%) and datasets (Hotpot, NQ, MS) use  Mistral-12B. The results clearly demonstrate the efficacy of EIRE as a standalone defense component.\n\n| W/O EIRE | PIA | 100%  | 20% | PIA | 100% |  20% | PIA  | 100%  | 20%|\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| N | 76 / 5  |  75 / 4 | 73 / 11 |  69 / 3 | 63 / 4| 72 / 16 |  87 / 5 | 85 / 5 | 83 / 11 |\n| Y  | 77.5 / 0.8 |75.7 / 3.6 |72.7 / 4.5 | 72.3 / 1.8 | 63.6 / 2.5 | 74.5 / 10.2 |91.8 / 0 |  88.2 / 0|89.1 / 9.1| \n\nThe table shows Accuracy (ACC↑) on the left and Attack Success Rate (ASR) on the right. When EIRE is enabled (\"Y\"), the model consistently achieves higher or comparable accuracy across all settings than when EIRE is turned off (\"N\").\nAttack Success Rate (ASR↓) More importantly, EIRE significantly lowers the attack success rate, particularly in high-poisoning scenarios. For example, under 100% PIA, ASR falls from 16% to 10.2% in one setting and to 0% in others.\nThese findings confirm that EIRE alone makes a significant contribution to the defense mechanism, both in terms of preventing attacks and maintaining model performance. We will clarify this in the revised manuscript and emphasize EIRE's standalone impact in the ablation study section.\n\n---\n\n\n**W3: Threshold sensitivity analysis is missing.**\n\nWe will add a supplementary plot showing how varying τ_cluster and τ_semantic affects accuracy and ASR. Preliminary results suggest that SeCon-RAG is relatively robust within a reasonable range (±0.1) of threshold values, due to the conservative AND-logic used in joint filtering.\n\nWe agree that thresholds are critical in determining the strictness of the Semantic Consistency Filter (SCF). In our experiments, we manually tuned these thresholds on a validation set. Unfortunately, due to space constraints, we did not include a detailed sensitivity analysis in the main paper.\n\nTo address this, we conducted a comprehensive threshold sensitivity analysis and included the findings in the supplementary material. Specifically, we varied τ_cluster and τ_semantic independently across a reasonable range and evaluated the impact on both model accuracy (ACC↑) and attack success rate (ASR↓) under different poisoning intensity levels (PIA: 100%, 60%, 20%) on datasets(Hotpot、NQ、MS).\nThe findings show that SeCon-RAG is relatively resistant to small variations in these thresholds, owing to the conservative AND-logic used in joint filtering. Changing τ_cluster from 0.86 to 0.90 maintains accuracy and ASR stability across both LLaMA-3.1-8B and GPT-4o backbones. Similarly, changes in τ_semantic between 0.2 and 0.4 cause only minor fluctuations in performance.\n\n| Model | τ_cluster | PIA | 100% | 60% | 20% | PIA  | 100% | 60%  | 20%  | PIA  | 100%  | 60% | 20% |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| LLaMA-3.1-8B  |0.86|72 / 4|68 / 4|72 / 4|67 / 19|83 / 2|79 / 4|86 / 2|83 / 6|88 / 4|88 / 4|84 / 7|86 / 4|\n| LLaMA-3.1-8B| 0.90 |72 / 4 |69 / 3 |74 / 4 | 65 / 19 | 83 / 2 | 80 / 4  | 86 /2 |84 / 6| 88 / 4 | 88 / 4 | 84 /7 |87 / 5 |       \n| GPT-4o | 0.86 | 80 / 3 |81 / 2 |81 / 3 |82 / 6 | 82  / 1| 81 / 1 | 83 / 1 | 81 / 3 | 90 / 3 |90 / 2 | 88 / 3 | 87 / 6  |\n|  GPT-4o  |0.90| 81 / 3  |81 / 3 | 84 / 4 |81 / 9 | 82 /  2 | 83 / 1 |84 / 2| 83 / 1| 88 / 4  |86 / 4 |90 / 4 |  85 / 6 |\n\n| Model  | τ_semantic | PIA | 100% | 60% | 20% | PIA  | 100% | 60% | 20% |  PIA  | 100%  | 60% | 20%  |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|LLaMA-3.1-8B | 0.2 |68 / 7 |   67 / 5    |    74 / 4   |    66 / 19   |     82 / 2  |    80 / 4   |    86/.2   | 83./7      |    88./4   |    88 / 4      |     86 / 5  |    89 / 4   |\n| LLaMA-3.1-8B |    0.4    |  68 / 7     |   70 / 3    |     74 / 4  |    66  / 19   |    82 / 2   |  80 / 4     | 85 / 2 |     83 / 7  |   88 / 4   |     88 / 4  |     86 / 5  |    89 / 6  |\n| GPT-4o | 0.2 |   81 / 4    |   81 / 3    |   84 / 3    |   84 / 7    |    81 / 2   |     82 / 2  |     82 / 1  |    84 / 3   |    89 / 4   |    90 / 3   |   87 / 3   |  88 / 8     |\n| GPT-4o | 0.4 | 80 / 4 |    82  / 3   |    83 / 4   |  82 / 9     |     81 / 1  |  82 / 2     |     82 / 1  |  83 / 1     |    89 / 2   |     88 / 4  |  88 / 1     |    84 / 7   |\n\n---\n\n**W4: Real-world deployment discussion is lacking.**\n\nWe agree that additional discussion of real-world deployment considerations would improve the paper. In Section 6 (Limitations), we will discuss the trade-off between robustness and latency, particularly for latency-sensitive applications (e.g., real-time QA). And we also want to point out that because of the SeCon-RAG's plug-and-play compatibility with existing RAG systems, the real-world can easily use it to improve the robustness of a realistic system.\n\n---\n\n**W5: Font size in tables/figures is too small.**\n\nThank you for this important formatting remark. We acknowledge that the font sizes in Table 1, Table 2, and Figures 1-4 are currently small due to layout constraints.  In the camera-ready version, we will separate large tables into sub-tables for each dataset to improve readability. And increase the font size and spacing in all figures and tables, move detailed numerical tables to the appendix, and keep summary plots in the main text.\n\n---\n\n**Q2: Semantic distinction between clean and toxic (poisoned) content is unclear.**\n\n\nThank you for the feedback.  The semantic difference between clean and toxic content in our SCF module can be understood from two key perspectives:\n\n\nFirst, because poisoned documents frequently contain identical or highly similar content, their embedding distributions tend to cluster tightly together when retrieved. In contrast, clean content has more diverse semantic representations and thus does not form such tight clusters. This phenomena has previously been examined in past work, like as the paper \"TrustRAG\" which mentioned a similar viewpoint.\n\nSecond, we conducted a thorough analysis using semantic graphs created from entities, intents, and relations extracted using EIRE. Figure 2 and Figures 1, 2, and 3 in the Appendix demonstrate that poisoned documents consistently produce sparser and less coherent semantic graphs than clean documents. These structural inconsistencies occur because poisoned content frequently contains misleading or contradictory information that lacks semantic consistency and connectivity. Furthermore, the characteristics of the poisoning attack approach exacerbate this effect.\n\nThese findings support our targeted design of the SCF module, which uses semantic graph-based analysis and clustering-based filtering to effectively distinguish toxic from clean content."}]

Author rebuttal:

Meta-review: This paper introduces SeCon-RAG, a two-stage framework to enhance the trustworthiness of RAGsystems against corpus poisoning attacks. The core contribution is a novel defense mechanism that integrates structured semantic analysis into the filtering process. The first stage combines cluster-based filtering with a novel Entity-Intent-Relation Extractor (EIRE) to clean the retrieval database, while the second stage performs a conflict-aware check to ensure semantic consistency before generating a final answer.

The primary strengths of the work are its novel approach to the timely and critical problem of RAG security, along with its extensive and rigorous evaluation. The experiments are comprehensive, covering five different LLMs and three datasets, and the results demonstrate a consistent and significant improvement over baseline methods. The main weakness, identified by multiple reviewers, is the considerable inference latency and computational overhead introduced by the framework's reliance on multiple LLM calls for its core components, which may limit its real-world applicability.

During rebuttal, The authors provided a response that addressed most of the weaknesses raised. They conducted several new experiments, including detailed ablation studies to decouple the contributions of their filtering components, a standalone evaluation of the EIRE module, and a sensitivity analysis for the framework's thresholds . While they acknowledged the latency concerns, they justified it as an acceptable trade-off for achieving high robustness in critical applications. Overall, the paper's claims are well-justified, and the margin of improvement shown in the experiments is quite consistent. The rebuttal successfully answered most of the reviewers' questions, with two reviewers raising their scores in response. The main concern from the most critical reviewer was the novelty of the work in comparison to a prior paper, TrustRAG . The authors responded to this directly with a new, decoupled ablation study clearly demonstrating the added value of their semantic filtering module. As the reviewer did not reply further to this clarification, it appears the authors' response was sufficient. Given the strength of the paper and the comprehensive rebuttal, the paper is recommended for acceptance.
Decision: Accept (poster)