Title: SeCon-RAG: A Two-Stage Semantic  Filtering and Conflict-Free Framework for Trustworthy RAG
Venue: NeurIPS 2025
Accepted: yes
Keywords: RAG

Prompt of LLMs

Defense against RAG attack
Abstract: Retrieval-augmented generation (RAG) systems enhance large language models (LLMs) with external knowledge but are vulnerable to corpus poisoning and contamination attacks, which can compromise output integrity. Existing defenses often apply aggressive filtering, leading to unnecessary loss of valuable information and reduced reliability in generation.
To address this problem, we propose a two-stage semantic filtering and conflict-free framework for trustworthy RAG. 
In the first stage, we perform a joint filter with semantic and cluster-based filtering  which is guided by the Entity-intent-relation extractor (EIRE). EIRE extracts entities, latent objectives, and entity relations from both the user query and filtered documents, scores their semantic relevance, and selectively adds valuable documents into the clean retrieval database. 
In the second stage, we proposed an EIRE-guided conflict-aware filtering module, which analyzes semantic consistency between the query, candidate answers, and retrieved knowledge before final answer generation, filtering out internal and external contradictions that could mislead the model.
Through this two-stage process, SeCon-RAG effectively preserves useful knowledge while mitigating conflict contamination, achieving significant improvements in both generation robustness and output trustworthiness.
Extensive experiments across various LLMs and datasets demonstrate that the proposed SeCon-RAG markedly outperforms state-of-the-art defense methods.


Peer reviews:
comments: SUMMARY:
This paper introduces SeCon-RAG, a two-stage framework to enhance the trustworthiness and robustness of RAG systems against corpus poisoning and contamination attacks. The core problem addressed is the vulnerability of RAG systems to malicious data, where existing defenses often suffer from aggressive filtering that removes valuable information, or fail to resolve conflicts between retrieved content and the LLM's internal knowledge. Experiments demonstrate that the effectiveness of SeCon-RAG.

STRENGTHS AND WEAKNESSES:
Strengths:

- SeCon-RAG addresses multiple aspects of RAG vulnerabilities. The combined use of clustering and semantic graph-based filtering in SCF, followed by CAF, provides a robust and layered defense.

Weaknesses:

- Dependency on LLMs. EIRE and ssG rely on extra LLMs.  It introduces concerns regarding the cost, latency, and bias of the LLM used for these foundational components.

- The effectiveness of EIRE standalone in extracting semantic structures and identifying poisoned content is not evaluated in ablation study.

- The paper mentions adjustable thresholds (two \tau), but lacks a study on the sensitivity of performance to these thresholds.

- EIRE and ssG rely on LLMs. This has impact on the overall system's robustness and efficiency. This paper lacks discussion on real-world deployment challenges.

- The fontsize in table 1, table 2, figure 1-4 are too small. The tables should be re arranged.

-

QUESTIONS:
1.See weekness

2.The semantic distinction between clean content and toxic content is not clearly explained

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 2
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-06-09

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces SeCon-RAG, a two-stage framework designed to defend Retrieval-Augmented Generation (RAG) systems against corpus poisoning and contamination attacks. Traditional defenses often use aggressive filtering, which can lead to the loss of useful information. To counter this, the proposed method first employs a Semantic and Cluster-Based Filtering (SCF) stage. This stage is guided by an Entity-intent-relation extractor (EIRE), which extracts key semantic information like entities, intents, and relations from documents. SCF combines filtering based on document clusters in the embedding space with filtering based on a semantic structure graph generated by EIRE. The second stage introduces an EIRE-guided conflict-aware filtering (CAF) module that operates before the final answer is generated. This module analyzes the semantic consistency between the user's query, the retrieved knowledge, and the candidate answers to filter out internal and external contradictions. This two-stage process aims to preserve valuable knowledge while mitigating the impact of malicious content, thereby improving both the robustness and trustworthiness of the generated output. The authors provide extensive experimental results across various large language models and datasets, showing that SeCon-RAG outperforms current state-of-the-art defense methods.\n\nSTRENGTHS AND WEAKNESSES:\nThe primary strength of this work lies in its novel and comprehensive approach to a timely and critical problem. The paper is the first to integrate structured semantic information into the RAG defense process through its proposed EIRE module, allowing for a more fine-grained detection of poisoned content. The two-stage framework, which combines the pre-retrieval SCF module with the inference-time CAF module, presents a robust and layered defense strategy. The evaluation is another significant strength; the authors conducted extensive experiments on three different QA benchmarks using five prominent LLMs and tested against multiple attack scenarios, including corpus poisoning and prompt injection attacks. The results are empirically strong, with SeCon-RAG consistently demonstrating high factual accuracy and low attack success rates, outperforming several baselines across nearly all settings. This is further supported by a thorough ablation study that validates the contribution of each individual component to the framework's overall effectiveness.\nDespite these strengths, the work has some weaknesses. A notable concern is the method's reliance on large language models for multiple core functions, including the EIRE extractor, the semantic graph similarity scoring, and the final judgment in the CAF module. This dependency introduces a moderate runtime overhead, with processing times reported between 1.21 and 1.45 minutes per batch, which may not be practical for latency-sensitive applications. Furthermore, the framework's performance is intrinsically tied to the quality of the EIRE parser, meaning any inaccuracies in the initial semantic extraction could propagate and degrade the performance of subsequent filtering stages. Finally, while the paper mentions that experimental results were statistically validated through multiple averages, the main results tables do not include error bars or other measures of statistical significance, making it more difficult to ascertain the true margin of improvement over the baseline methods.\n\nQUESTIONS:\n1.Could you provide more details on the LLMs used for the sub-tasks within SeCon-RAG (EIRE, semantic graph similarity, CAF decision-making)? Are these general-purpose models or smaller, specialized models? If general-purpose, how is the prompting engineered for robustness?\n2.Could you elaborate on the \"Supervise\" aspect for EIRE mentioned in Figure 1?\n3.How were the thresholds τcluster​ and τsemantic​ determined for the experiments? Was a validation set used, and how sensitive is the performance to variations in these thresholds?\n4.Regarding the \"small collection of verified correct documents Dcor​\" for semantic graph benchmarking: How large is this set, how is it curated, and how does its composition affect the semantic filtering performance?\n5.The CAF module checks for consistency with the LLM's internal knowledge (\"Model Consistency\" ). How is this \"internal knowledge\" accessed or queried for consistency checking, especially to avoid reinforcing existing biases or hallucinations in the base LLM?\n\nLIMITATIONS:\nsee above questions.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents SeCon-RAG, a two-stage framework to make Retrieval-Augmented Generation (RAG) systems more trustworthy and resistant to data poisoning attacks. Existing defenses can often remove useful information or fail to resolve knowledge conflicts. SeCon-RAG tackles this with two core modules: 1) Semantic and Cluster-Based Filtering (SCF): This module uses clustering and an Entity-Intent-Relation Extractor (EIRE) to perform fine-grained filtering, removing poisoned documents while preserving valuable ones. 2) This module uses EIRE to analyze semantic consistency between the query, retrieved documents, and the model's internal knowledge, filtering out contradictions before generating an answer. The contributions include introducing structured semantic analysis to RAG defense via EIRE and the proposed framework itself. Experiments show SeCon-RAG outperforms baseline methods in accuracy and attack resistance across various LLMs and datasets.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- Trustworthy RAG against malicious attacks is an interesting and important topic\n- Results are shown on multiple LLMs of different categories and sizes\n\nWeakness (please see questions for more details):\n- The methodology is relatively heuristic, lacking motivations in design choices\n- Technical details are not clear enough\n- Complexity analysis. It is appreciated that Figure 3 shows an empirical comparison under a specific initiation of hyperparameters of the proposed approach. However it is better to include a formal complexity analysis in the paper, for example, in terms of number of total documents, retrieved documents, average document token length, etc.\n- The method heavily relies on prompt engineering in most components, therefore ultimate limited by the inherent capability of LLMs used.\n\nQUESTIONS:\n- In line 168 \"Due to the semantic similarity of malicious documents, they cluster in embedding space\". This statement is too strong without any supporting evidence. I can imagine different attacking approaches would change this statement easily\n- In line 184 \"Correct documents produce densely connected semantic graphs with high coherence, whereas poisoned documents have sparse or fragmented structures.\" Again, one can simple flip an edge or rename an entity in Figure 2 (a) to produce a poisoned document, so this claim does not hold as well.\n- In line 192, where do these verified documents come from?\n- In equation (5), graphs are inputs to the LLM. However, in line 178-181, the graph node v is defined as \"projection of embedding vector\". Does that mean numerical vectors are sent to LLM as inputs? This does not make sense to me. In addition to that, how does the projection computed is not clear at all.\n\nLIMITATIONS:\nYes, in the conclusion section.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe main objective of this paper is to identify and remove harmful documents from the knowledge base, thereby improving the reliability of the RAG system's output. First, this paper develops an EIRE method to identify the intent, entities, and relations in each document. Then, this papercombines clustering method with the EIRE method to eliminate harmful documents from the repository. Finally, after retrieval based on the filtered repository, this work further refines the retrieved documents using the EIRE method to ensure that only those documents that are both relevant to the query and factually consistent are retained as augmentations.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths \n1. This work focuses on the task of removing corpus poisoning, which is highly important for improving the reliability of RAG systems.\n2. This work employs a new approach, using EIRE to analyze and statistically evaluate documents at the semantic level to identify harmful ones.\n3. The experiments in this work cover multiple large models and diverse datasets, with the results demonstrating the overall effectiveness of the proposed method.\nWeaknesses\n1. The explanation of the principles behind some key steps in this work's methodology is unclear, making it somewhat difficult to understand why this method is effective.\n2. There is a lack of some key analysis experiments. For example, the paper mentions that SCF includes two filtering processes but does not employ experiments to explain why both must be used together.\n3. The proposed method in this work introduces higher inference latency, which somewhat limits its practical applicability.\n\nQUESTIONS:\n1. In line 168 of the paper, it is mentioned that \"Due to the semantic similarity of malicious documents, they cluster in embedding space.\" What is the basis or evidence supporting this claim?\n2. Similarly, in line 188, it is stated that \"poisoning documents generate sparse or fragmented graphs.\" While this is illustrated in Figure 2, what is the underlying reasoning behind this phenomenon?\n3. In line 194 of the paper, it is mentioned that the similarity between the graph of a candidate document and some verified correct documents is used to evaluate the candidate document. Is the effectiveness of this operation supported by experiments?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-03"}