E co S afe RAG : Efficient Security through Context Analysis in Retrieval-Augmented Generation (2025)

Abstract: Retrieval-Augmented Generation (RAG) compensates for the static knowledge limitations of Large Language Models (LLMs) by integrating external knowledge, producing responses with enhanced factual correctness and query-specific contextualization. However, it also introduces new attack surfaces such as corpus poisoning at the same time. Most of the existing defense methods rely on the internal knowledge of the model, which conflicts with the design concept of RAG. To bridge the gap, EcoSafeRAG uses sentence-level processing and bait-guided context diversity detection to identify malicious content by analyzing the context diversity of candidate documents without relying on LLM internal knowledge. Experiments show EcoSafeRAG delivers state-of-the-art security with plug-and-play deployment, simultaneously improving clean-scenario RAG performance while maintaining practical operational costs (relatively 1.2 \times latency, 48%-80% token reduction versus Vanilla RAG).

## introduction rag effectively reduces the inherent limitations of llms in knowledge-intensive tasks by dynamically integrating relevant passages from external knowledge bases @xcite @xcite . it extends the static parametric memory of llms to adapt to evolving knowledge demands and significantly enhances factual accuracy in open-domain question answering through real-time retrieval mechanisms @xcite , while reducing hallucination issues caused by parametric memory constraints @xcite . although rag significantly enhances the performance of language models, its reliance on external knowledge bases introduces new security risks. the vulnerabilities of this technology manifest in two key dimensions: first, due to the inherent limitations of existing retrieval technologies @xcite and the presence of noisy data in knowledge bases, retrieval results often contain irrelevant or incorrect information @xcite @xcite . a typical example is google search suggesting "non-toxic glue" for sticking pizza due to retrieving prank content from reddit @xcite . second, rag systems face significant security challenges that undermine their reliability, with vulnerabilities existing in both the retrieval and generation components @xcite . retrieval-augmented language models @xcite , denoising processes through self-synthesized rationales @xcite , and adaptive noise-robust model @xcite are currently some solutions to address redundant information. while malicious documents could theoretically be treated as noise, their effectiveness against attacks remains unverified in practical scenarios. the existing methods @xcite for defending against malicious poisoning rely on the internal knowledge base of the model for some steps. however, these methods exhibit intrinsic limitations: they depend on internal knowledge base of llm for evaluation, potentially introducing model biases @xcite . furthermore, this reliance contradicts the foundational design principle of rag systems, which emphasizes the utilization of external knowledge, thereby complicating efforts to effectively mitigate the issue of malicious content. to bridge the gap, we propose ecosaferag, a sentence-level rag framework that employs baitguided diversity detection to identify and filter malicious content through contextual analysis without relying on the internal knowledge of llm, as illus-figure 1 : comparison of the vanilla rag (red path) and ecosaferag (green path). vanilla rag directly retrieves the entire document, which can easily introduce unverified toxic content. the proposed ecosaferag adopts a sentence-level processing approach. building upon this, a bait-guided contextual diversity detection mechanism is introduced, which effectively identifies and filters potential malicious content by analyzing the semantic diversity of the context of candidate content, enhancing the security and accuracy of the generated content. as shown in figure 6 , sentence-level segmentation enhances the exposure of attack features while effectively reducing redundancy in normal content. this provides a solid foundation for subsequent processing. we further discovered that when faced with contradictory candidates (e.g., a claims "chicago fire has 23 episodes" while b insists "it has 24 episodes"), relying solely on core sentences is insufficient for determining veracity. to address this issue, analyzing the context of the statements can aid decision-making. moreover, existing poisoned document constructions @xcite require llm template generation (appendix b), which exhibits certain contextual similarities @xcite . notably, in specific application scenarios, the sparsity of candidate documents may lead to cold start problems for traditional detection methods. therefore, we propose the bait-guided contextual diversity check method ( §3.3). this approach leverages the systematic differences in contextual quality between normal and poisoned documents by injecting bait to guide clustering, achieving precise filtration. we conduct a systematic evaluation across three typical attack scenarios (corpus poisoning attack, prompt injection attack, and adversarial attack) using nq @xcite , hotpotqa @xcite , and ms-marco @xcite , with validation on vicuna @xcite , llama 2 @xcite , and llama 3-8b models @xcite . our main contributions are as follows: rag defenses. current defense mechanisms for rag systems remain in their nascent stages of development, exhibiting several limitations across different methodologies. the majority voting mechanism employed in robustrag @xcite exhibits suboptimal performance when the number of poisoned documents exceeds one per query. while trustrag @xcite introduces a twostage defense mechanism that integrates k-means clustering with cosine similarity and rouge metrics for initial detection, followed by knowledgeaware self-assessment, its reliance on the model's internal knowledge base remains a vulnerability. to this end, we further propose ecosaferag, intending to contribute meaningful insights to the development of rag defense strategies. ## experimental results and analysis our evaluation comprises performance results across diverse datasets and attack scenarios, cost analysis, and ablation studies, with experimental parameters detailed in appendix d.2. ## conclusion we present ecosaferag, a comprehensive defense mechanism against multiple security vulnerabilities in retrieval-augmented generation systems that maintains the core rag principle of independence from llm internal knowledge. our approach employs sentence-level segmentation to expose attack features while reducing redundancy in normal content, providing a foundation for effective filtering. recognizing that contradictory information cannot be resolved through core sentences alone, we devel-oped a bait-guided contextual diversity check that leverages the systematic differences between normal and poisoned documents. experiments demonstrate that ecosaferag delivers state-of-the-art security with plug-and-play deployment, simultaneously improving clean-scenario performance while maintaining practical operational costs (1.2× relative latency, 48%-80% token reduction versus vanilla rag).