Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses

What it is

Pushkal Kumar and Arvin Sahaym (arXiv 2610.33849, October 2026) argue that published query-time RAG poisoning filters score near-perfectly because of how the poison set was built, not because of what the filter reads. They give two statistics that profile a poison set using only the poison and the clean corpus, with no defense, scores or labels. Containment is how often the target question appears verbatim in the poison. Length overlap is how far poison word lengths fall inside the clean band. They release a script that computes the profile. The page text is cut off partway through the survey table, so the script's name and usage are not shown.

How it works

PoisonedRAG's released src/attack.py builds each passage as adv_text_a = question + "." followed by the generated text, while its released archive stores only the generated half. Containment is therefore 1.00 in every template cell and on the attack authors' own passages. Containment and length overlap by corpus:

The legal clean corpus has no length variance at all (p95/p5 = 1.00).

Two controls show the effect:

• Prefix deletion. Removing the prefix from the attack authors' passages, and changing nothing else, leaves 0.93 of them still retrieved for their target. It takes the RAGuard re-implementation from AUROC 0.953 to 0.758 and its miss rate from 0.191 to 0.763.
• Shuffled-filler padding. Padding medical poison to clean length with word-shuffled filler moves TrustRAG's set-level stage from a miss rate of 0.000 to 0.827. The authors' own learned scorer goes from 0.000 to 0.986 at its deployed threshold, but only to 0.321 at a matched 5% false-positive rate. Its AUROC stays at 0.953, and the share of injected poison reaching the context rises from 0.00 to 0.94.

The authors call this the ranking surviving while the decision does not. They name two failure modes: calibration collapse, where the ranking is usable but the deployed threshold is dead and can partly be repaired at a stated false-positive cost, and signal collapse, which nothing in the decision layer repairs.

Padding with real clean prose also collapses a GPT-2 perplexity threshold and RAGuard's chunk score, but by content dilution rather than length. Shuffled filler returns both miss rates to 0.000.

Survey of 21 published defense evaluations

• 8 verifiably run poison containing the target question. 3 ship the attack's attack.py line unchanged, and one released poison set has the question in 500 of 500 passages.
• 5 substitute a length or repetition cue, such as a fragment repeated 2 to 10 times. D-SCAN's poison is 119 to 162 words against clean chunks fixed at 100, where word count alone reaches AUROC 0.999.
• 2 use constructions with no question, and 6 cannot be determined.
• 12 report no false-positive rate at the deployed operating point, and only 1 reports a ranking metric.
• 3 remove the prefix (TrustRAG, TRIS, TriShieldRAG), but they report attack success at one fixed threshold with no false-positive side.

On PoisonedRAG's own NQ passages, a GPT-2 perplexity threshold misses 1.000 with and without the prefix (AUROC 0.773 and 0.729). On poison regenerated for a medical corpus it misses 0.062 at AUROC 0.993.

What to do

The page's recommendation is to treat a detection result as evidence only when it comes with the poison set's construction profile and the false-positive rate at the threshold actually deployed. When evaluating or choosing a filter, run the profile script on the benchmark poison. Then rerun the filter with the question prefix stripped, and with length-matched shuffled filler, and compare miss rate at the deployed threshold, not AUROC alone.

Caveats

• The profile is validated on four corpora only. At single (corpus, attack, defense) points its direction is wrong for 40 of 90.
• One of the ten defenses is the authors' own learned scorer. A defense-aware attacker passes 0.977 of poisoned documents past it, and the authors propose no defense.
• Their cost-derived decision rule changes no decision in 12 of 26 cells, so on flagged cells no operating-point claim can be falsified, theirs included.
• Four attack families were tested, and the profile was checked on every question-targeted attack that releases poison as text. Attacks framed as legitimate corrections or updates carry no construction cue to mark them.