Detect, Unlearn, Restore: Defending Text Summarization Models Against Data Poisoning

When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse

Retrieval-augmented generation (RAG) is indispensable for enhancing large language models. However, RAGs are increasingly susceptible to poisoning attacks, in which adversarial documents are injected to manipulate generator outputs. Previous methods rely on output-side signals such as perplexity and consistency checks to detect such attacks. Nevertheless, our analysis reveals that deliberate attacks often induce false confidence, where poisoned outputs exhibit even lower perplexity than benign ones, rendering uncertainty-based detection ineffective. To address this challenge, we explore the internal dynamics of the generator and identify a distinctive signature termed Attention Collapse. Unlike the dispersed attention in benign generations, attacked generations exhibit a decrease in entropy as attention concentrates on poisoned documents. Building on these findings, we propose D-SCAN (Document-level Signal Collapse Analysis), a lightweight detection framework that monitors attention dynamics to identify attacked generations. Extensive experiments on multiple attack benchmarks demonstrate the effectiveness of our method. Moreover, D-SCAN can detect attacks even when they fail to alter the final answer. Code is available at https://github.com/yingtaoren/D-Scan.git.

RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning

Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence. We introduce RAGuard, a layered defense against \emph{factual} corpus-poisoning attacks on RAG pipelines. The first layer adversarially fine-tunes a dense retriever on synthetic poisoned documents (fabricated facts, contradictions, and reasoning traps), teaching it to downrank malicious passages before generation. The second layer, the Zero-Knowledge Inference Patch ZKIP, is a label-free, black-box filter: for each retrieved document, it performs a leave-one-out decode and scores the document by the semantic shift and output-entropy change that its removal induces. ZKIP requires no poison labels, no ground-truth answers, and no access to model internals; it compares the model's own answers under counterfactual contexts. On poisoned Natural Questions at 5--30\% poison ratios, adversarial retriever training alone reduces but does not eliminate attack success, while ZKIP drives the measured attack success rate to 0.000 in every defended configuration, keeping Recall@5 within 0.03 of the clean-corpus baseline. Supervised analyses on both Natural Questions and BEIR (NFCorpus) confirm that the counterfactual signals ZKIP relies on carry learnable poison structure. The defense costs $k{+}1$ generator passes per query ($6\times$ for $k{=}5$); we analyze batching and early-stopping approximations that reduce this overhead. We also show that keyword-preserving poisons leave lexical retrievers such as BM25 essentially unaffected, an observation that delineates the boundary of the threat model. Code, datasets, and evaluation harnesses are released for reproducibility.

Random Character-Level Perturbations Amplify LLM Jailbreak Attacks

Explaining Jailbreaks: Structured and Interpretable Safety Assessment for Large Language Models

MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoning

This work proposes MemCatalyst, a set of data poisoning tools, aiming to amplify the data auditing performance on VLMs, and forces VLMs to over-learn specific inconsistencies between image features and textual semantics during training, thereby increasing their susceptibility to membership information auditing.

PRISM: A Lightweight Method for Jailbreak Detection via Prompt-Response Semantic Coherence Scoring in LLMs

Detecting whether a jailbreak attack against a large language model (LLM) has succeeded is a challenging problem in AI security. Existing approaches rely on brittle string matching, expensive LLM-based judges, or task-specific classifiers that often fail to generalize. This paper investigates whether semantic coherence is sufficient to evaluate jailbreak success. In this work, we propose PRISM: Prompt-Response coherence for Identifying jailbreaks via Scoring Method, a lightweight method that models jailbreak detection as a coherence problem between the harmful prompt and the model response. The approach combines multiple semantic similarity signals within an ensemble of classical and simple machine learning models. Training in 3,480 pairs of prompt-responses from AdvBench, HarmBench and Alpaca, PRISM achieves F1 = 0.91 and AUC-ROC = 0.98 in the internal test set. In a held-out validation set of 694 labeled samples never seen during training, it outperforms six baseline attack success estimators, achieving the highest accuracy (0.746) and AUC-ROC (0.840), while being up to $\mathbf{1 6} \times$ faster than LLM-based methods. These results demonstrate that semantic coherence provides a robust and efficient signal for jailbreak detection, significantly reducing the implementation complexity of state-of-the-art approaches.