Elamur Research⌕
☰
home / papers / 2026 / PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption

PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption

Paper · 2026 · Xue Tan, Yi Zheng, Chang Huo et al.

Summary

Retrieval-Augmented Generation can be hijacked when attackers plant crafted passages in the knowledge base so that the LLM returns an answer they chose. Existing defenses such as AstuteRAG and TrustRAG depend on the LLM already knowing the facts, and they offer no formal guarantees. RobustRAG does give guarantees, but it is expensive because it needs many LLM calls. PRA-RAG takes a different route and works at the retrieval stage. It first retrieves a deliberately enlarged Top-K set and samples many fixed-size subsets of those passages. Each subset is embedded, and the method finds the smallest ball in embedding space that covers more than half of the subsets. It then builds a weighted embedding average from the subset at the centre of that ball. Clean subsets form a combinatorial majority as long as the number of poisoned passages stays small, so the authors can prove an upper bound on the semantic drift poisoning can cause. They turn this bound into a robustness metric called Provable Average Deviation (PAD). The method is model-agnostic, cheap, and lowers attack success while keeping answer accuracy.

Key points

  • On MS-MARCO with 20% of retrieved passages poisoned, PRA-RAG keeps accuracy at 71% and cuts attack success rate to 1%, beating AstuteRAG, InstructRAG, RobustRAG and other baselines.
  • The certificate is distribution-free. It requires only that clean size-n subsets outnumber half of all subsets, not that poisoned and clean embeddings be separable.
  • In ablations, robustness improves (lower PAD) with larger Top-K (8→16) and larger subsets (3→5 passages). It degrades as poisoned passages increase from ε=1 to 3.
  • Averaging the selected embeddings outperforms simply concatenating the selected texts (PRA-RAG cat) on both accuracy and attack success.
  • PRA-RAG had the lowest average latency among the compared defenses on NQ, MS-MARCO and HotpotQA, at roughly 6 s per query.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Fudan UniversityShanghai · China167 works · 20,987 citations🎓Worcester Polytechnic InstituteWorcester · United States8 works · 380 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Information retrieval & search · 473 works

Cite

Cite as Xue Tan, Yi Zheng, Chang Huo, Yunruo Zhang, Yu Liu, Hao Luan, Zhuyang Yu, Jun Dai, Xiaoyan Sun and Ping Chen. 2026. PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1794

@inproceedings{tan2026pra,
  title = {{PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruption}},
  author = {Xue Tan, Yi Zheng, Chang Huo, Yunruo Zhang, Yu Liu, Hao Luan, Zhuyang Yu, Jun Dai, Xiaoyan Sun and Ping Chen},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1794},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1794}
}

References

36 references, 14 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  2. Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. 2024. Self-rag: Learning to retrieve, generate, and critique through self-reflection.
  3. Jinheon Baek, Soyeong Jeong, Minki Kang, Jong C Park, and Sung Hwang. 2023. Knowledge-augmented language model verification. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 1720–1736. find
  4. Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, and 1 others. 2016. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268.
  5. BBC. 2024. Glue pizza and eat rocks: Google ai search errors go viral. https://www.bbc.co.uk/ news/articles/cd11gzejgz4o. ↗
  6. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877–1901.
  7. Zirui Cheng, Jikai Sun, Anjun Gao, Yueyang Quan, Zhuqing Liu, Xiaohua Hu, and Minghong Fang. 2025. Secure retrieval-augmented generation against poisoning attacks. arXiv preprint arXiv:2510.25025. — [arXiv:2510.25025](https://arxiv.org/abs/2510.25025) find
  8. Wei-Lin Chiang, Zhuohan Li, Ziqing Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, and 1 others. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna.lmsys. org (accessed 14 April 2023), 2(3):6. ↗
  9. Sukmin Cho, Jeongyeon Seo, Soyeong Jeong, and Jong C Park. 2023. Improving zero-shot reader by reducing distractions from irrelevant documents in open-domain question answering. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 3145–3157. find
  10. Google. 2024. Generative ai in search: Let google do the searching for you. https://blog.google/products/search/ generative-ai-google-search-may-2024/. ↗
  11. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security,…
  12. Wassily Hoeffding. 1963. Probability inequalities for sums of bounded random variables. Journal of the American statistical association, 58(301):13–30. find
  13. Gautier Izacard, Mathilde Caron, Lucas Hosseini, Sebastian Riedel, Piotr Bojanowski, Armand Joulin, and Edouard Grave. 2021. Unsupervised dense information retrieval with contrastive learning. arXiv preprint arXiv:2112.09118.
  14. Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, and 1 others. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825. find
  15. Ruochen Jiao, Shaoyuan Xie, Justin Yue, Takami Sato, Lixu Wang, Yixuan Wang, Qi Alfred Chen, and Qi Zhu. 2024. Exploring backdoor attacks against large language model-based decision making. arXiv preprint arXiv:2405.20774. — [arXiv:2405.20774](https://arxiv.org/abs/2405.20774) find
  16. Yang Jiao, Xiaodong Wang, and Kai Yang. 2025. Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization. arXiv preprint arXiv:2504.07717. — [arXiv:2504.07717](https://arxiv.org/abs/2504.07717) find
  17. Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of naacL-HLT, volume 1, page 2. Minneapolis, Minnesota.
  18. Aounon Kumar and Tom Goldstein. 2021. Center smoothing: Certified robustness for networks with structured outputs. Advances in Neural Information Processing Systems, 34:5560–5575. find
  19. Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, and 1 others. 2019. Natural questions: a benchmark for question answering research. Transactions of the Association for Computational Lin…
  20. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Processing Systems, 33:9459–…
  21. Microsoft. 2024. Bing chat. https://www.microsoft.com/en-us/edge/features/bing-chat. ↗
  22. Ofir Press, Muru Zhang, Sewon Min, Ludwig Schmidt, Noah A Smith, and Mike Lewis. 2023. Measuring and narrowing the compositionality gap in language models. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 5687–5711. rocky. 2024. A retrieval corruption attack. https://x… find
  23. Avital Shafran, Roei Schuster, and Vitaly Shmatikov. 2024. Machine against the rag: Jamming retrieval-augmented generation with blocker documents. arXiv preprint arXiv:2406.05870. — [arXiv:2406.05870](https://arxiv.org/abs/2406.05870) find
  24. Baolei Zhang, Yuxi Chen, Minghong Fang, Zhuqing Liu, Lihai Nie, Tong Li, and Zheli Liu. 2025a. Practical poisoning attacks against retrieval-augmented generation. arXiv preprint arXiv:2504.03957. — [arXiv:2504.03957](https://arxiv.org/abs/2504.03957) find
  25. Zhen Tan, Chengshuai Zhao, Raha Moraffah, Yifan Li, Song Wang, Jundong Li, Tianlong Chen, and Huan Liu. 2024. Glue pizza and eat rocks-exploiting vulnerabilities in retrieval-augmented generative models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages… find
  26. Baolei Zhang, Haoran Xin, Minghong Fang, Zhuqing Liu, Biao Yi, Tong Li, and Zheli Liu. 2025b. Traceback of poisoning attacks to retrieval-augmented generation. In Proceedings of the ACM on Web Conference 2025, pages 2085–2097. find
  27. Nandan Thakur, Nils Reimers, Andreas Rücklé, Abhishek Srivastava, and Iryna Gurevych. 2021. Beir: A heterogenous benchmark for zero-shot evaluation of information retrieval models. arXiv preprint arXiv:2104.08663.
  28. Fei Wang, Xingchen Wan, Ruoxi Sun, Jiefeng Chen, and Sercan Ö. Arık. 2025. Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models. Preprint, arXiv:2410.07176.
  29. Zhepei Wei, Wei-Lin Chen, and Yu Meng. 2024. Instructrag: Instructing retrieval-augmented generation with explicit denoising. arXiv preprint arXiv:2406.13629. — [arXiv:2406.13629](https://arxiv.org/abs/2406.13629) find
  30. Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. 2024. Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405.15556. find
  31. Lee Xiong, Chenyan Xiong, Ye Li, Kwok-Fung Tang, Jialin Liu, Paul Bennett, Junaid Ahmed, and Arnold Overwijk. 2020. Approximate nearest neighbor negative contrastive learning for dense text retrieval. arXiv preprint arXiv:2007.00808.
  32. Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083. — [arXiv:2406.00083](https://arxiv.org/abs/2406.00083) find
  33. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.
  34. Collin Zhang, Tingwei Zhang, and Vitaly Shmatikov. 2025c. Adversarial decoding: Generating readable documents for adversarial objectives. Preprint, arXiv:2410.02163.
  35. Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, and Zhenhao Li. 2025. Trustrag: Enhancing robustness and trustworthiness in rag. arXiv preprint arXiv:2501.00879. — [arXiv:2501.00879](https://arxiv.org/abs/2501.00879) find
  36. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. Poisonedrag: Knowledge corruption attacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/tan-2026-pra-rag-provably-robust-aggregation/