Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon, Sk. Md. Mizanur Rahman, Atsuo Inomata
cs.CR, cs.AI, cs.LG
Submitted: 2026-08-08
Updated: 2026-08-11
Comments: 14 pages with Appnedix, 11 figures. Submitted to IEEE CIC 2026, Research Track (double-blind review)
License: http://creativecommons.org/licenses/by/4.0/
The gist: Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a
Terminology
Abstract
Retrieval-Augmented Generation (RAG) enables large language models to classify network flows and generate human-readable incident reports by retrieving semantically similar historical traffic from a vector knowledge base. However, the retrieval layer introduces vulnerabilities to knowledge poisoning and prompt-injection attacks. We present RAG-IDS, a three-tier multi-agent intrusion detection framework with a retrieval-boundary defense combining soft trust scoring, label-embedding consistency checking (LECC), and prompt sanitization, designed to recover classification quality under retrieval-layer attack. Experiments on CIC-UNSW-NB15 show recovery relative to clean undefended performance ranging from R=1.0 at 1% poisoning to R=0.57 at 30%, with negligible clean-performance overhead. Under prompt injection, multi-document retrieval limits label-flip success to 0.6-2.4%, compared with 35-55% for single-document retrieval. Ablation results show that LECC is the primary contributor to robustness, while soft trust-based demotion outperforms hard filtering. The defended RAG pipeline offers an explainable, attack-resilient foundation for intrusion detection, well suited for hybrid deployment alongside high-throughput classifiers.
Sources
- C-Pack: Packed Resources For General Chinese Embeddings
- MA-IDS: Multi-Agent RAG Framework for IoT Network Intrusion Detection with an Experience Library
- FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflection
- Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models
- Retrieval-Augmented Generation for Large Language Models: A Survey
- Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation
- Practical Poisoning Attacks against Retrieval-Augmented Generation
- Defending Against Knowledge Poisoning Attacks During Retrieval-Augmented Generation
- CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills