MIRAGE: manipulation-immune RAG with adaptive guard against textual evidence attacks

Abstract

Abstract Retrieval-augmented generation (RAG) substantially improves large language models (LLMs) on knowledge-intensive tasks by incorporating external knowledge, yet open knowledge sources introduce prominent security risks. The SafeRAG benchmark identifies four novel textual evidence manipulation attacks, namely silver noise, inter-context conflict, soft advertisement, and White Denial-of-Service (White DoS), which bypass conventional defense components and threaten both the security and availability of RAG systems. Existing single-stage defenses fail to capture the implicit malicious characteristics of these attacks, while multi-stage frameworks are limited by fixed parameters, weak conflict resolution, and insufficient detection of implicit toxicity and availability threats. To address these limitations, we propose MIRAGE, a two-stage adaptive defense framework combining retrieval-side purification and generation-side resolution. The first stage applies attack-characteristic-aware dynamic K-means clustering and dynamic ROUGE-L threshold filtering to eliminate malicious documents. The second stage employs attack-adaptive knowledge integration rules alongside an enhanced self-evaluation mechanism that jointly verifies factual accuracy, implicit toxicity, and availability. Under the static, non-adaptive attack setting defined by SafeRAG, experiments on DeepSeek-v3.2 show that MIRAGE achieves average improvements of 20.9% in Attack Failure Rate (AFR), 11.5% in Retrieval Accuracy (RA), and 14.1% in F1(avg) over baselines across all four attack scenarios, providing effective technical support for the stable deployment of RAG systems in complex adversarial environments.