Retrieval-augmented generation (RAG) has been shown vulnerable to retrieval corruption attacks: an attacker can inject malicious passages into retrieval results to induce inaccurate responses. In this paper, we propose RobustRAG as the first defense framework against retrieval corruption attacks. The key insight of RobustRAG is an isolate-then-aggregate strategy: we get LLM responses from each passage in isolation and then securely aggregate these isolated responses. To instantiate RobustRAG, we design keyword-based and decoding-based algorithms for securely aggregating unstructured text responses. Notably, RobustRAG can achieve certifiable robustness: we can formally prove and certify that, for certain queries, RobustRAG can always return accurate responses, even when the attacker has full knowledge of our defense and can arbitrarily inject a small number of malicious passages. We evaluate RobustRAG on open-domain QA and long-form text generation datasets and demonstrate its effectiveness and generalizability across various tasks and datasets.

在本文中，我们提出了RobustRAG作为对抗检索污染攻击的第一个防御框架，通过采用独立后聚合策略，我们设计了基于关键词和解码的算法，以安全地聚合非结构化文本响应，并证明了RobustRAG在某些查询上能始终返回准确的响应，即使攻击者对我们的防御有完全了解并能随意注入少量恶意段落。我们在开放域问题回答和长文本生成数据集上评估了RobustRAG，展示了其在各种任务和数据集上的有效性和泛化能力。

可证明鲁棒检索错误的RAG模型