Overview

This chapter tests three retrieval-stage defenses for RAG indirect injection: query paraphrasing, perplexity filtering, and token masking. In the reported experiments, paraphrasing initially reduced Recall@5 by less than 10% for most datasets but adaptive optimization restored performance; repetition lowered perplexity while preserving attack effectiveness; and random masking weakened as triggers grew or were dispersed. These results challenge the named static strategies as standalone guarantees, not all defenses. A stronger design assigns controls to different boundaries: govern corpus provenance, measure top-K exposure, segregate context, validate outputs and groundedness, limit tools with least privilege, and require approval for high-risk actions. Trade-offs include recall, latency, engineering effort, and agent autonomy. Fine-tuning, hybrid retrieval, and reranking are outside the main evaluation.

Learning outcomes

Query paraphrasing, perplexity filtering, and token masking disrupt tested trigger representations but do not provide durable standalone guarantees against adaptation.
A stronger RAG design assigns provenance, retrieval, context, output, tool, and approval controls to the boundaries they can actually influence.
Security controls involve trade-offs: filtering can reduce recall, approval adds latency, and least privilege can reduce agent autonomy.

Keywords

RAGParaphrasingPerplexityMaskingProvenanceLeast privilege

Why Simple Filters Do Not Secure Retrieval

The retrieval-based LLM is now known to have two linked exposure points: an external item must first reach context, and the model or application must then allow that item to influence an answer or action. This chapter diagnoses why three intuitive retrieval-stage defenses—query paraphrasing, perplexity filtering, and token masking—do not provide a durable guarantee against an adaptive attacker. It then maps a stronger response across the corpus, context, model, and action boundaries so a retrieval failure is detected or contained rather than handed directly to the model’s authority.

The diagnosis matters because a defense can appear effective while testing only a fixed version of the threat. If a transformation makes one trigger less similar, or a detector identifies one unusually unnatural document, the result may look like prevention. But an attacker who can observe the retrieval outcome can change the item to fit the new condition. The relevant question is not whether a control works against one sample. It is whether the control changes the system’s security properties or merely changes the surface that the attacker optimizes.

Why the obvious detectors break

Query paraphrasing is an attractive first response. If a user’s query is rewritten before retrieval, a trigger tuned to the original wording may no longer align with the text the retriever sees. The application can perform the rewrite without changing the user experience, and the approach does not require access to the attacker’s construction process. As a static disruption, it is sensible: it changes one input to the ranking contest.

The paper’s results show why that disruption is limited. Paraphrasing causes a small initial degradation—less than a 10% drop in Recall@5 for most of the evaluated datasets. But the attacker can optimize against several possible paraphrases rather than one exact query. Once the trigger is selected for the distribution of rewritten queries, retrieval performance is restored and can even exceed the original baseline. The defense changed the wording, not the underlying fact that the retriever still ranks by a manipulable similarity signal.

This does not make paraphrasing useless. It may reduce the success of a trigger that was built for one unchanging query, and it can be useful for ordinary retrieval quality or robustness testing. It does mean the result must be described as friction or a narrow signal, not as prevention. A control that depends on the attacker not adapting is fragile by design when the attacker can query, observe, and repeat.

Perplexity filtering relies on a different intuition. Perplexity is a measure related to how surprising a sequence of words is to a language model. Artificially assembled malicious text may look statistically unusual, so a system can flag documents with high perplexity before sending them to the retriever or the LLM. In the initial comparison, the paper confirms that the malicious text has higher perplexity than clean content.

The problem is that the signal belongs to the initial presentation, not necessarily to the underlying objective. The study reports that repeating the malicious text can lower its perplexity while preserving attack effectiveness. In some cases, repetition drives the score below that of the clean documents, making the item appear more natural to the detector.

Published by DeepMox

FAQ

Why can query paraphrasing fail against adaptive triggers?

Query paraphrasing can fail because an attacker can optimize a trigger for several possible rewritten queries; in the study, the initial Recall@5 drop was under 10% for most datasets and later performance recovered.

What does perplexity filtering miss in poisoned RAG content?

Perplexity filtering can miss poisoned content because repetition may lower the score while preserving attack effectiveness, and natural language can still carry unauthorized instructions.

Why are layered controls stronger than a single RAG filter?

Layered controls are stronger because provenance, retrieval tests, context segregation, output validation, least privilege, and human approval address different transitions rather than one trigger representation.

Previous12 minRAG Agents: When Context Becomes Action

Next10 minRAG Security Design: Before the Model Acts

RAG Defense: Why Simple Filters Fall Short

Why Simple Filters Do Not Secure Retrieval

Why the obvious detectors break

FAQ