跳转至

文章背景与核心概要

随着大语言模型（LLM）在网络安全领域的广泛应用，检索增强生成（RAG）框架通过从向量知识库中提取相关的历史流量数据，使大语言模型能够有效地对网络流进行分类并生成清晰、易读的事件报告。然而，这种检索阶段也使系统面临知识投毒（Knowledge Poisoning）和提示词注入攻击（Prompt-Injection Attacks）的严重威胁。

为了保障这些系统的安全性，本文作者推出了 RAG-IDS，这是一个三层的多智能体入侵检测框架，具备专门的检索边界防御机制。该防御机制集成了软信任评分、标签嵌入一致性检查（LECC，被认为是整体鲁棒性的主要贡献者）以及提示词净化技术。实验结果表明，该系统在知识投毒和提示词注入防御方面表现出极高的韧性与极低的性能开销，为构建具备可解释性且抗攻击的入侵检测基础奠定了坚实基础。

Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection

arXiv: 2608.08100 [cs.CR]
Submitted: August 8, 2026
Authors: Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon, Sk. Md. Mizanur Rahman, Atsuo Inomata
Comments: 14 pages with Appendix, 11 figures. Submitted to IEEE CIC 2026, Research Track (double-blind review).

arXiv: 2608.08100 [cs.CR]
Submitted: August 8, 2026
Authors: Kaysarul Anas Apurba, Md. Hasibul Hasan, Mahedee Zaman Moon, Sk. Md. Mizanur Rahman, Atsuo Inomata
Comments: 14 pages with Appendix, 11 figures. Submitted to IEEE CIC 2026, Research Track (double-blind review).

📋 Summary

Retrieval-Augmented Generation (RAG) frameworks empower Large Language Models (LLMs) to effectively classify network flows and generate clear, human-readable incident reports by pulling relevant historical traffic data from a vector knowledge base. However, this retrieval phase leaves the system exposed to knowledge poisoning and prompt-injection attacks.

To secure these systems, the authors introduce RAG-IDS, a three-tier multi-agent intrusion detection framework featuring a specialized retrieval-boundary defense. This defense mechanism integrates: * Soft trust scoring (outperforming traditional hard filtering), * Label-embedding consistency checking (LECC) (identified as the primary contributor to overall robustness), and * Prompt sanitization.

Key Results:

  • Knowledge Poisoning Resilience: Experiments on the CIC-UNSW-NB15 dataset show classification quality recovery relative to clean, undefended performance scaling from \(R = 1.0\) at 1% poisoning down to \(R = 0.57\) at 30% poisoning, with negligible performance overhead on clean data.
  • Prompt Injection Mitigation: Multi-document retrieval successfully limits label-flip success rates to just 0.6%–2.4%, a massive improvement over the 35%–55% success rate seen in single-document retrieval.

Ultimately, RAG-IDS offers an explainable, attack-resilient foundation for intrusion detection that is well-suited for hybrid deployment alongside high-throughput classifiers.

📋 Summary

Retrieval-Augmented Generation (RAG) frameworks empower Large Language Models (LLMs) to effectively classify network flows and generate clear, human-readable incident reports by pulling relevant historical traffic data from a vector knowledge base. However, this retrieval phase leaves the system exposed to knowledge poisoning and prompt-injection attacks.

To secure these systems, the authors introduce RAG-IDS, a three-tier multi-agent intrusion detection framework featuring a specialized retrieval-boundary defense. This defense mechanism integrates: * Soft trust scoring (outperforming traditional hard filtering), * Label-embedding consistency checking (LECC) (identified as the primary contributor to overall robustness), and * Prompt sanitization.

Key Results:

  • Knowledge Poisoning Resilience: Experiments on the CIC-UNSW-NB15 dataset show classification quality recovery relative to clean, undefended performance scaling from \(R = 1.0\) at 1% poisoning down to \(R = 0.57\) at 30% poisoning, with negligible performance overhead on clean data.
  • Prompt Injection Mitigation: Multi-document retrieval successfully limits label-flip success rates to just 0.6%–2.4%, a massive improvement over the 35%–55% success rate seen in single-document retrieval.

Ultimately, RAG-IDS offers an explainable, attack-resilient foundation for intrusion detection that is well-suited for hybrid deployment alongside high-throughput classifiers.

license icon

license icon