Research · curated 11 Aug 2026
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
D-SCAN offers defenders an internal-attention-based detection method for RAG poisoning that works even when perplexity and consistency checks fail, addressing a growing attack surface in retrieval-augmented LLM systems.
Researchers from University of Technology Sydney and collaborators present D-SCAN (Document-level Signal Collapse Analysis), a lightweight framework that detects RAG poisoning attacks by monitoring an internal signature they call 'Attention Collapse'—where a generator's attention entropy decreases and concentrates on injected adversarial documents. The paper shows that output-side signals like perplexity fail because poisoned outputs can exhibit lower perplexity (false confidence), and that D-SCAN can detect attacks even when they do not alter the final answer, with code released on GitHub.