Research · curated 15 Jul 2026
When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse | Proceedings of the 49th International ACM SIGIR Conference on Research and Development in Information Retrieval
First reported acm.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
D-SCAN offers defenders an internal-state detection signal for RAG poisoning that works where perplexity- and consistency-based methods fail, addressing a growing attack surface in retrieval-augmented LLM deployments.
A SIGIR 2026 paper introduces D-SCAN (Document-level Signal Collapse Analysis), a lightweight detection framework that identifies RAG poisoning attacks by monitoring 'Attention Collapse' — a drop in attention entropy as the generator concentrates on injected adversarial documents. The authors show that output-side signals like perplexity fail because poisoned outputs can exhibit false confidence with even lower perplexity than benign ones, and that D-SCAN detects attacks even when they do not alter the final answer. Code is available at github.com/yingtaoren/D-Scan.