PRA-RAG: Provably robust RAG aggregation cuts attack rate to 1%

PRA-RAG, a provably robust aggregation algorithm for retrieval-augmented generation, was posted to arXiv on 8 May 2026 as arXiv:2607.00012. The paper, authored by Xue Tan and nine others, proposes a sampling-and-geometry approach that the authors say reduces poisoning attack success to as low as 1% while maintaining an accuracy of 71% across multiple benchmarks and RAG architectures.

What is PRA-RAG and how does it work?

PRA-RAG is a retrieval aggregation algorithm that samples multiple combinations of retrieved texts, uses geometric structures in embedding space to find a robust subset, and derives a stable aggregated representation from that subset. The paper frames this as a defense against poisoning attacks on retrieved texts, and it provides theoretical bounds on the maximum impact that poisoned retrieved content can have on the aggregated representation.

The core mechanism, as described in the abstract, is twofold: random sampling of retrieval combinations to expose inconsistent or adversarial items, and geometric analysis in the embedding space to isolate a subset whose aggregated vector is stable. The authors present a quantitative measure of RAG robustness tied to provable bounds, rather than purely empirical heuristics.

How well does PRA-RAG defend against poisoning attacks?

In experiments across multiple benchmarks and RAG architectures, PRA-RAG reduced attack success rate to as low as 1% while maintaining an accuracy of 71%, outperforming representative state-of-the-art methods. The abstract emphasizes that existing defenses often lack theoretical robustness guarantees and can fail when the language model has limited knowledge of the retrieved content; PRA-RAG aims to address those shortcomings with both theory and experiments.

The paper reports two concrete performance figures: an attack success rate "as low as 1%" and an accuracy of "71%" for PRA-RAG in the evaluated setups. The authors argue these results show a significant improvement over representative baseline methods, and they supply provable bounds that quantify the maximum effect of poisoned retrieved items on the aggregated representation.

Why does this matter?

Retrieval-Augmented Generation improves language model outputs by supplying external knowledge, but that same retrieval channel can be a vector for poisoning attacks that steer model outputs. PRA-RAG matters because it pairs empirical reductions in attack success with theoretical bounds, offering a way to measure and limit how much corrupted retrievals can change the final aggregated representation. For systems that depend on external knowledge sources, provable limits on adversarial impact are a substantive addition to the toolset for safe deployment.

Beyond immediate defenses, the paper addresses a gap the authors identify: many prior methods lack formal robustness guarantees and can underperform when the base model lacks knowledge about retrieved passages. PRA-RAG's combination of sampling, embedding-space geometry, and formal bounds targets that specific weakness.

What to watch

The arXiv entry includes toggles and links for code, data and demos such as Hugging Face, Replicate, DagsHub and related services on the paper page, which are listed alongside the submission. Watch for the linked code and demonstrations to appear and for independent reproductions of the reported figures: the submission date on arXiv is 8 May 2026 and the paper identifier is arXiv:2607.00012. Subsequent peer review or community evaluations that confirm the 1% attack rate and 71% accuracy across varied real-world RAG deployments will be the clearest next milestones.

Authors and provenance: the paper lists Xue Tan, Yi Zheng, Chang Huo, Yunruo Zhang, Yu Liu, Hao Luan, Zhuyang Yu, Xiaoyan Sun, Ping Chen and Jun Dai as authors, and it was submitted to arXiv on 8 May 2026.