D-SCAN Detects RAG Poisoning Through Attention Collapse
Yingtao Ren and five coauthors introduced D-SCAN, a proposed framework for detecting retrieval-augmented generation poisoning attacks, in a paper submitted to arXiv on August 7. The paper identifies "Attention Collapse," a pattern in which attention entropy declines as model attention concentrates on poisoned documents, and reports results across multiple attack benchmarks.
Yingtao Ren and five coauthors introduced D-SCAN (Document-level Signal Collapse Analysis), a proposed method for detecting document-poisoning attacks against retrieval-augmented generation systems. The paper was submitted to arXiv on August 7, and an ACM Digital Library record lists a July 19 publication date for a short-paper version.
RAG poisoning occurs when adversarial documents enter a retrieval corpus and influence a model's generated response. According to the paper's abstract, prior detection approaches commonly use output-side signals, including perplexity and consistency checks. The authors report that deliberate attacks can instead create "false confidence": poisoned outputs may have lower perplexity than benign outputs, rendering uncertainty-based detection ineffective.
Monitoring attention rather than output confidence
The proposed approach examines the generator's internal attention dynamics. The authors call the reported signature Attention Collapse. In their analysis, benign generations exhibit more dispersed attention, while attacked generations show declining attention entropy as attention becomes concentrated on poisoned documents.
D-SCAN monitors this document-level concentration pattern to flag potentially attacked generations. The authors report experiments on multiple attack benchmarks and state that the method can identify attacks even when the final answer is not changed. The available source material does not specify the benchmark names, model architectures, detection thresholds, false-positive rates, or inference overhead.
That distinction matters for security evaluation. A detector that only examines a final answer or its token probabilities may miss retrieval-layer manipulation that has not produced an observable answer change. Security evaluation of RAG pipelines can therefore treat retrieval, context assembly, and generation as separate attack surfaces rather than assuming output-quality metrics capture the full threat model.
Deployment constraints remain open
D-SCAN monitors attention dynamics during generation. The source material does not establish applicability to closed model APIs that do not expose attention tensors. Teams evaluating the technique would also need to assess whether its attention-concentration signal remains reliable across long contexts, multi-document retrieval, different transformer implementations, and benign cases where a single authoritative document legitimately dominates the response.
The authors state that code is available, although the retrieved arXiv record does not include the repository URL.
Key Points
- 1D-SCAN targets RAG poisoning by monitoring document-level attention concentration, rather than relying solely on generated-output perplexity or consistency signals.
- 2The authors report that poisoned generations can exhibit lower perplexity than benign outputs, creating false confidence for uncertainty-based detectors.
- 3Attention-level defenses may detect retrieval manipulation even when the final answer is unchanged, while comparable deployments require model-internal observability and calibration testing.
Scoring Rationale
The paper addresses a meaningful security weakness in RAG systems and proposes an internal-signal detector that could complement output-based safeguards. Its practical impact remains unverified in the retrieved material because benchmark details, overhead, and deployment compatibility are not provided.
Sources
Primary source and supporting public references used for this report.
Practice with real Telecom & ISP data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Telecom & ISP problems
