RAG poisoning can make a model more confident, which is exactly why confidence-based detectors can fail.

This paper finds malicious retrieved documents can increase token confidence and output consistency.

So uncertainty-based detectors can miss the attack because poisoning can create false confidence.

Under attack, attention becomes concentrated on poisoned documents instead of staying spread across the retrieved evidence.

The authors call this Attention Collapse.

So for RAG security, checking only the final answer or its confidence may miss the warning.

Monitoring how attention is distributed across retrieved documents could expose poisoning before the answer visibly breaks.

– arxiv. org/abs/2608.06947

Title: "When Context Bites: Detecting RAG Poisoning via Document-Level Attention Collapse"