RAG Shield
Edits around the pipeline
Someone writes to the vector store directly, or changes a chunk after it was indexed.
Signatures catch it: 125 of 125 tampered chunks were dropped in testing.
Provenance and poisoning detection for retrieval-augmented AI
Know where every retrieved chunk came from, and whether to trust it.
Your assistant trusts whatever sits in its index, and anyone who can edit a wiki page or ticket can put text there. RAG Shield signs every chunk at ingestion, isolates what each edit to a trusted page adds, and checks every chunk at retrieval, before your model sees it.
Open-source SDK · first release November 2026 · runs in your environment
Three ways poisoned content reaches your model
Low-trust sources
Uploads, scraped pages and shared drives carry text aimed at the model.
Trust tiers keep it from being served silently: 0 silent hits in testing.
A compromised trusted page
An approved wiki page is edited. Signing can't help, because the page really is from your wiki.
Delta scoring isolates the edit, and this is where we are focusing our research.
How it works
Sign at ingestion
Each chunk's hash and source metadata are signed with Ed25519 and kept in a provenance ledger, with key revocation.
Score what changed
When a page is re-ingested, RAG Shield compares it with the last signed version and scores only the new paragraphs or sentences, so a short payload isn't diluted by the legitimate page around it.
Detect
A local injection classifier and an embedding-outlier model score content. Nothing leaves your network.
Filter at retrieval
Unverifiable chunks are dropped. Suspicious trusted content is served with a warning and queued for review, never silently deleted. A lockdown switch serves only clean, verified chunks during an incident.
What we have measured so far
| Measurement | Without RAG Shield | With RAG Shield |
|---|---|---|
| Retrieval quality on clean data (recall@5) | 0.553 | 0.553 (no loss) |
| Chunks edited directly in the vector store | served | 125 / 125 dropped |
| Low-trust poison served silently | 88 / 88 | 0 / 88 |
| Attacks in a compromised trusted page flagged | 11% (off-the-shelf classifier) | 42% at 6.5% false alarms (delta scoring) |
| Added latency per retrieval (CPU) | – | ≈ 6 ms |
A 35-document synthetic security corpus with 125 published attacks from Microsoft's BIPIA benchmark (MIT), inserted unchanged. One finding stands out: an off-the-shelf injection classifier separates attacks from ordinary security logs and incident reports barely better than chance (AUROC 0.54). A security-tuned classifier is in progress. Full methodology will be published with the SDK.
Become a design partner
We're working with a small number of teams that run RAG over content many people can edit: wikis, tickets, shared drives, vendor documents.
You get
- RAG Shield free during the pilot, running in your environment
- A guided provenance and poisoning review of your index, run in your environment so your data never leaves it (first 5 partners)
- Direct input into the roadmap and integrations
We ask for
- A 30-minute feedback call every two weeks
- Anonymized numbers: false alarms, added latency, setup time
Pricing
Open source
Free
- Python SDK: signing, delta scoring, trust filter
- Local detectors
- Runs entirely in your environment
Team
$800/month
- Review dashboard and queue
- Hosted scanning, up to 1M chunks
- Provenance reports for audits
Free for design partners during the pilot.
Enterprise
Custom
- SSO and audit export
- On-premises deployment
- Support and custom integrations
Questions
Does my data leave my network?
No. The SDK, the detectors and the provenance ledger run in your environment. The hosted dashboard stores chunk IDs, scores and provenance metadata, not text, unless you turn on previews.
Isn't a prompt-injection classifier enough?
On our security corpus, an off-the-shelf classifier separated attacks from normal logs and incident reports barely better than chance. Provenance, delta scoring and calibration on your own content are what make detection usable.
Will it delete legitimate content?
Never on a detector score alone for trusted sources. Suspicious trusted content is served with a warning and goes to a human review queue.
Which stacks are supported?
Python RAG pipelines. LangChain, LlamaIndex, ChromaDB and pgvector adapters are planned for the first release.