Research on Detection of Geographic Information Poisoning Attacks in RAG Systems

This study focuses on the problem of geographic information poisoning attacks faced by large language model RAG systems and explores technical solutions for detecting false geographic content. The research covers the threat model of geographic information poisoning attacks, multi-dimensional detection technical paths, technical challenges and countermeasures, as well as the construction of a multi-layer collaborative defense system, aiming to ensure the accuracy and security of geographic information in RAG systems and related AI applications.

Retrieval-Augmented Generation (RAG) technology has become an important architecture for large language model applications, enhancing the model's answer capability by retrieving relevant information from external knowledge bases. However, this architecture introduces new security risks—malicious content in the knowledge base may enter the generation results through the retrieval link, forming a 'poisoning attack'. As a type of knowledge with clear spatial attributes, geographic information is particularly vulnerable to poisoning attacks.

Geographic information poisoning attack refers to the act of attackers injecting false or misleading geographic-related content into the RAG system's knowledge base, affecting the model's answers to questions about geographic locations, administrative divisions, geographic features, etc. Its harms include:

• Misleading Decision-Making: Decisions in key scenarios such as logistics, navigation, and emergency response may be erroneous due to incorrect geographic information
• Difficult to Detect: Geographic information errors are often more concealed than obviously false information
• Chain Effects: A single geographic error may trigger systemic biases in related reasoning

Knowledge Verification Mechanism

For the verifiable characteristics of geographic information, a multi-source cross-validation mechanism is established to compare with authoritative geographic databases (such as OpenStreetMap and official administrative division data) to identify abnormal geographic claims, covering dimensions such as place names, coordinates, and boundary relations.

Semantic Consistency Analysis

Using the semantic understanding ability of large language models, detect the internal consistency of geographic descriptions in text, such as checking whether the place description matches the climate zone or cultural region, and verifying whether the relationship between geographic entities conforms to common sense (e.g., adjacent cities cannot be hundreds of kilometers apart).

Source Credibility Evaluation

Establish a source tracing mechanism for knowledge fragments, and conduct credibility rating for information sources: geographic information from authoritative governments and academic institutions gets higher trust; information from unknown or low-credibility channels needs additional review.

Dynamic Geographic Information

Dynamic changes such as administrative division adjustments and place name changes make the timeliness of geographic knowledge a challenge. It is necessary to distinguish between 'outdated information' and 'malicious poisoning' to avoid misjudging normal knowledge updates as attacks.

Multilingual Geographic Entities

The same geographic entity has different names in different languages, and attackers may use this difference to confuse. The detection system needs to have cross-language geographic entity recognition capabilities.

Adversarial Poisoning

Advanced attackers may modify key geographic parameters (such as slight coordinate offsets). Subtle changes are difficult to detect through simple rules, so it is necessary to combine statistical anomaly detection and deep semantic analysis to deal with them.

Effective defense against geographic information poisoning requires collaboration of multi-layer mechanisms:

1. Preprocessing Layer: Conduct source verification and content screening before knowledge is stored in the database
2. Retrieval Layer: Introduce credibility weighting during retrieval, and prioritize returning high-credibility sources
3. Generation Layer: Add fact-checking prompts when generating answers to let the model actively verify geographic claims
4. Post-processing Layer: Extract and verify geographic information from the final output

The research on geographic information poisoning detection is not only related to the security of RAG systems but also has reference value for the security of broader AI applications. As large models are deeply applied in fields such as map services, logistics planning, and emergency response, ensuring the accuracy of geographic information will become an important part of the credibility of AI systems.