Researchers identified a vulnerability in retrieval-augmented generation systems in which adversarial document injection causes models to answer with false confidence while their attention mechanisms undergo what the authors term Attention Collapse. They developed D-SCAN, a lightweight detection framework that monitors document-level attention entropy and density during inference to flag poisoning attacks. Across three multi-hop QA benchmarks (HotpotQA, 2WikiMultihopQA, and MuSiQue), D-SCAN outperformed existing detection methods with AUC scores above 0.93, detecting attacks even when they failed to change the model’s final answer.
