FlagThis

Abstract

Policy-Aware Large Language Model RetrievalAugmented Generation (PA-LLM-RAG) demonstrated that edgedeployed retrieval-augmented generation can ground LLM decisions in structured operational policies. However, the security of such frameworks under adversarial conditions remains unexplored. This paper presents a comprehensive adversarial evaluation of PA-LLM-RAG and introduces a novel attack along with an effective defense mechanism targeting the knowledge-base retrieval layer. We propose Query-Agnostic Semantic Retrieval Poisoning, which injects semantically crafted rules into the IoBT knowledge base that achieve high retrieval ranking across all operator query types without requiring knowledge of runtime prompts. The attack achieves 85% LLM context corruption from a single injected rule (1.6% poisoning rate) and saturates at 2.65 poisoned rules per LLM context at 7.7% poisoning, with effectiveness remaining constant across all evaluated poisoning rates up to 25%, demonstrating that even minimal knowledge base compromise is sufficient to corrupt mission decisions. Further, to counter this threat, we propose Cyber-Layered Defense for Knowledge Base (CLD-KB), a dual-detector anomaly detection framework combining One-Class SVM boundary detection with a novel Member-Based Category Spread analysis that exploits the three-category policy taxonomy (Workflow, Rules of Engagement, Capability) to identify the cross-category embedding signature unique to poisoned rules. CLD-KB significantly outperforms five baseline methods including DBSCAN, LOF, K- Means, Isolation Forest, and One-Class SVM in both poisoning detection and knowledge preservation. System evaluation across poisoning rates from 1.6% to 25% confirms 100% context integrity with only 7ms computational overhead per mission, establishing CLD-KB as an effective and edge-deployable defense for LLM-driven for Internet of Battlefield Things (IoBT) mission control.