Retrieval-augmented generation (RAG) increasingly underpins high-stakes applications, yet remains vulnerable to Confundo-style poisoning where adversarially optimized documents manipulate generated outputs. Existing defenses assume that detecting poisoned evidence prevents harm. We show this assumption is incorrect: models exhibit a monitoring-control gap -- they can detect contradictions in retrieved evidence yet still act on poisoned claims. We introduce the Cordon Principle -- no agent capable of final synthesis may access untrusted natural-language evidence -- and realize it through CORDON-MAS, a compartmentalized framework that enforces this principle architecturally by separating evidence extraction, cross-source audit, and answer synthesis into agents with asymmetric memory privileges. Across five BEIR datasets, CORDON-MAS reduces attack success rate by 92.4\% relative to undefended RAG. This reframes RAG poisoning from a detection problem to an information-flow control problem.
Cite
@article{arxiv.2605.26754,
title = {Cordon-MAS: Defending RAG against Knowledge Poisoning via Information-Flow Control},
author = {Zhe Yu and Wenpeng Xing and Gaolei Li and Shuguang Xiong and Hongzhi Wang and Xuyang Teng and Meng Han},
journal= {arXiv preprint arXiv:2605.26754},
year = {2026}
}