CRIF Multi-View: Counterfactual Retrieval Defense for Poison-Resilient Power-Domain RAG

Abstract

Power-domain large language models increasingly rely on retrieval-augmented generation (RAG) to access standards, maintenance records, and equipment knowledge. This external knowledge channel also introduces a security risk: a small number of retrieval-optimized documents can displace authentic evidence without modifying either the retriever or the generator. We propose CRIF Multi-View, an ingestion-time defense that measures a candidate's prospective effect on target, paraphrased, same-topic, and cross-topic probes before indexing. The resulting Counterfactual Retrieval Impact Fingerprint is fused with static content and provenance evidence and calibrated using a sourcedisjoint clean buffer. We evaluate sparse, dense, and hybrid retrieval on a controlled power-domain benchmark, including benign format shift, adaptive threshold-aware attacks, and ingestion-cost analysis. CRIF achieves zero observed fixed-pool ASR in all three retrieval spaces while preserving 90.2% TF-IDF and 91.3% hybrid targeted Recall@1. Under threshold-aware attacks, CRIF reduces ASR@1 from 97.5-100% for unprotected RAG to $16.7-63.0 {\%}$, while benign-format FQR remains between 2.7% and 10.0%. These results establish behavior-aware admission control as an effective and auditable defense layer for poisonresilient power-domain RAG.