Safe RAG by RAG: Untying the Bell That RAG Rang with the RAG Hand

Retrieval-augmented generation (RAG) is widely adopted for knowledge-intensive tasks, but unverified external knowledge can pose risks such as data injection and retrieval pollution, leading to unexpected generation. Existing defenses rely on patch-based fixes, which limit generalization and increase system latency. To address these issues, we propose RAG2RAG, the first framework-level security solution designed specifically for RAG. Inspired by human intuition to reason about "what can and cannot be said" during RAG phase, RAG2RAG augments the main RAG module with a lightweight security expert module composed of two components: (1) a Detective that dynamically retrieves supporting evidence, and (2) a Judge that makes final decisions based on retrieved context. The main and expert modules operate in parallel without causing noticeable delays. Experiments across two languages, 6 domains, and 7 types of poisoning attacks demonstrate that RAG2RAG consistently achieves higher accuracy and lower attack success rates than 7 mainstream baselines. Furthermore, it integrates seamlessly with various RAG architectures, offering generalizable and efficient protection across diverse threat scenarios.