Decision Models as Retrieval Gates Against Injection and Pollution: what it means for business leaders

A released 4-billion-parameter decision model screening retrieved web pages cuts prompt-injection success from 13.6% to 5.7% when added to standard sanitisation, and keeps polluted search pools usable, at about a tenth of an LLM judge's cost.

1. What the method is

The paper tests whether off-the-shelf, open-weight decision models can act as a gate between the retriever and the generator in a retrieval-augmented generation (RAG) pipeline. A decision model answers typed questions about a text by returning a score for each of a fixed set of answers, without generating tokens. Each retrieved passage, read as its raw HTML, is asked three questions in one pass: does it instruct an AI, is it filler or engineered to mislead, and is it relevant to the query. A high score on either of the first two drops the passage. A middle instruction score keeps it, but the whole answer must then cite every sentence. The best gate, Kev-4B, is used as released with no fine-tuning. Added on top of the published sanitisation, it cuts injection success to 5.7% and takes 76 ms per passage.

2. Why the method was developed

Any system that answers from retrieved web text reads content its operators did not write. Some of that content is aimed at the model: instructions hidden in HTML or written in plain sight, and synthetic pages written to rank well and mislead. Guo and Wei showed that stripping hidden elements, Unicode normalisation and citation prompting cut injection success sharply. Yu et al. showed that AI-written pages crowd real ones out of retrieval. Both called for a filter between retriever and generator, but neither built one. The published mitigations also leave gaps. They remove hidden hiding places but do nothing against an instruction addressed to the AI in visible text, look-alike letters or code blocks. Normalisation even repairs zero-width obfuscation for the attacker, raising that carrier's success from 1 to 35 of 109 pages. Large LLM judges detect attacks well, but they are slow, costly, and sometimes repeat the injected text themselves.

3. Who should care

Teams building RAG products, search assistants or web-browsing agents should care most, because this is a drop-in component with a measured price. Security and platform engineering get a tunable control: a threshold that trades attacks blocked against legitimate pages wrongly dropped, which they can set by the false-positive rate the product can tolerate. ML engineering owns the decision of where the gate sits, and the paper shows that placement matters as much as the model. Product owners should note that the quality of answers to clean queries did not measurably drop. Infrastructure and finance leads get a cost comparison: about $0.015 per thousand passages on one GPU, against about $0.15 for a strong LLM judge. Buyers of third-party RAG or agent platforms can turn this into a procurement question: what screens retrieved content before the model sees it, and at which point in the pipeline?

4. How the method works

A decision model takes a text and questions with fixed answer sets and returns a score per answer from a single forward pass, so three questions cost one call. The gate reads up to 8,000 characters of the page's HTML or of the plain-text chunk the retriever indexed. Q1 asks whether the passage instructs an AI, Q2 whether it is filler or engineered to mislead, and Q3 whether it is relevant. Q3 is computed but held back for future re-ranking. In the headline configuration, a passage whose instruction or pollution score reaches 0.5 is dropped. An instruction score between 0.35 and that threshold switches the generator to a prompt that demands a citation for every sentence. Against polluted pools the gate can sit in two places: after ranking, removing documents from the top ten, or before ranking, screening the whole candidate pool so that the top ten refills with clean documents.

5. How it was evaluated

There were two testbeds. Corpus A rebuilds Guo and Wei's design, whose data was not released, from public Reddit question threads. It has 1,000 queries, each with an attack page and an otherwise identical control page. The instruction sits in one of nine hiding places, among them visible text, hidden spans, off-screen CSS, alt text, ARIA labels, zero-width characters, look-alike letters and code blocks. It is one of five kinds whose success can be checked automatically. The corpus adds 4,000 unrelated pages, 300 benign pages with instructions for humans, and 1,000 poison pages. Llama-3.3-70B rewrote the payloads, including as an attacker shown the gate's scores. BM25 retrieves the top five passages, and Llama-3.1-8B generates (70B in some runs). Corpus B uses 200 MS MARCO queries, each with ten real passages and 20 generated clickbait documents. Baselines are the published mitigations, TF-IDF, a perplexity filter, three other decision models and three LLM judges.

6. How it performed

With the 8B generator, attack success is 27.9% undefended, 13.6% with the published mitigations and 5.7% with Kev added (95% CI 4.3 to 7.2). Kev wrongly drops 4 of 186 retrieved benign pages, and responsiveness on clean queries is 86.2% against 85.6%. Kev separates attacks at AUROC 0.94 on HTML and 0.87 on plain text. LLM judges reach 0.99 to 1.00 but cost ten times more, and used as a drop gate the 70B judge wrongly drops 18.3% of benign pages. An attacker optimising against the gate reached only 3.5%. With two thirds of the pool fake, accuracy falls from 84% to 28% without a gate. Screening the whole pool restores 83% with 0.5% fake exposure, while filtering only the top ten leaves 23%. The authors' limits: templated benign pages, a forum-only corpus, no attacks with the gate's weights, missing ablations. Our call: pilot it behind our sanitiser on pipelines that retrieve open-web content. (Source: arXiv 2611.08325, 2026)