PoisonVax: Protecting Trusted Facts in RAG Through Dual-View Records

Corpus poisoning can steer retrieval-augmented generation (RAG) toward attacker-chosen answers by displacing trusted evidence or overriding it during generation. Existing defenses mainly filter suspicious passages or aggregate responses from retrieved evidence, but they cannot ensure that trusted facts reach the generator and prevail over competing claims. We introduce PoisonVax, a maintainer-led defense that reinforces trusted facts during corpus construction to improve both retrieval exposure and answer adoption. Each fact is stored as a dual-view record: an index view with an optimized retrieval key serves the retriever, while a generation view with a directive supports the trusted answer. The retriever scores only the index view, while a fixed field mapping supplies the generation view after retrieval. This separation keeps generation directives out of retrieval optimization while leaving the retriever, generator, and scoring rule unchanged. Records are constructed without access to evaluation questions. Under five injected attack passages per fact, with the same trusted facts available to all methods, PoisonVax achieves 58.46% answer accuracy and substantially outperforms TrustRAG and RobustRAG while using one online generation call. Matched experiments further show a 30.09 percentage point gain over a fully reoptimized single text baseline after removing attractor spans.