Adversarial Distilled Retrieval-Augmented Guarding Model for Online Malicious Intent Detection

2025/09/18 by Yihao Guo, Guo, Yihao, Hongyuan Bian +32
Computer Science · #Advanced Graph Neural Networks #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Spam and Phishing Detection

paper · pdf · doi:10.48550/arxiv.2509.14622

openalex publication_date 2025/09/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

With the deployment of Large Language Models (LLMs) in interactive applications, online malicious intent detection has become increasingly critical. However, existing approaches fall short of handling diverse and complex user queries in real time. To address these challenges, we introduce ADRAG (Adversarial Distilled Retrieval-Augmented Guard), a two-stage framework for robust and efficient online malicious intent detection. In the training stage, a high-capacity teacher model is trained on adversarially perturbed, retrieval-augmented inputs to learn robust decision boundaries over diverse and complex user queries. In the inference stage, a distillation scheduler transfers the teacher's knowledge into a compact student model, with a continually updated knowledge base collected online. At deployment, the compact student model leverages top-K similar safety exemplars retrieved from the online-updated knowledge base to enable both online and real-time malicious query detection. Evaluations across ten safety benchmarks demonstrate that ADRAG, with a 149M-parameter model, achieves 98.5% of WildGuard-7B's performance, surpasses GPT-4 by 3.3% and Llama-Guard-3-8B by 9.5% on out-of-distribution detection, while simultaneously delivering up to 5.6x lower latency at 300 queries per second (QPS) in real-time applications.

Citations

• RAR: Setting Knowledge Tripwires for Retrieval Augmented Rejection
• RAG LLMs are Not Safer: A Safety Analysis of Retrieval-Augmented Generation for Large Language Models
• PolyGuard: A Multilingual Safety Moderation Tool for 17 Languages
• BingoGuard: LLM Content Moderation Tools with Risk Levels
• Jasper and Stella: distillation of SOTA embedding models
• Deliberative Alignment: Reasoning Enables Safer Language Models
• A Comparative Study of Clinical ModernBERT and BioMedical ModernBERT on the DDXPlus Dataset
• STAND-Guard: A Small Task-Adaptive Content Moderation Model
• Class-RAG: Real-Time Content Moderation with Retrieval Augmented Generation
• JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework
• HarmAug: Effective Data Augmentation for Knowledge Distillation of Safety Guard Models
• Debiasing Text Safety Classifiers through a Fairness-Aware Ensemble
• The Llama 3 Herd of Models
• ShieldGemma: Generative AI Content Moderation Based on Gemma
• Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMs
• WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models
• WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning
• Rule By Example: Harnessing Logical Rules for Explainable Hate Speech Detection
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• Unveiling Safety Vulnerabilities of Large Language Models
• Making Harmful Behaviors Unlearnable for Large Language Models
• Making Retrieval-Augmented Language Models Robust to Irrelevant Context
• Qwen Technical Report
• Efficient Memory Management for Large Language Model Serving with PagedAttention
• AgentBench: Evaluating LLMs as Agents
• Pythia: A Suite for Analyzing Large Language Models Across Training and Scaling
• GPT-4 Technical Report
• tasksource: A Dataset Harmonization Framework for Streamlined NLP Multi-Task Learning and Evaluation
• Affective Coherence Monitoring for Transformer-Based Language Models
• ProsocialDialog: A Prosocial Backbone for Conversational Agents
• ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and\n Implicit Hate Speech Detection
• Self-Knowledge Distillation with Progressive Refinement of Targets
• Knowledge Distillation: A Survey
• Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks
• MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformers
• PyTorch: An Imperative Style, High-Performance Deep Learning Library
• DistilBERT, a distilled version of BERT: smaller, faster, cheaper and lighter
• Ray: A Distributed Framework for Emerging AI Applications
• Proximal Policy Optimization Algorithms
• Deceiving Google's Perspective API Built for Detecting Toxic Comments
• Ex Machina: Personal Attacks Seen at Scale
• Distilling the Knowledge in a Neural Network

Related

• Adversarially Robust Detection of Harmful Online Content: A Computational Design Science Approach
• TrustRAG: Enhancing Robustness and Trustworthiness in Retrieval-Augmented Generation
• Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
• AIP: Subverting Retrieval-Augmented Generation via Adversarial Instructional Prompt
• CPA-RAG:Covert Poisoning Attacks on Retrieval-Augmented Generation in Large Language Models