Defense method for retrieval enhancement generation system, electronic equipment and medium
By employing proactive compression aggregation and rationalized generation techniques, the accuracy and robustness of the RAG system under noisy data and malicious attacks have been addressed, resulting in more reliable answer generation and enhancing the system's security and interpretability.
Patent Information
- Application Number
- CN202511271765.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Priority Date
- 2025-06-20
- Filing Date
- 2025-09-08
- Publication Date
- 2026-01-09
AI Technical Summary
Existing Retrieval Augmentation (RAG) systems are insufficient in accuracy and robustness when dealing with noisy data and malicious attacks. They struggle to effectively distinguish between useful information and noise and are vulnerable to malicious attacks.
Employing proactive compression and aggregation techniques, along with rationalized generation, the system iteratively compresses documents, extracts keyword and paragraph importance scores, combines a large language model for secure decoding and aggregation, and constructs a basic principle learner for noise reduction, ensuring the interpretability and consistency of the generated answers.
The robustness and security of the RAG system under noisy data and malicious attack scenarios have been improved, and the generated answers are more accurate and reliable, reducing the impact of noise interference and malicious attacks.
Smart Images
Figure CN121301501A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application belongs to the field of natural language processing and machine learning security, and particularly relates to a defense method for a retrieval-augmented generation system, an electronic device and a medium. BACKGROUND
[0002] In recent years, with the rapid development of natural language processing (NLP) technology, retrieval-augmented generation (RAG) models have gradually become an important means to improve the quality and relevance of text generation. RAG models combine large language models with externally retrieved relevant knowledge to significantly improve the accuracy and timeliness of language generation tasks. However, RAG models still face many challenges in practical applications, especially in handling noisy data and responding to malicious attacks.
[0003] Firstly, the retrieved external information often contains a large amount of noise and irrelevant information, which will interfere with the generation process of the RAG model and reduce the accuracy and reliability of the generated content. To solve this problem, researchers are constantly exploring effective noise filtering methods to improve the robustness of RAG models. However, existing noise filtering methods are mostly based on simple heuristic rules or statistical features, which are difficult to accurately distinguish between useful information and noise, affecting the filtering effect.
[0004] Secondly, RAG models are also vulnerable to malicious attacks, such as injecting malicious retrieval results to induce the model to generate incorrect or inaccurate output. This retrieval corruption attack poses a serious threat to the security of RAG models. SUMMARY
[0005] In view of this, the present application provides a defense method for a retrieval-augmented generation system, an electronic device and a medium.
[0006] In a first aspect, the present application embodiment provides a defense method for a retrieval-augmented generation system, the method comprising the following steps:
[0007] In response to a question, the retrieval-augmented generation system outputs a number of documents, and compresses and aggregates all the documents;
[0008] In response to the question and the aggregated documents, a large language model outputs a denoising principle for the retrieval-augmented generation system; when the denoising principle meets a consistency evaluation, a basic principle learner is constructed, and the basic principle learner is subjected to rationalization generation learning according to the question and the denoising principle;
[0009] In the reasoning stage, the question and the compressed aggregated document are input into the trained basic principle learner, and a denoising principle is output; according to the question and the denoising principle, an answer with explainability and accuracy is generated by searching the enhanced generation system.
[0010] In a second aspect, an embodiment of the present application provides an electronic device, comprising a memory and a processor, the memory being coupled to the processor; wherein the memory is configured to store program data, and the processor is configured to execute the program data to implement the defense method for the retrieval enhancement generation system.
[0011] In a third aspect, an embodiment of the present application provides a computer readable storage medium having a computer program stored thereon, the program being executed by a processor to implement the defense method for the retrieval enhancement generation system.
[0012] In a fourth aspect, an embodiment of the present application provides a computer program product, comprising computer programs / instructions, which are executed by a processor to implement the defense method for the retrieval enhancement generation system.
[0013] Compared with the prior art, the present application has the following beneficial effects:
[0014] The present application provides a defense method for a retrieval enhancement generation system, which reduces the interference of noise data through an active compression strategy, and improves the explainability and reliability of model output by using rationalization generation technology, thereby enhancing the robustness and security of the retrieval enhancement generation system RAG in the scene of noise data and malicious attacks. This method not only solves the shortcomings of the existing retrieval enhancement generation system RAG in processing noise data, but also provides a new solution for the security protection of the retrieval enhancement generation system RAG. BRIEF DESCRIPTION OF DRAWINGS
[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.
[0016] Figure 1 A schematic diagram of a defense method for a retrieval enhancement generation system provided by an embodiment of the present application;
[0017] Figure 2 A schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION
[0018] With reference to the drawings and the embodiments of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts are within the scope of the present application.
[0019] It should be noted that the features in the following embodiments and implementation manners can be combined with each other without conflicts.
[0020] As shown in Figure 1 , the present application provides a defense method for a retrieval-augmented generation system based on active compression aggregation and rationalization generation, which comprises the following sub-steps:
[0021] Step S1, in response to a question, the retrieval-augmented generation system outputs a plurality of documents, and compresses and aggregates all the documents.
[0022] In this example, a novel compression framework is provided, which can actively compress documents until all necessary evidence required to answer the question is found. In order to compress a large amount of information from the documents, an iterative architecture is designed in this example, in which the context of compression is updated every generation. Specifically, the step S1 comprises:
[0023] Step S101, the process of compressing all the documents comprises:
[0024] Segmenting the documents output by the augmented generation system, the expression is as follows:
[0025] S t ={d (t-1)×j+1 ,d (t-1)×j+2 ,...,d (t-1)×j+j}
[0026] In the formula, S t represents the t-th segment composed of j documents, and j represents the pre-defined number of documents to be compressed each time;
[0027] Iteratively compressing each segment, the expression is as follows:
[0028] C t ,E t =π(q,S t ,C t-1 )
[0029] In the formula, q represents the question, C t and E t represent the context of the t-th step and the thought chain of the t-th step after compression respectively, and π(.) represents a compression function.
[0030] It is noted that during the compression process, the model actively integrates information relevant to the problem by jointly analyzing the previously compressed context and the newly provided segment. This approach ensures that only the most relevant information is retained at each step, resulting in a compact context. Since the output context is designed to hold information relevant to the query, it can serve as a consolidated memory of all iterations prior to the current step.
[0031] At step S102, the compressed document is subjected to a secure keyword aggregation and / or a secure decoding aggregation.
[0032] It is noted that the biggest challenge of aggregation is to design a secure text aggregation technique. First, unlike the classification task of predefining possible outputs, the text response of a large language model LLM can be highly unstructured. For example, given the query "What is the name of the highest mountain?", valid answers include "Mount Qomolangma Everest", "Sagarmatha Mount Everest", and "Qomolangma is the highest". Therefore, the present example needs to design a flexible aggregation technique to handle different forms of text. Second, although the adversarial influence has been isolated to a single response, a malicious response can still disrupt the (insecure) text aggregation process. Therefore, the present example needs to design a secure aggregation technique to formally analyze and prove the robustness in the worst case.
[0033] In particular, the step S102 includes:
[0034] The process of secure keyword aggregation includes:
[0035] extracting keywords from the output response of each independent large language model;
[0036] counting the extracted keywords, recording the frequency of occurrence of each keyword;
[0037] setting a threshold, retaining keywords with a frequency of occurrence greater than the threshold, thereby completing the secure keyword aggregation of the compressed document.
[0038] Note that for free-form text generation (e.g., open-domain QA), simple techniques like majority voting perform poorly because they cannot recognize texts like “Mount Qomolangma” and “Qomolangma” as the same answer. To tackle this challenge, we propose a keyword aggregation technique: we extract important keywords from each isolated LLM response, aggregate the keyword counts across different responses, and ask the same LLM to answer the query using the keywords with larger counts. This approach allows us to extract and aggregate information from unstructured text responses. Since an attacker can only increase a small keyword count, they cannot arbitrarily introduce malicious keywords to corrupt the final response.
[0039] The step S102B, the security decoding aggregation process includes:
[0040] Further, the keyword aggregation only requires LLM text responses, and thus is applicable to any LLM. If we have additional access to the next token probability distribution at the decoding stage, we can use a more fine-grained method, called secure decoding.
[0041] Specifically, the step S102B includes:
[0042] Calculate the importance score of each paragraph in the compressed document based on TF-IDF;
[0043] Sort the importance scores of each paragraph from high to low, and select the top K paragraphs;
[0044] Obtain the next token probability vector of each selected paragraph, and average all token probability vectors to obtain the average probability;
[0045] Perform next token prediction for each selected paragraph based on the average vector, and obtain the top two tokens t1, t2 with the highest average probabilities c1, c2;
[0046] If the probability difference c1-c2 is greater than a predefined threshold, it is considered that the prediction is reliable, and the first token t1 is selected as the next token t * ; otherwise, it is considered that the prediction is uncertain, and the token predicted without any retrieval is selected as the next token t * ;
[0047] Given the predicted token t * , it is appended to the response string r * , and the decoding is repeated until the maximum number of new tokens is reached to obtain the final response.
[0048] Step S103, set an evaluation coefficient E as a termination condition; the evaluation coefficient E is used to evaluate the input segment S of the t-th step t and the context C of the t-1-th step t-1 whether sufficient details are provided to answer the question;
[0049] When the provided context is sufficient to meet the evaluation coefficient E, the iteration is terminated, and the compression and aggregation of the document are completed.
[0050] It should be noted that the early termination by setting the evaluation coefficient E can prevent redundant contexts from entering the compressed context or distracting attention. Secondly, it avoids meaningless iterations, thereby greatly reducing the computational burden that may arise from iterative processing steps. Thirdly, it is dynamically adjusted according to the complexity of the question and the information density of the document. This flexibility enables our COMPACT framework to be both effective and efficient in a wide range of scenarios, from simple questions to more complex, multi-hop questions that require extensive context integration.
[0051] Step S2, in response to the question and the aggregated document, the large language model generates a system output denoising principle for retrieval enhancement; when the denoising principle meets the consistency evaluation, a basic principle learner is constructed, and the basic principle learner is rationally generated according to the question and the denoising principle.
[0052] Further, for a given QA pair <q i ,a i > and a set of retrieved documents This example suggests that an off-the-shelf LLM (as a basic principle generator) with denoising instructions to produce corresponding basic principles r i , useful documents are distinguished from noisy documents, and the context is explained how it leads to the basic truth answer a i . To ensure that the synthesized basic principles are consistent with the basic fact answers, we use a simple substring matching to evaluate their consistency. In five benchmarks, the consistency ratio of at least one relevant document containing the basic truth answer of the training sample is 98%, supporting the reliability of the synthesized basic principles as integrity checks. This allows this example to effectively increase the standard dataset T = {<q, a>} → T + = {<q, r>}, using self-synthesized denoising principles only by instructing the LM without any additional supervision.
[0053] Further, in this example, according to the question and the denoising principle (i.e., the basic principle enhanced dataset T +), a basic principle learner M is constructed, and the INSTRUCTRAG-ICL or INSTRUCTRAG-FT learning strategy is selected to perform rationalized generation learning on the basic principle learner M.
[0054] INSTRUCTRAG-ICL is a training-free INSTRUCTRAG instance, in which the model learns the denoising principle through context learning (ICL). For a given test question q and a set of retrieved documents D = {d1,..., d K}, we first randomly sample N demonstrations from the basic principle augmented training dataset, and then prompt the model to follow the examples and generate the basic principle r. In order to save memory and improve inference efficiency, this instance only displays the example question and its corresponding basic principle in such ICL demonstrations.
[0055] INSTRUCTRAG-FT is a trainable INSTRUCTRAG instance that learns the denoising principle through supervised fine-tuning (FT) with standard language modeling objectives. It maximizes the likelihood of the basic principle r based on the question q and the retrieved documents D.
[0056]
[0057] where θ is the model parameter. INSTRUCTRAG-FT uses the same data format for training and inference. It takes the retrieved documents as input, followed by the question, and outputs the denoising principle r.
[0058] Step S3, in the inference stage, input the question and the compressed and aggregated documents into the trained basic principle learner, and output the denoising principle; according to the question and the denoising principle, the retrieval augmented generation system generates an accurate answer with explainability.
[0059] Embodiment 1
[0060] With the rapid growth of medical data, how to effectively extract valuable information from a large amount of clinical literature and medical records has become an important research topic. Although existing retrieval augmented generation (RAG) systems have made progress in information retrieval and generation, the accuracy and robustness of the generated content still need to be improved when facing noisy data and malicious attacks. The present application provides a defense method for retrieval augmented generation system based on active compression aggregation and rationalized generation, to enhance the reliability and stability of the RAG system. The specific method includes the following steps:
[0061] Step S1, in response to a question, the retrieval augmented generation system outputs a number of documents, and compresses and aggregates all the documents.
[0062] Specifically, in this example, taking the medical RAG as an example of GPT mounting, in order to deal with potential malicious attacks and noise effects, the information will be refined. Specifically, the following sub-steps are included:
[0063] Step S101, compress all documents.
[0064] In the medical RAG system, when the user asks a question such as "What is the best treatment for high blood pressure?", the medical RAG system needs to retrieve relevant information from a huge database of medical literature. In order to solve the low efficiency problem of traditional RAG system in processing a large number of documents, the present application introduces a dynamic compression technology. This technology is based on the "hierarchical information processing" theory in cognitive psychology, which believes that human beings also abstract and extract key points layer by layer when processing information.
[0065] In this process, for example, when setting 5 documents related to high blood pressure to be processed each time, the medical RAG system will analyze these documents one by one and extract the most relevant information from them. This is based on the "information gain" principle in information theory, that is, as much useful information as possible should be extracted in each iteration. Specifically, C t and E t represent the compressed context and the evaluation of the t-th step. E t is used as part of the input for the next step. By comparing C t and E t , the most relevant document is found.
[0066] Context updating will be performed afterwards, in each iteration, the system will update the current accumulated context, only keeping the key information that helps answer the question.
[0067] Step S102, perform security keyword aggregation and / or security decoding aggregation on the compressed documents.
[0068] Step S102A, perform security keyword aggregation on the compressed documents.
[0069] Exemplarily, for the answer to an open-ended question such as "What is the best instruction method?", the present application adopts a security aggregation method based on keywords.
[0070] Keyword extraction: important keywords are extracted from each independent LLM response. For example, for synonyms, the system will identify that both words are describing the same thing. This process can be represented as:
[0071] K i = ExtractKeywords(R i )
[0072] where Ri is the i-th response, K i is R i From the extracted keyword set. This is based on Named Entity Recognition (NER) techniques in natural language processing, which can accurately locate key information in the text. Based on this, the present example will find the most relevant words from "methods" and "ways" and then extract relevant information. Then keyword counting will be performed, and the frequency of each keyword will be recorded.
[0073] Keyword filtering and integration: set a threshold, only those keywords whose count exceeds the threshold will be retained. This step can be represented as:
[0074] K filtered = {k ∈ K | c k > μ}
[0075] Where c k is the count value of keyword k. Assuming the threshold value μ = 5, the filtered keyword set is: {high blood pressure, control blood pressure, improve diet, antihypertensive drugs, hypertension treatment, drug treatment}.
[0076] Step S102B, the compressed document is securely decoded and aggregated.
[0077] For the case of generating longer text, the present application also proposes a method of secure decoding and aggregation. This method is suitable for scenarios where the next token probability distribution of the decoding stage can be accessed.
[0078] Identify useful paragraphs: by analyzing the content of each paragraph, determine which paragraphs contain useful information. This step uses text summarization techniques to extract core content from long documents.
[0079] Assuming the user's question is: "What is the best treatment for high blood pressure?" The medical RAG system retrieves several documents related to high blood pressure treatment from the medical literature database, containing A, B, C, D, E five paragraphs, and the importance score s i of each paragraph can be represented as:
[0080] s i = UsefulnessScore(P i )
[0081] Where P i is the content of the i-th paragraph. The importance score can be calculated by TF-IDF (Term Frequency-Inverse Document Frequency) and other techniques.
[0082] Assume that the importance score of paragraph A is 2, the importance score of paragraph B is 5, the importance score of paragraph C is 4, the importance score of paragraph D is 3, and the importance score of paragraph E is 1.
[0083] Decoding: Assume that at the decoding stage, the medical RAG system selects paragraph B, paragraph C, and paragraph D. The next token probability vectors for each paragraph are: Assume that at the t-th time step, the probabilities of the first two tokens predicted are p t (w t ) = 0.25 and p t (w t+1 ) = 0.2167. If the pre-defined threshold is 0.05, then:
[0084] Δ = p t (w t ) - pt(w t+1 ) = 0.25 - 0.2167 = 0.0333
[0085] Since Δ < τ, the prediction is considered uncertain, and the unretrieved predicted token w' is selected as the next token.
[0086] Robust prediction: The goal of robust prediction is to decide whether to select the current predicted token as part of the final answer by setting a probability difference threshold. This mechanism not only improves the accuracy of the answer but also reduces the impact of false information by controlling the propagation of uncertainty.
[0087] Step S103, set an evaluation coefficient E as a termination condition; the evaluation coefficient E is used to evaluate whether the input segment S t at the t-th step and the context C t-1 at the (t-1)-th step provide sufficient details to answer the question;
[0088] When the provided context is sufficient to meet the evaluation coefficient E, the iteration is terminated, and the compression and aggregation of the document are completed.
[0089] Step S2, in response to the question and the aggregated document, the large language model generates a system output denoising principle for retrieval enhancement; when the denoising principle meets the consistency evaluation, a basic principle learner is constructed, and the basic principle learner is rationally generated and learned according to the question and the denoising principle.
[0090] For example, suppose a user asks, "What is the best treatment for hypertension?" The medical RAG system retrieves several documents related to hypertension treatment from a medical literature database, and these documents have already undergone dynamic compression and secure aggregation. Now, the medical RAG system needs to generate the final answer using denoising instructions, consistency assessment, and automatic generation principles.
[0091] The process of evaluating the consistency of the denoising principle includes: assuming whether the basic principle generated by the existing language model contains the following key points: "improving dietary habits (such as reducing sodium intake)" and "moderate exercise (such as regular walks)". Then, through simple substring matching, the medical RAG system confirms that the generated basic principle contains all the necessary information and is consistent with the known factual answers.
[0092] Step S3: In the reasoning phase, the question and the compressed and aggregated document are input into the trained basic principle learner, and the denoising principle is output. Based on the question and the denoising principle, the enhanced generation system is retrieved to generate an interpretable and accurate answer.
[0093] In summary, this invention provides a defensive method for retrieval augmentation (RAG) systems. It reduces interference from noisy data through proactive compression strategies and enhances the interpretability and credibility of model output using rationalization generation techniques, thereby improving the robustness and security of RAG systems under noisy data and malicious attack scenarios. This method not only addresses the shortcomings of existing RAG systems in handling noisy data but also provides a new solution for the security protection of RAG systems.
[0094] Accordingly, this application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; and, when the one or more programs are executed by the one or more processors, causing the one or more processors to implement the defense method for a retrieval-enhanced generation system as described above. Figure 2 The diagram shown is a hardware structure diagram of any device with data processing capabilities for the defense method of the retrieval enhancement generation system provided in the embodiments of the present invention, except for... Figure 2 In addition to the processor, memory, and network interface shown, any data processing device in the embodiment may also include other hardware depending on the actual function of the data processing device, which will not be described in detail here.
[0095] Correspondingly, the application further provides a computer readable storage medium, which stores computer instructions, and the instructions are executed by a processor to implement the defense method for the search enhancement oriented generation system. The computer readable storage medium can be an internal storage unit of any device with data processing capability, such as a hard disk or a memory. The computer readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. Further, the computer readable storage medium can include both the internal storage unit of any device with data processing capability and the external storage device. The computer readable storage medium is used to store the computer program and other programs and data required by the device with data processing capability, and can also be used to temporarily store data that has been output or will be output.
[0096] The above embodiments are only used to illustrate the design ideas and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the present application and implement it, and the protection scope of the present application is not limited to the above embodiments. Therefore, any equivalent changes or modifications made according to the disclosed principles and design ideas of the present application are within the protection scope of the present application.
Claims
1. A defense method for retrieval enhancement generation systems, characterized in that, The method includes the following steps: In response to the question, the retrieval enhancement system outputs several documents, and all documents are compressed and aggregated; In response to the question and the aggregated documents, the large language model outputs the denoising principle to the retrieval enhancement generation system. When the denoising principle meets the consistency evaluation, a basic principle learner is constructed, and rational generative learning is performed on the basic principle learner according to the question and the denoising principle. During the reasoning phase, the question and the compressed and aggregated document are input into a trained fundamental principle learner, which outputs the denoising principle. Based on the question and the denoising principle, the enhanced generation system generates an interpretable and accurate answer.
2. The defense method for a retrieval enhancement generation system according to claim 1, characterized in that, The process of compressing all documents includes: The document output by the enhanced generation system is segmented using the following expression: S t ={d (t-1)×j+1 ,d (t-1)×j+2 ,...,d (t-1)×j+j } In the formula, S t Let t represent the t-th segment composed of j documents, where j represents the number of predefined documents to be compressed in each iteration; Iteratively compress each segment, as shown in the following expression: C t ,E t =π(q,S t ,C t-1 ) In the formula, q represents the problem, and C t and E t Let represent the context of step t after compression and the thought chain of step t, respectively, and π(.) represent the compression function.
3. The defense method for a retrieval enhancement generation system according to claim 1, characterized in that, The process of aggregating compressed documents includes: Perform secure keyword aggregation and / or secure decoding aggregation on the compressed document.
4. A defense method for a retrieval enhancement generation system according to claim 3, characterized in that, The process of aggregating security keywords in compressed documents includes: Extract keywords from the output response of each individual large language model; Count the extracted keywords and record the frequency of each keyword. Set a threshold to retain keywords that appear more frequently than the threshold, thereby completing the safe keyword aggregation of the compressed document.
5. A defense method for a retrieval enhancement generation system according to claim 3, characterized in that, The process of securely decoding and aggregating compressed documents includes: Calculate the importance score of each paragraph in the compressed document based on TF-IDF; Sort each paragraph by importance score from highest to lowest, and select the top K paragraphs in the ranking; Obtain the next token probability vector for each selected paragraph, and average all token probability vectors to obtain the average probability; Based on the average vector, predict the next token for each selected paragraph and obtain the first two tokens t1, t2 with the highest average probability c1, c2. If the probability difference c1-c2 is greater than a predefined threshold, the prediction is considered reliable, and the first token t1 is selected as the next token t. * Conversely, if the prediction is not certain, then the token t is chosen as the next token t, provided that no prediction has been retrieved. * ; Given the predicted token t * append it to the response string r * The decoding process is repeated until the maximum number of new tokens is reached to obtain the final response.
6. A defense method for a retrieval-enhanced generation system according to claim 1, characterized in that, The process of compressing and aggregating all documents also includes: The evaluation coefficient E is set as the termination condition; the evaluation coefficient E is used to evaluate the input segment S at step t. t and the context C of step t-1 t-1 Did you provide enough details to answer the question? The iteration terminates when the provided context is sufficient to satisfy the evaluation coefficient E, completing the document compression and aggregation.
7. A defense method for a retrieval-enhanced generation system according to claim 1, characterized in that, The process of rationalizing and generating learning based on the problem and the denoising principle includes: Based on the problem and the denoising principle, INSTRUCTRAG-ICL or INSTRUCTRAG-FT learning strategies are selected to conduct rational generative learning of the learners of the basic principles.
8. An electronic device comprising a memory and a processor, characterized in that, The memory is coupled to the processor; wherein the memory is used to store program data, and the processor is used to execute the program data to implement the defense method for a retrieval-enhanced generation system as described in any one of claims 1-7.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the defense method for a retrieval-enhanced generation system as described in any one of claims 1-7.
10. A computer program product comprising a computer program / instructions, characterized in that, When executed by a processor, the computer program / instruction implements the defense method for a retrieval-enhanced generation system as described in any one of claims 1-7.