Abstract
Poisoning attacks on retrieval-augmented generation are rarely localized to a single passage. They are recurring campaigns whose evidence is structured across time, yet most existing defenses inspect one query in isolation and discard whatever they learned before the next query arrives. We recast the problem as longitudinal stream mining over a RAG pipeline's evolving sources, chunks, motifs, and lineage. Our framework, LTM-RAG, maintains four trust memories (one per axis) under decayed Beta posteriors, bounded lineage propagation, and verifier calibration, updated prequentially so that feedback from window t governs only subsequent retrievals. We pair this longitudinal gate with a top-K majority aggregator and recommend their hybrid as the deployment configuration: mining handles recurring evidence, and query-local aggregation handles first exposure. On a 36-window prequential benchmark across five attack schedules, the hybrid drops answer-level ASR from 94.8% to 14.0% on the burst persistent-source scenario (5 seeds, BM25 with a fixed gate). A live-judge dense pipeline (BGE + Gemini-2.5-flash-lite + gpt-4o-mini, n≥1200) reproduces the same ordering on the dense+LLM-judge protocol. Controlled-model results explain when each memory carries the load: a detection-delay separation under observable lineage, a hidden-lineage lower bound, and reports of time-to-distrust, time-to-recovery, trust regret, and subgroup false-reputation damage. The scope is deliberately bounded. The framework does not cleanse first-exposure poison or defeat white-box optimization, and an attacker who simultaneously breaks motif, lineage, and verifier-feedback assumptions can fully neutralize the gate. Keywords: Retrieval-augmented generation, Data poisoning, Streaming data mining, Trust memory, Provenance, Temporal drift, Adversarial robustness