Abstract
Poisoning attacks on retrieval-augmented generation are rarely localized to a single passage. They are recurring campaigns whose evidence is structured across time, yet most existing defenses inspect one query in isolation and discard whatever they learned before the next query arrives. We recast the problem as longitudinal stream mining over a RAG pipeline's evolving sources, chunks, motifs, and lineage. Our framework, LTM-RAG , maintains four trust memories (source, chunk, motif, and lineage) under decayed Beta pseudo-counts with asymmetric aging, bounded lineage propagation, and verifier-aware evidence attenuation, updated prequentially so that feedback from window t governs only subsequent retrievals. We pair this longitudinal gate with a source-normalized top-K aggregator and recommend their Hybrid as the deployment configuration: mining handles recurring evidence, and query-local aggregation handles first exposure. On a 36-window prequential benchmark across five attack schedules, the Hybrid drops answer-level attack success rate (AnsASR) from 94.8% to 14.0% on the burst persistent-source scenario (5 seeds; BM25 fixed-gate recurrence stack with delayed known attribution). A separately logged live-judge diagnostic reports lower AnsASR for LTM-RAG and Hybrid than for Vanilla within that protocol (n ≥ 1200 per row). Controlled experiments characterize component effects and temporal behavior under the stated protocols, and report time-to-distrust, clean utility, and subgroup false-reputation damage, with trust regret defined and bounded for the controlled loss. The scope is deliberately bounded. The framework does not cleanse first-exposure poison or defeat white-box optimization, and an attacker who simultaneously breaks motif, lineage, and verifier-feedback assumptions can neutralize the gate. Keywords: Retrieval-augmented generation, Data poisoning, Streaming data mining, Trust memory, Provenance, Temporal drift, Adversarial robustness