Protecting proprietary RAG databases from unauthorized redistribution is challenging: existing watermarking methods either inject fabricated relations between real entities, polluting the knowledge base with misinformation, or embed fragile lexical patterns that adversarial paraphrasing easily removes. We propose SentinelRAG, a watermarking framework that embeds style-consistent but fictitious knowledge entries into the RAG database. Our key insight is that synthetic knowledge describing fictitious entities is unlikely to be retrieved by legitimate queries, yet can be reliably triggered through targeted probes known only to the data owner. Experiments on four datasets ranging from 2.9k to 8.8M documents demonstrate that SentinelRAG achieves statistically significant detection $p < 10^{-5}$ across all tested configurations at only a 0.1% injection rate. Compared to the state-of-the-art, our method significantly reduces the false detection rate while maintaining negligible interference with legitimate user queries.

翻译：保护专有RAG数据库免遭未经授权的再分发颇具挑战性：现有水印方法要么注入真实实体间的虚假关系，从而用错误信息污染知识库；要么嵌入脆弱的词汇模式，易被对抗性改写移除。我们提出SentinelRAG，一种将风格一致但虚构的知识条目嵌入RAG数据库的水印框架。其关键洞察在于：描述虚构实体的合成知识极不可能被合法查询检索到，却可通过仅数据所有者知晓的定向探针可靠触发。在包含2.9k至8.8M文档的四个数据集上的实验表明，SentinelRAG在仅0.1%的注入率下，所有测试配置均能达到统计显著性检测（$p < 10^{-5}$）。与现有最优方法相比，该方法在显著降低误检率的同时，对合法用户查询的干扰可忽略不计。