In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning

• URL: http://arxiv.org/abs/2609.09243v1
• Date: Tue, 08 Sep 2026 08:31:57 GMT
• Title: In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Document Poisoning
• Abstract summary: We study how much a small quantized model, Llama 3.1 8B, degrades when a fraction of its retrieved context is poisoned.<n> Accuracy falls from 77.9% on clean context to 43.5% when all three passages are corrupted.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Retrieval-augmented generation (RAG) grounds a language model in retrieved documents, which reduces hallucination but creates a new attack surface: if retrieved text is tampered with, the model may repeat the falsehood. We study how much a small quantized model, Llama 3.1 8B, degrades when a fraction of its retrieved context is poisoned. Three corruption strategies are tested, entity swap, number swap, and negation, each applied to zero, one, two, or three of the three retrieved passages, over a factorial sweep of 588 runs on a fact-checking task built from FEVER. Accuracy falls from 77.9% on clean context to 43.5% when all three passages are corrupted. Entity swap flips the largest share of answers that were correct on clean context. Number-based corruption stays flat while poisoned passages are a minority and jumps once they form a majority, a pattern we re-check with query-level bootstrap intervals. The model rarely invents new falsehoods; its dominant reaction is to abstain, and a lexical overlap proxy of unsupported generation falls under attack rather than rising. The study is a small-scale measurement with coarse automated labels; we treat the strategy contrasts as suggestive until decoding is controlled and stronger adjudication is in place.

Related papers

• SynthSentry: Detecting Synthetic Data Contamination in Language Model Training Data [2.998247765202193]
  We introduce a corpus-level, model-agnostic contamination signal requiring no access to the generating model, no generation history, and no synthetic labels.<n>We evaluate on corpora contaminated by small open-weight generators and an instruction-tuned open-weight model under a leave-one-generator-out protocol.<n>The score ranks corpora by severity with little loss when whole generator families are held out.
  arXiv  Detail & Related papers  (2026-09-11T02:25:18Z)
• When Auditors Fabricate: Batch-Size Degradation and Confident Hallucination in LLM Detection of Planted Document Contamination [0.0]
  We construct a contaminated corpus of 150 academic papers spanning supply chain management and medical research.<n>We inject 450 known contaminants of three types: typographical corruption, semantic reversal, and absurd out-of-context insertion.<n>We evaluate Google Gemini 3.0 Pro's ability to recover a 180-contaminant answer-key subset across 60 documents.
  arXiv  Detail & Related papers  (2026-09-09T04:29:45Z)
• Noēsis: Deterministic-First Retrieval with Two-Tier Context Hydration for Factuality-Critical Queries on Small Local Models [0.0]
  We present Noesis, the deterministic-first query plane of the Noesis architecture.<n>Noesis makes every deterministic judgment before generation.<n>Every reported value is traceable to its exact source and position by construction.
  arXiv  Detail & Related papers  (2026-09-07T15:49:16Z)
• TRIS: A Tri-Layer Retrieval Integrity Sieve Against Knowledge Poisoning [6.613886785198943]
  Tri-Layer Sieve sanitizes retrieved evidence through cross-embedding-space clustering.<n>It exploits a key weakness of retrieval-stage poisoning: a single document must satisfy one embedding geometry, one internal Trigger-Payload structure, and one generation objective.
  arXiv  Detail & Related papers  (2026-08-31T23:21:27Z)
• TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation [1.5474833458331865]
  Retrieval-Augmented Generation lets a large language model answer questions using documents retrieved from an external knowledge base at query time.<n>If the knowledge base accepts writes from more than one party, an attacker needs only a handful of adversarial documents to steer the model toward a chosen wrong answer.<n>PoisonedRAG demonstrated this: as few as five crafted documents flip an undefended system's answer roughly 90% of the time.
  arXiv  Detail & Related papers  (2026-07-26T20:52:23Z)
• Abliteration Is Not a Scalpel: Off-Target Effects of Refusal Removal on Decision Disposition Across Model Families [51.56484100374058]
  Abliteration - deleting a model's refusal direction from its weights - is the standard recipe behind popular "uncensored" open-weight models.<n>As a disposition probe we use 21,600 decisions under uncertainty, replayed through a frozen pipeline so the decision-layer model is the only variable.<n>Three effects replicate across both families (weeks-clustered CIs excluding zero)<n>A fourth effect reverses sign: the same operation makes Gemma-abliterated less confident and Qwen-abliterated more (family CIs non-overlapping)
  arXiv  Detail & Related papers  (2026-07-19T22:27:00Z)
• A measurement substrate for agentic Kubernetes operations: Methodology and a case study in retrieval-compounding falsification [0.0]
  Empirical claims about autonomous operations agents are largely unfalsifiable.<n>Code agents have a verification substrate that turns "did it work" into a fast, falsifiable, groundtruth signal.<n>We present agent-breakage, a closed-loop measurement framework that injects faults into a target cluster.
  arXiv  Detail & Related papers  (2026-05-21T21:47:52Z)
• The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems [1.0262304700896199]
  We formalize emphSemantic Norm Drift (SND) as a third path to agent misconduct.<n>In SND, a policy-formatted document enters a shared vector store through normal uploads and later reappears as trusted system context.<n>Counterfactual Composition Testing identifies the causal entry with 87.5% accuracy and zero false positives.
  arXiv  Detail & Related papers  (2026-05-12T20:21:47Z)
• BURN: Backdoor Unlearning via Adversarial Boundary Analysis [73.14147934175604]
  Backdoor unlearning aims to remove backdoor-related information while preserving the model's original functionality.<n>We propose Backdoor Unlearning via adversaRial bouNdary analysis (BURN), a novel defense framework that integrates false correlation decoupling, progressive data refinement, and model purification.
  arXiv  Detail & Related papers  (2025-07-14T17:13:06Z)
• Turning Logic Against Itself : Probing Model Defenses Through Contrastive Questions [50.40122190627256]
  We introduce POATE, a novel jailbreak technique that harnesses contrastive reasoning to provoke unethical responses.<n>PoATE crafts semantically opposing intents and integrates them with adversarial templates, steering models toward harmful outputs with remarkable subtlety.<n>To counter this, we propose Intent-Aware CoT and Reverse Thinking CoT, which decompose queries to detect malicious intent and reason in reverse to evaluate and reject harmful responses.
  arXiv  Detail & Related papers  (2025-01-03T15:40:03Z)
• Verifying the Robustness of Automatic Credibility Assessment [50.55687778699995]
  We show that meaning-preserving changes in input text can mislead the models. We also introduce BODEGA: a benchmark for testing both victim models and attack methods on misinformation detection tasks. Our experimental results show that modern large language models are often more vulnerable to attacks than previous, smaller solutions.
  arXiv  Detail & Related papers  (2023-03-14T16:11:47Z)
• A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarks [72.7373468905418]
  We develop an open-source toolkit OpenBackdoor to foster the implementations and evaluations of textual backdoor learning. We also propose CUBE, a simple yet strong clustering-based defense baseline.
  arXiv  Detail & Related papers  (2022-06-17T02:29:23Z)
• Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Models [86.02610674750345]
  Adversarial GLUE (AdvGLUE) is a new multi-task benchmark to explore and evaluate the vulnerabilities of modern large-scale language models under various types of adversarial attacks. We apply 14 adversarial attack methods to GLUE tasks to construct AdvGLUE, which is further validated by humans for reliable annotations. All the language models and robust training methods we tested perform poorly on AdvGLUE, with scores lagging far behind the benign accuracy.
  arXiv  Detail & Related papers  (2021-11-04T12:59:55Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.