{"id":"3c549076-4817-4779-b9e1-6943d83a97a1","arxiv_id":"2501.18365","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Fine-tuning an LLM with defect detection and utility extraction tasks makes it more robust to noisy, irrelevant, and counterfactual documents in retrieval-augmented generation.","lead":"This paper proposes RbFT, a fine-tuning method that trains an LLM to detect and ignore defective retrieved documents in retrieval-augmented generation. It reports large gains over inference-time robustness methods on three question-answering datasets while keeping inference speed unchanged, though the evaluation reuses the same synthetic defects used in training.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline gains are measured on the same synthetic defect process used in training; unless RbFT transfers to held-out defect types or retrievers, the 'diverse retrieval conditions' claim is not established.","rationale":"The reader's weakest assumption is the most load-bearing concern: the evaluation defect distribution is identical to the training defect distribution. I find no more fundamental internal flaw. The two-task fine-tuning protocol is clearly specified, the ablation in Table 2 supports a joint contribution of Defect Detection and Utility Extraction, and the inference-efficiency comparison in Table 3 is plausible. The paper also provides a code and data URL, which is real supporting evidence. The limitation is external validity: because the same retriever, the same corpus, the same defect-generation models, and the same tau values are used in training and evaluation, the large gains in Table 1 may be an artifact of distributional memorization rather than a robust learned capability. The proposed test, evaluating the released checkpoints on held-out defect types, retrievers, or counterfactual generators, would settle whether the concern lands. If the gains persist under those shifts, conditional acceptance is appropriate; if they collapse, the claim should be narrowed. Since the reader already judged this as a conditional acceptance with the same underlying caveat, I do not recommend changing the verdict.","tokens_in":16286,"tokens_out":3043,"duration_ms":31493,"concrete_test":"Run the same RbFT checkpoints on a held-out distribution shift. Concretely, regenerate the Hard setting test set with (i) a different retriever, e.g., BM25 or Contriever, used both for the top-5 lists and for noisy negative sampling, (ii) counterfactual documents generated by a different instruction-tuned model, e.g., Qwen2.5-3B-Instruct for RbFT models trained on Llama, and (iii) noisy documents sampled from ranks 6-50 instead of ranks >50. If RbFT's EM margin over AstuteRAG shrinks by more than about 20% relative to Table 1 under any of these shifts, then the matched-distribution interpretation is supported and the abstract's 'diverse retrieval conditions' claim must be qualified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 5.3 and Section 5.4 couple training and evaluation: noisy documents are sampled from ranks >50 of the same e5-base-v2 retrieval list, irrelevant documents from the same corpus, counterfactual documents are rewritten by Llama-3.2-3B-Instruct (the same base model being fine-tuned), and 'during the evaluation phase, the same tau values are used.' Therefore Table 1 and Figure 4 measure performance on the exact defect-construction process the model was trained on. The reported 72.4% EM improvement in Hard+Counterfactual could reflect LoRA weights learning the specific surface form and distribution of these synthetic rewrites, such as rewriting artifacts or the ghost of the correct answer, rather than a general ability to ignore defective evidence. Because the Defect Detection task exposes the model to labels for these exact corruptions, shortcut learning is plausible. The central claim of robustness 'across diverse retrieval conditions' extrapolates beyond the matched synthetic distribution without any held-out defect-type or retriever experiment. This is an external-validity risk rather than an internal inconsistency: the in-distribution numbers are credible, but they do not yet establish the advertised generality.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes RbFT, a LoRA-based fine-tuning method for RAG that trains a generation model on two auxiliary tasks: Defect Detection (classify each retrieved document as helpful, noisy, irrelevant, or counterfactual) and Utility Extraction (answer the query given defective documents). The method is evaluated on NQ, HotpotQA, and TriviaQA with three synthetic defect types injected under a replacement probability tau. Experiments report that RbFT outperforms Vanilla RAG and four inference-time robustness baselines (RobustRAG, CRAG, InstructRAG, AstuteRAG) in both EM and F1, and that it does so at essentially the same inference cost as Vanilla RAG.","tokens_in":16521,"tokens_out":8014,"duration_ms":71806,"significance":"If the reported results hold, the paper makes a useful practical contribution: a lightweight fine-tuning recipe that improves robustness to noisy, irrelevant, and counterfactual retrieved content while preserving in-distribution accuracy and introducing no extra inference overhead. The method is clearly specified, the code and data are promised to be released, and the in-distribution gains on the synthetic defect benchmark are large and consistent across two base models. The significance is conditional, however, on the synthetic defect process being representative: because the evaluation shares the training distribution of defect types and tau values, the current experiments do not establish the advertised generality to 'diverse retrieval conditions' or to real-world retrieval errors.","major_comments":[{"comment":"The central robustness claim is not supported by the current evaluation protocol. The training and evaluation use the same synthetic defect-generation pipeline: noisy documents are sampled from lower-ranked results of the same e5-base-v2 retrieval list, irrelevant documents are sampled from the same corpus, counterfactual documents are generated by Llama-3.2-3B-Instruct, and Section 5.4 states that 'during the evaluation phase, the same tau values are used.' As a result, the improvements in Table 1 and Figure 4 measure performance on the exact defect distribution the model was optimized for, rather than robustness to a range of retrieval conditions. To substantiate the abstract's claim of 'diverse retrieval conditions,' the authors need to evaluate on held-out defect types (e.g., adversarial perturbations, human-written or independently generated misinformation), on a different retriever (e.g., BM25 or a different dense retriever), and at tau values not seen in training.","section":"§5.3, §5.4"},{"comment":"The comparison with baselines is asymmetric and conflates method effect with fine-tuning. RbFT is fine-tuned on the target datasets and the synthetic defect distribution, whereas RobustRAG, CRAG, InstructRAG, and AstuteRAG are applied without any fine-tuning on these datasets. The reported improvement ratios (for example, 72.4% EM over the second-best method in the Hard+Counterfactual setting for Llama) therefore may reflect the general benefit of task-specific adaptation rather than the specific Defect Detection and Utility Extraction objectives. The authors should include a control model fine-tuned with the same LoRA hyperparameters and the same data but with a standard QA objective (the Vanilla+UE ablation is a partial control but is not compared against the inference-time baselines in Table 1), as well as, ideally, an existing RAG fine-tuning baseline such as RA-DIT.","section":"§5.2, Table 1"},{"comment":"For the Llama variant, counterfactual documents are generated by Llama-3.2-3B-Instruct, the same model that is subsequently fine-tuned. Since the Defect Detection task provides the model with labels for these exact generated rewrites, the model may learn to recognize the generator's stylistic or lexical fingerprints rather than a general ability to detect counterfactual content. The counterfactual results in Table 1 and Figure 4 should be re-verified with counterfactual documents generated by a different model (e.g., Qwen or GPT-4) or with human-written misinformation to exclude this shortcut.","section":"§5.3 (counterfactual generation)"}],"minor_comments":[{"comment":"The change-ratio notation in Table 2 is ambiguous: for example, Vanilla+DD reaches 49.7 EM with an '↑2.7%' label in the Clean setting, which is actually better than RbFT's 48.4 EM, yet the text describes single-task variants as weaker. Please clarify the sign convention and, where a single-task variant outperforms RbFT, discuss the implication for the two-task design.","section":"Table 2"},{"comment":"The six curves in each panel of Figure 4 are difficult to distinguish in grayscale; using distinct markers and line styles would make the figure readable in print.","section":"Figure 4"},{"comment":"The paper does not specify the exact prompting protocol used at evaluation time: it should state explicitly that the Utility Extraction prompt alone is used for generation and that the Defect Detection labels are used only as a training signal, or describe how the two heads are combined at inference.","section":"§4, §5.4"},{"comment":"The description of fine-tuning omits the data mixing ratio between the Defect Detection and Utility Extraction tasks, the maximum sequence length, and the number of training steps; adding these would make the training procedure fully reproducible from the text alone.","section":"§5.4"},{"comment":"The phrase 'RbFT is vertical to these methods' is nonstandard; it should be 'orthogonal to' or 'complementary to,' and the claim of compatibility would be stronger if backed by an explicit integration experiment or by a reference to existing evidence.","section":"§6.4"},{"comment":"There is a typo in the Figure 2 caption: 'Emperical' should be 'Empirical.'","section":"Figure 2 caption"}],"recommendation":"major_revision","confidential_remarks":"The evaluation protocol is the key weakness: in-distribution results are strong, but the matched train/eval defect distribution and the asymmetric baseline comparison leave the central generality claim unsubstantiated. The method is plausible, the writing is clear, and the promised code release is a positive sign. I would encourage the authors to add held-out defect types, a different retriever, and a fine-tuning control baseline; these additions are within the scope of a revision and would materially change the strength of the contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"RbFT is a clean, low-overhead fine-tuning recipe for making RAG models more robust to noisy, irrelevant, and counterfactual retrieved documents. The two-task design—defect detection plus utility extraction, trained jointly with LoRA—is new relative to the inference-time baselines, and the ablation shows both tasks contribute. Efficiency is a real win: inference stays roughly at Vanilla RAG latency. On the tested synthetic defects, the numbers are credible and consistent across two 3B models.\n\nThe soft spot is exactly what the stress test flags: the evaluation distribution is the training distribution. Section 5.3 generates the same three defect types with the same pipeline, including using the same base model for counterfactual rewriting, and Section 5.4 confirms that the same tau values are used in evaluation. Table 1 and Figure 4 therefore measure in-distribution fit, not generalization to \"diverse retrieval conditions.\" The abstract overclaims. A second problem, related, is that the comparison is asymmetric: RbFT is fine-tuned on the target datasets and defect distribution, while RobustRAG, CRAG, InstructRAG, and AstuteRAG are dropped in as inference-time methods with no fine-tuning. That makes the headline gains look larger than a fair comparison would.\n\nThese are external-validity concerns rather than fatal flaws. The method is clearly specified, the data generation is concrete, and the citation pattern looks solid—the related work covers the relevant baselines and positions itself correctly. What is missing is a held-out test: different defect types (or at least different generation models and tau values), a different retriever, ideally a different corpus. That is a day of experiments, not a redesign.\n\nI'd send this to review, but conditionally. The reviewers should demand the held-out experiments and a fairer baseline setup before publication. The core idea—training the LLM to assess and extract rather than to build a more expensive pipeline around it—is sensible and likely to be useful to the RAG robustness community.\n\nWho is this for? People working on practical RAG robustness and fine-tuning; it gives them a cheap, compatible alternative to inference-time frameworks. It is not a field-reorganizing result. But it is honest, citable work, and the flaw is addressable.","headline":"Useful two-task fine-tuning recipe for RAG robustness, but the headline gains are in-distribution; needs held-out defect tests before the generality claim holds.","tokens_in":17049,"tokens_out":2453,"would_cite":true,"duration_ms":23658,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that fine-tuning an LLM on two tasks—classifying each retrieved document as useful, noisy, irrelevant, or counterfactual, and answering correctly from defective contexts—makes RAG far more resilient to retrieval defects…","keywords":["retrieval-augmented generation","robust fine-tuning","retrieval defects","defect detection","utility extraction","low-rank adaptation","open-domain question answering","counterfactual documents"],"falsifier":"Take the same RbFT-fine-tuned models and evaluate them on defect types absent from training—character-level adversarial perturbations, documents poisoned by a different attack algorithm, or naturally imperfect retrievals from a different retriever and corpus—and compare exact-match accuracy against vanilla RAG. If the improvement over vanilla RAG shrinks to zero or reverses on these held-out defects, the central robustness claim is falsified.","tokens_in":16094,"feed_emoji":"🛡️","tokens_out":9688,"duration_ms":81604,"temperature":0.7,"pith_summary":"Retrieval-augmented generation inherits whatever defects the retriever and knowledge base have, and this paper argues that the root fix is to make the language model itself more skeptical and more resourceful. RbFT fine-tunes a 3B-parameter LLM on two tasks: Defects Detection, which labels each retrieved document as helpful, possibly relevant but unhelpful, irrelevant, or containing incorrect information, and Utility Extraction, which trains the model to produce the correct answer from defective retrieval lists. On Natural Questions, HotpotQA, and TriviaQA, LoRA-fine-tuned Llama-3.2-3B and Qwen2.5-3B models outperform prior robustness methods in every tested setting, with the largest margins when all retrieved documents are defective; exact-match gains over the second-best method reach 72.4% (Llama) and 64.1% (Qwen) on counterfactual defects. Because only weights change, per-query inference time stays essentially identical to vanilla RAG's, unlike multi-step robustness pipelines. If the result holds, retrieval-defect robustness can be bought with training data rather than with slower inference schemes.","feed_headline":"Two fine-tuning tasks keep RAG answers accurate when retrieval fails","feed_subtitle":"Works on 3B-parameter LLMs with zero extra inference cost, and even beats plain RAG on clean inputs.","key_machinery":"The engine of RbFT is a pair of fine-tuning tasks trained jointly with low-rank adaptation (LoRA), which updates a small set of parameters and keeps training efficient. Defects Detection uses a listwise prompt that forces the model to output one of four assessments for each document: it helps answer the question, it is possibly relevant but does not help, it is irrelevant, or it contains incorrect information. Utility Extraction keeps the standard answer-generation objective but feeds the model the defective document list, so the model learns to ignore or look past bad evidence and draw on the useful fraction or on its own parametric knowledge. Defective documents are injected at probability $\\tau \\in \\{0.2, 0.4, 0.6, 0.8, 1.0\\}$, with noisy documents sampled from below rank 50, irrelevant documents sampled from the full corpus, and counterfactual documents generated by having Llama-3.2-3B-Instruct produce a plausible wrong answer and then rewriting the passages around that wrong answer. What carries the argument is the combination of the two tasks: the detection labels tell the model which inputs to distrust, while the answer-generation task gives it practice succeeding despite them, and the ablation shows each task alone is weaker.","core_discovery":"The paper's central claim is that one fine-tuning recipe can make a RAG system substantially more robust to defective retrieved documents without sacrificing clean-set performance or inference speed. Concretely, RbFT uses the same corrupted document lists for both tasks: assess each document and then answer the question despite the bad context. The severity of defects is controlled by a replacement probability $\\tau$ over the top-5 retrieved list; the Hard setting is $\\tau = 1.0$, where every document is defective. Table 1 reports that under Hard counterfactual defects, RbFT reaches EM 33.8 (Llama) and 25.1 (Qwen) versus vanilla RAG's 9.0 and 8.9, and the relative improvement over the second-best method is 72.4% and 64.1%. The authors read the mechanism as teaching the model to judge input quality and to extract and synthesize only useful evidence; their attention case study shows smoother attention over documents after fine-tuning, with less focus on misleading tokens.","pith_inferences":["The evaluation uses only defects the authors synthesized, so whether RbFT teaches a general 'distrust and verify' policy or memorizes those corruption patterns is untested; a held-out evaluation with adversarial typos, poisoning attacks, or naturally occurring retrieval failures would resolve this.","The per-document assessments produced by Defects Detection could double as a free explanation or logging signal, or as training data for a separate reranker, but the paper does not propose or evaluate any such use.","The counterfactual generator is the same model family as one of the fine-tuned test models (Llama-3.2-3B-Instruct), so an open question is whether robustness persists against counterfactuals written by a different or stronger author; the paper does not test this.","The clean-setting gain over vanilla RAG suggests the retriever's top-5 already carries false positives, implying part of RbFT's effect is correcting ordinary retrieval noise rather than only extreme corruption; this could be checked by re-running the recipe with a stronger retriever and seeing whether the clean gain shrinks."],"forward_implications":["A 3B-parameter LLM can keep much of its accuracy even when the retriever returns zero useful documents; in the Hard+Mix condition RbFT scores EM 31.9 (Llama) and 24.0 (Qwen) while vanilla RAG scores 11.4 and 11.0.","Robustness does not have to cost latency: RbFT's inference time is 0.196 s per query for both models, essentially equal to vanilla RAG, compared with 1.207 s for RobustRAG and 3.417 s for AstuteRAG.","Because RbFT is a weight-only change, it can be stacked with inference-time defenses rather than replacing them, which the paper identifies as a route to further robustness.","A single model trained across multiple $\\tau$ values handles both mild and extreme defect rates, so a deployed system need not know the defect severity in advance."],"supporting_citations":[{"why":"Supplies the LoRA fine-tuning technique that keeps RbFT training efficient and preserves the base model's general capabilities.","marker":"[15]"},{"why":"One of the two base LLMs fine-tuned by RbFT and the generator of the misleading wrong answers used to build counterfactual documents.","marker":"[11]"},{"why":"The second base LLM fine-tuned by RbFT, showing the recipe transfers across model families.","marker":"[55]"},{"why":"Natural Questions is one of the three QA benchmarks whose training split supplies RbFT training data and whose test split is used for evaluation.","marker":"[23]"},{"why":"HotpotQA is the multi-hop QA benchmark that tests whether RbFT works beyond single-hop factoid questions.","marker":"[56]"},{"why":"TriviaQA is the third benchmark in the evaluation suite, providing additional open-domain QA queries and answers.","marker":"[21]"},{"why":"The e5-base-v2 dense retriever returns the top-100 documents from which both the original retrieval lists and the noisy and irrelevant defective documents are drawn.","marker":"[49]"},{"why":"RobustRAG is the isolate-then-aggregate baseline that RbFT must beat in both accuracy and inference speed.","marker":"[53]"},{"why":"CRAG is the corrective-RAG baseline with a retrieval evaluator; the paper disables its web-search module for a fair comparison.","marker":"[54]"},{"why":"AstuteRAG is the strongest iterative baseline in the effectiveness-robustness comparison, resolving knowledge conflicts between internal and retrieved knowledge.","marker":"[48]"}],"fun_headline_variants":["RbFT: fine-tuning that makes RAG robust to defective retrievals","One fine-tune recipe: beat noisy retrievals, keep clean-set accuracy","RbFT: robust RAG via two fine-tuning tasks, zero extra inference cost","Train LLMs to judge and ignore bad retrievals: RbFT","New fine-tuning improves RAG robustness against retrieval defects"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the synthetic defects used for training and evaluation—lower-ranked passages, random corpus passages, and passages rewritten around an LLM-generated wrong answer—are representative of the retrieval defects a real RAG system will meet, so the model learns a general defensive skill rather than memorizing those specific corruption patterns.","fun_headline_variants_meta":{"raw":{"variants":["RbFT: fine-tuning that makes RAG robust to defective retrievals","One fine-tune recipe: beat noisy retrievals, keep clean-set accuracy","RbFT: robust RAG via two fine-tuning tasks, zero extra inference cost","Train LLMs to judge and ignore bad retrievals: RbFT","New fine-tuning improves RAG robustness against retrieval defects"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000337,"raw_usage":{"total_tokens":1833,"prompt_tokens":885,"completion_tokens":948,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":501,"completion_tokens_details":{"reasoning_tokens":868}},"tokens_in":501,"tokens_out":948,"duration_ms":7995,"temperature":1.0,"reasoning_tokens":868,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T23:44:33.933750+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the same RbFT-fine-tuned models and evaluate them on defect types absent from training—character-level adversarial perturbations, documents poisoned by a different attack algorithm, or naturally imperfect retrievals from a different retriever and corpus—and compare exact-match accuracy against vanilla RAG. If the improvement over vanilla RAG shrinks to zero or reverses on these held-out defects, the central robustness claim is falsified.","supporting_citations":[],"review_version":1}