{"id":"071ba6b1-1ae1-4915-9078-dd004293ebe0","arxiv_id":"2509.03787","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Misleading health documents in RAG context sharply lower LLM accuracy, and heavily helpful-biased retrieval pools restore it.","lead":"This paper tests whether large language models give correct health answers when the documents fed into a retrieval-augmented system are harmful or deliberately misleading. It finds that misleading documents sharply lower accuracy, while a retrieval pool strongly dominated by helpful documents can keep the model on the correct side.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Abstract's rescue claim is only demonstrated for strongly helpful-biased pools; with one helpful among many adversarial passages, alignment remains far below baseline.","rationale":"The reader's verdict is CONDITIONAL with moderate confidence, and the rationale explicitly notes that the abstract 'overstates the helpful-evidence rescue effect, which is only demonstrated under a strongly helpful-biased 8:2 pool.' My concern is the same overstatement, so I agree with the reader's verdict and recommended softening. However, the reader's formal 'weakest_assumption' field names a different issue: that the Bigdeli et al. adversarial documents were not re-validated against the six LLMs tested here. I do not regard that as the most load-bearing concern, because the paper does measure the effect of those documents on the target LLMs in the single-document setup; even if the documents are not 'adversarial' in the ranking-attack sense, the observed degradation is a real empirical result. The pool-composition issue is more central because it targets the headline causal claim directly: 'presence of helpful evidence preserves robustness' is contradicted by the paper's own 1:1 paired-document and passage-based pooling results. The proposed test—an explicit ratio sweep—would cleanly determine whether the rescue effect requires helpful dominance, and would settle whether the abstract needs qualification. I therefore recommend keeping the reader's CONDITIONAL verdict rather than moving to accept or reject.","tokens_in":29803,"tokens_out":4272,"duration_ms":44406,"concrete_test":"Re-run the bias-controlled pooling setup on TREC 2021 with GPT-4.1 (and ideally one open-source model) using Liar and FSAP-IntraQ adversarial segment pools, varying the helpful:adversarial ratio across 1:9, 2:8, 4:6, 5:5, 6:4, and 8:2 while keeping the total pool at 10 segments. Plot ground-truth alignment against the helpful proportion. If alignment only approaches the non-RAG baseline at 8:2 (or 6:4), the abstract's 'when helpful evidence is also present' must be replaced with 'when helpful evidence dominates the retrieval pool.' If alignment is already near-baseline at 1:9, the current wording is supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract's central claim—'robustness can be preserved when helpful evidence is also present in the retrieval pool'—is not supported as stated. The near-perfect rescue effect is demonstrated only in the bias-controlled pooling setup (Section 3.3.4), which uses an 8:2 helpful-biased pool. The other pooling experiments contradict the unqualified claim. In the paired-document setup (Section 4.3.1), a single helpful document paired 1:1 with a Liar or FSAP-IntraQ document raises TREC 2021 alignment from ~1.7% to ~39–49%, still far below both the ~89% non-RAG baseline and the ~98% helpful-only rate. In the passage-based pooling setup (Section 4.3.2), adversarial passages constitute ~92–94% of the top-10 pool and alignment is 4.3–44% depending on query framing, even though helpful passages are present. Thus the qualitative conclusion should be that helpful evidence must dominate the pool, not merely be present. The concluding discussion's phrasing—'the inclusion of helpful evidence, even in the presence of adversarial or harmful content, can protect against misalignment'—inherits the same overgeneralization. This is an internal consistency issue between the headline claim and the reported results, not an external-validity disagreement, and it directly affects the actionable takeaway about retrieval safeguards.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper empirically evaluates RAG robustness in the health domain. Using TREC 2020 and TREC 2021 Health Misinformation Track collections alongside six types of adversarial documents from Bigdeli et al., it measures ground-truth alignment of six LLMs (GPT-4.1, GPT-5, Claude-3.5-Haiku, DeepSeek-R1-Distill-Qwen-32B, Phi-4, LLaMA-3 8B Instruct) under four retrieval-pool conditions: single-document, paired-document, passage-based pooling, and bias-controlled pooling. Queries are framed as consistent, neutral, or inconsistent relative to ground truth. The main findings are that helpful documents improve alignment relative to the Non-RAG baseline, harmful and adversarial documents degrade it, strong adversarial strategies such as Liar nearly eliminate alignment, and helpful-dominated pools restore near-perfect alignment. The paper also reports that COVID-19 queries (TREC 2020) are more robust than general health queries (TREC 2021), and that query framing consistently orders alignment as consistent > neutral > inconsistent. All experimental results are released on GitHub.","tokens_in":30093,"tokens_out":4558,"duration_ms":48856,"significance":"If the results hold, this is a useful empirical contribution: it provides the first systematic comparison of multiple adversarial document generation strategies against multiple LLM families in a high-stakes health domain. The study is well-designed in several respects: large per-condition sample sizes, bootstrap confidence intervals, explicit replication across model families and two datasets, and public release of responses and evaluation prompts. The paper does not introduce a new attack method, but the quantitative ranking of attack effectiveness (Rewriter/Paraphraser being milder than Fact-Inversion and FSAP, Liar being most damaging) and the demonstration that helpful-document dominance matters more than mere presence are actionable for retrieval-safeguard design. The central claims rest entirely on measured alignment rates, so the validity of the automated stance classifier and the representativeness of the imported adversarial documents are the key correctness risks.","major_comments":[{"comment":"The headline claim that 'robustness can be preserved when helpful evidence is also present in the retrieval pool' is only supported by the bias-controlled 8:2 helpful-dominant condition (§3.3.4). The other pooling experiments contradict the unqualified wording. In the paired-document setup (§4.3.1), a single helpful document paired with a Liar document raises TREC 2021 alignment from 1.7% to only 39.1–45.0%, far below the ~89% Non-RAG baseline and ~98% helpful-only rate. In passage-based pooling (§4.3.2), helpful passages are present (~5% of the pool) but alignment remains 4.3–43.7% depending on query framing. The conclusion should state that helpful evidence must dominate the pool, not merely be present. This is an internal-consistency issue between the abstract/conclusion and the reported results, and it changes the practical takeaway about retrieval safeguards.","section":"Abstract and §5"},{"comment":"All quantitative claims depend on automated stance classification by gemini-2.0-flash, validated only against gpt-4o-mini (Cohen's κ = 0.90 for TREC 2020, 0.82 for TREC 2021). No human-label validation is reported, and the Limitations section itself concedes that automated classifiers may miss subtle inaccuracies. Inter-model agreement does not rule out systematic bias; if the classifier is differentially sensitive to document style, adversarial tone, or response length, the reported alignment rates and the Liar-vs-Rewriter hierarchy could shift. I request a human-annotated spot-check stratified by document type and query framing, or an explicit error analysis, before the headline numbers are taken at face value.","section":"§3.4 and §6"},{"comment":"The six adversarial document types are imported from Bigdeli et al. [6] without re-validating their effectiveness for the six generation models studied here. The cited paper demonstrates ranking-based effectiveness; in this study the documents are supplied directly to the generator, so the generation-stage 'adversarialness' is assumed rather than verified. The measured degradation is internally consistent, but external validity as 'realistic misinformation' is not established. A concrete test would be to have health-information experts rate a sample of the adversarial documents for credibility and misleadingness, or to include naturally occurring misinformation passages, to confirm the attack-type hierarchy is not an artifact of these specific generated documents.","section":"§3.1.2"}],"minor_comments":[{"comment":"The hierarchy 'Liar≫ FSAP-IntraQ > FSAP-InterQ > ...' mixes the 'much greater' symbol with the ordinary chain '>'. Clarify whether Liar is intended to be categorically worse than the rest or simply the top of a total order.","section":"§4.2"},{"comment":"The x-axis labels 'Passage-Based', 'Harmful', 'Rewriter', 'Paraphraser', etc., are not self-explanatory in grayscale or print. Add a legend or axis key that clearly distinguishes the passage-based baseline from the biased-to-helpful and biased-to-harmful conditions.","section":"Figure 3"},{"comment":"The composition of biased pools is described for one attack type at a time. State explicitly whether the 8:2 helpful/harmful skew is applied per attack type or across all adversarial segments combined, and whether the two non-dominant slots are selected independently per query.","section":"§3.3.4"},{"comment":"Paired-document sampling is capped at ten pairs per query per condition. Report the distribution of sampled pairs after filtering and note whether any query had fewer than ten; unequal pair counts across queries can weight the aggregate alignment rate unevenly.","section":"§3.3.2"}],"recommendation":"major_revision","confidential_remarks":"The paper is within scope and the empirical core is sound; the main issue is calibrating the abstract and discussion to what the experiments actually show. The review concerns are addressable with text revision plus additional validation (human spot-check of the classifier and clearer reporting of pair-sampling). I would not reject."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know: this is the most thorough empirical measurement I've seen of how adversarial retrieved evidence degrades RAG answers in the health domain, and the core numbers are believable. But the abstract oversells the rescue effect. A helpful document in the pool does not reliably save you unless it dominates the pool. That is an internal inconsistency in the write-up, and it is fixable.\n\nWhat is genuinely new: the controlled evaluation across six adversarial document families, six LLMs (closed and open), three query framings, and multiple pooling setups, all grounded in TREC health misinformation collections with expert helpful/harmful labels. The headline results are stark and consistent: Liar documents collapse alignment to near zero across model families, helpful documents push it near the ceiling, and consistent > neutral > inconsistent query framing holds everywhere. The COVID-19 vs. general health robustness gap is a nice, non-obvious finding. Methodologically, the paper does things right: bootstrap confidence intervals, multiple model families, and a public repository with all responses and plots. That is real reproducible evidence.\n\nThe soft spots, in rough order of seriousness. First, the abstract's claim—\"robustness can be preserved when helpful evidence is also present\"—is not what the experiments show. In the paired-document setup (Section 4.3.1), one helpful document paired 1:1 with a Liar or FSAP-IntraQ document lifts alignment from ~1.7% to ~39–49%, still far below the ~89% non-RAG baseline. In the passage-based pooling setup (Section 4.3.2), helpful passages are present but adversarial passages make up ~92–94% of the top-10 pool, and alignment is 4–44%. The near-perfect rescue appears only in the 8:2 helpful-biased pool (Section 3.3.4). So the conclusion should say helpful evidence must dominate the pool, not merely be present. The concluding discussion repeats the same overgeneralization. This matters because the actionable takeaway changes from \"add some helpful docs\" to \"keep adversarial passages out,\" which is a different design constraint. Second, the stance classifier is an LLM validated only against another LLM; Cohen's kappa of 0.90/0.82 between two machines is not the same as agreement with humans. A small human-labeled sample would strengthen confidence in the metric. Third, the adversarial documents are imported from Bigdeli et al. without re-validating their effectiveness against the specific generation models tested here. They were shown to outrank helpful docs in retrieval, but their ability to mislead these LLMs is assumed. That shifts the headline numbers somewhat, but the direction of the effect is unlikely to disappear.\n\nBottom line: this deserves a serious referee. The measurements are reproducible, the design is largely sound, and the overclaim is easily corrected by softening the abstract and the discussion. I would send it to peer review, and I'd ask for a human evaluation sample or at least a qualitative check on the stance classifier. The paper is a solid empirical contribution to RAG robustness in high-stakes domains, and the core finding—retrieved evidence composition, not just relevance, controls alignment—holds up.","headline":"Solid, reproducible measurement of adversarial RAG vulnerability in health QA, but the abstract overclaims that mere presence of helpful evidence rescues alignment—domination, not presence, is what the data show.","tokens_in":30599,"tokens_out":2106,"would_cite":true,"duration_ms":23649,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"RAG answers collapse under adversarial evidence, recover when helpful docs dominate.","keywords":["RAG robustness","adversarial evidence","health misinformation","ground-truth alignment","query framing","retrieval pool composition","LLM evaluation","TREC Health Misinformation Track"],"falsifier":"A direct check: take the same TREC queries and pool compositions, but re-score a sample of the generated responses with human medical expert annotators instead of the two LLM stance classifiers. If the human experts find that the adversarial documents do not actually push the model into reproducing the false stance (or that the models resist Liar documents at scale), the headline degradation numbers would not survive. A second check: run the bias-controlled pools at helpful ratios of 6:4, 4:6, and 2:8; if alignment does not fall off monotonically with the helpful fraction, the claim that compo","tokens_in":29681,"feed_emoji":"🩺","tokens_out":2196,"duration_ms":24139,"temperature":0.7,"pith_summary":"This paper systematically tests how much the evidence fed into a retrieval-augmented generation (RAG) system controls whether a language model gives the correct answer to a health question. The authors find that a single helpful document reliably lifts accuracy above the no-context baseline, while a single adversarial document—especially one generated from scratch to push a false stance—can drive ground-truth alignment below 5 percent. When the retrieved pool is skewed eight-to-two toward helpful material, alignment returns to near-perfect levels, even under misleading question phrasing. The study shows that the composition and balance of the retrieval pool, more than the order of documents or the size of the model, determines whether a RAG system stays trustworthy in high-stakes medical settings.","feed_headline":"RAG health answers collapse under adversarial evidence, recover with helpful pools","feed_subtitle":"A single misleading document can drive correct-answer rates below 5%; an 8:2 helpful-biased pool restores near-total alignment.","key_machinery":"The controlled experimental grid: four document types (helpful, harmful, six adversarial variants, and no-context baseline), three query framings (consistent, neutral, inconsistent), and four retrieval-pool constructions (single-document, paired-document, passage-based reranking with MonoT5, and bias-controlled 8:2 pools). The adversarial documents produced by Bigdeli et al. [6]—Rewriter, Paraphraser, Fact-Inversion, FSAP-InterQ, FSAP-IntraQ, and Liar—are the mechanism that pushes the system to its failure point, and the bias-controlled pools are the mechanism that restores it.","core_discovery":"The central claim is that the reliability of a RAG system answering health questions is governed primarily by the mix of document types in the retrieved context. Helpful documents raise ground-truth alignment above the no-context baseline, harmful documents lower it, and adversarially generated documents—particularly 'Liar' documents built from scratch to assert an incorrect stance—can collapse alignment to near zero across all tested models, from GPT-4.1 and GPT-5 to LLaMA-3 8B. However, when the retrieval pool is deliberately biased toward helpful evidence at an eight-to-two ratio, alignment recovers to near-perfect levels, and even a single helpful document placed alongside an adversarial","pith_inferences":["A testable extension: measuring alignment while varying the helpful-to-adversarial ratio between 0:10 and 10:0 would identify the minimal helpful fraction needed for protection, potentially a design target for retrieval safeguards.","The results imply that retrieval-stage defenses—blocking or reranking out adversarial documents before they reach the prompt—matter more than prompt-centered or generation-stage defenses, since the model follows whatever dominates the context.","The same bias-controlled methodology could be applied to other high-stakes domains (legal, financial, public-safety) where ground-truth labels exist, to see whether the 'helpful majority restores robustness' effect generalizes.","A user-facing implication the authors stop short of drawing: an end user who manually injects a single trusted source into a RAG prompt may substantially shield themselves from misinformation embedded in the retrieved context."],"forward_implications":["Adding one helpful document to a RAG context reliably improves ground-truth alignment beyond the no-context baseline, across model families.","Adversarial documents of the Liar type can drive alignment below 5 percent, showing that the generation stage rarely recovers once malicious content is ranked into the top-k.","An 8:2 helpful-biased retrieval pool restores alignment to near-perfect levels, effectively neutralizing the adversarial evidence and the misleading query framing.","Document order (helpful first vs. helpful second) has minimal influence; what matters is the presence and proportion of helpful content.","LLMs are markedly more resistant to COVID-19-related misinformation (TREC 2020) than to general health misinformation (TREC 2021), suggesting post-training alignment is uneven across medical topics."],"supporting_citations":[{"why":"Supplies the six adversarial document types (Rewriter, Paraphraser, Fact-Inversion, FSAP-InterQ, FSAP-IntraQ, Liar) that are the central attack material; the paper imports these without re-validation.","marker":"[6]"},{"why":"TREC 2021 Health Misinformation Track provides the 27 general-health queries with human-labeled helpful and harmful documents.","marker":"[18]"},{"why":"TREC 2020 Health Misinformation Track provides the 22 COVID-19 queries with human-labeled helpful and harmful documents.","marker":"[19]"},{"why":"Provides the methodological inspiration for the bias-controlled pooling setup, transferring the human-judgment evidence-imbalance concept to RAG.","marker":"[61]"},{"why":"MonoT5 reranker selects the top-10 passages in the passage-based and bias-controlled pooling setups, shaping the evidence pools.","marker":"[54]"},{"why":"Ragnarok framework executes the RAG experiments and supports the multi-model comparisons.","marker":"[62]"},{"why":"Establishes RAG vulnerability to query-appended trigger attacks, serving as the comparison point the paper extends to naturalistic medical misinformation.","marker":"[10]"},{"why":"Supports the use of an LLM stance classifier by showing LLMs can align with human judgments in text-annotation tasks.","marker":"[16]"}],"fun_headline_variants":["Adversarial docs crush RAG health accuracy—8:2 helpful pool saves it","One adversarial doc sinks RAG to <5% accuracy; helpful pool restores it","Adversarial evidence can crash RAG health accuracy; helpful pool bias fixes it","RAG health: one misleading doc crashes accuracy, 8:2 helpful pool restores"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The adversarial documents, imported from a prior study, are genuinely evasive misinformation for the six language models tested here, even though the paper does not re-validate their effectiveness against those specific models.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial docs crush RAG health accuracy—8:2 helpful pool saves it","One adversarial doc sinks RAG to <5% accuracy; helpful pool restores it","Adversarial evidence can crash RAG health accuracy; helpful pool bias fixes it","RAG health: one misleading doc crashes accuracy, 8:2 helpful pool restores"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000742,"raw_usage":{"total_tokens":3184,"prompt_tokens":816,"completion_tokens":2368,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":560,"completion_tokens_details":{"reasoning_tokens":2277}},"tokens_in":560,"tokens_out":2368,"duration_ms":18419,"temperature":1.0,"reasoning_tokens":2277,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T10:39:59.080047+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct check: take the same TREC queries and pool compositions, but re-score a sample of the generated responses with human medical expert annotators instead of the two LLM stance classifiers. If the human experts find that the adversarial documents do not actually push the model into reproducing the false stance (or that the models resist Liar documents at scale), the headline degradation numbers would not survive. A second check: run the bias-controlled pools at helpful ratios of 6:4, 4:6, and 2:8; if alignment does not fall off monotonically with the helpful fraction, the claim that compo","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the methodological inspiration for the bias-controlled pooling setup, transferring the human-judgment evidence-imbalance concept to RAG."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Ragnarok framework executes the RAG experiments and supports the multi-model comparisons."}],"review_version":1}