Pith. sign in

REVIEW 3 major objections 2 minor 1 cited by

Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning

T0 review · 3 major / 2 minor · reviewed 2026-05-08 · grok-4.3

Challenge this review Download PDF Read on arXiv ↗

Pith's one-line read RAG architecture choice produces attack success rates from 24.4 percent to 81.9 percent under the same knowledge base poisoning attack.

desk verdict RAG architecture cuts poisoning attack success from 82% to 24% but the LLM judge's 48% precision makes the exact spread and decomposition hard to trust. read the letter →

arxiv 2605.05632 v1 submitted 2026-05-07 cs.CR cs.CLcs.LG

Samuel Korn This is my paper
classification cs.CRcs.CLcs.LG
keywords RAGknowledgebasepoisoningadversarialrobustnesscontradictiondetectionrecursivelanguagemodelsagenticretrievalretrieval-augmentedgenerationsecurityevaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper compares four retrieval-augmented generation designs on their ability to withstand an adversarial attack that inserts a single contradictory document into the knowledge base. All four designs answer clean questions at roughly the same rate of 92 percent, yet their rates of adopting the poisoned information range from 24.4 percent for recursive language models to 81.9 percent for standard retrieve-then-generate pipelines. The gap arises mainly after the poisoned document has already been retrieved, because adversarial wording affects how each architecture weighs conflicting evidence. Readers who deploy RAG systems for factual tasks would care because the results indicate that architecture selection can cut the impact of poisoning attacks by more than half without any loss in normal performance.

What carries the argument

Controlled comparison of vanilla RAG, agentic RAG, MADAM-RAG, and recursive language models under single-document poisoning by the CorruptRAG-AK attack, which uses meta-epistemic framing to target credibility assessment in the retrieved content.

What would settle it

Re-scoring the 921 Natural Questions responses with human evaluators instead of the LLM judge and checking whether the 58-percentage-point spread in attack success rates across the four architectures remains intact.

Watch

Extended reading notes

Core claim

Architecture is a high-impact variable in adversarial robustness: under CorruptRAG-AK, attack success rates range from 81.9% (vanilla) to 24.4% (RLM) - a spread of nearly 58 percentage points across architectures with comparable clean accuracy (~92%). Decomposing this gap, once the poisoned document is retrieved, adversarial framing - not retrieval optimization - drives the majority of CorruptRAG-AK's advantage for three of four architectures, localizing the cross-architecture vulnerability at the content-reasoning stage. The study also introduces a seven-category behavioral taxonomy capturing contradiction detection, hedging, and failure modes beyond binary accuracy.

Load-bearing premise

The LLM-based judge correctly identifies when a system detects and responds to contradictions, and the reimplemented MADAM-RAG behaves the same as the version described in its original paper.

Editorial extensions

If this is right

  • Recursive language models reduce the rate at which poisoned information is adopted by more than 57 percentage points compared with vanilla RAG.
  • For three of the four architectures, the attack's advantage comes from how the poisoned document is framed rather than from any change in retrieval ranking.
  • MADAM-RAG produces the highest rates of apparent contradiction detection but still yields a 41.4 percent non-answer rate on clean inputs.
  • A seven-category taxonomy of behaviors reveals failure modes such as hedging and unresolved contradictions that binary accuracy metrics miss.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • High-stakes RAG deployments should consider recursive language models when poisoning is a plausible threat.
  • Future work could test whether the same architecture ranking holds when attackers inject multiple conflicting documents rather than one.
  • Better mechanisms for resolving detected contradictions, not just spotting them, would likely narrow the robustness differences across architectures.
  • Any production use of reimplemented agent-based systems requires direct validation against original reported behaviors to avoid divergence in non-answer rates.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 2 minor

Summary. The paper evaluates four RAG architectures (vanilla RAG, agentic RAG, MADAM-RAG, and Recursive Language Models) on 921 Natural Questions QA pairs under clean, naive injection, and CorruptRAG-AK poisoning conditions. It claims that architecture is a high-impact variable for robustness to knowledge-base poisoning, reporting attack success rates ranging from 81.9% (vanilla) to 24.4% (RLM) under CorruptRAG-AK while clean accuracy remains comparable (~92%). The performance gap is decomposed to show that adversarial framing (rather than retrieval) drives most of the advantage after the poisoned document is retrieved, localizing vulnerability at the content-reasoning stage. A seven-category behavioral taxonomy is introduced, and the authors note that their LLM judge has ~48.5% precision (over-identifying contradictions) and that their MADAM-RAG reimplementation yields a 41.4% non-answer rate even on clean inputs.

Significance. If the empirical findings hold after addressing evaluator concerns, the work provides concrete evidence that architectural design choices can produce large differences in adversarial robustness for RAG systems (nearly 58 percentage points in attack success) without sacrificing clean performance. The public release of code, data, and analysis notebooks is a clear strength that supports reproducibility and follow-on work. The seven-category taxonomy offers a useful lens beyond binary accuracy for studying contradiction handling and hedging behaviors.

major comments (3)
  1. [Abstract] Abstract and evaluation methodology: The headline 58-percentage-point spread in attack success rates (81.9% vanilla to 24.4% RLM) and the decomposition attributing most of CorruptRAG-AK's advantage to adversarial framing at the content-reasoning stage are both produced by the same LLM judge whose precision is reported as only ~48.5%. If judge errors are not uniform across architectures (e.g., higher false-positive rates on hedging or multi-agent systems), both the magnitude of the architecture effect and the localization to reasoning could be artifacts of the evaluator rather than true differences.
  2. [Abstract] Abstract: The MADAM-RAG reimplementation is reported to achieve the highest apparent contradiction-detection rate, yet it produces a 41.4% non-answer rate on clean inputs; the authors flag possible implementation divergences from the original paper. Without a direct side-by-side validation (e.g., matching non-answer rates or detection behavior on the original authors' test set), it is difficult to interpret whether the reported detection advantage is real or an artifact of the reimplementation.
  3. [Evaluation] Evaluation section (decomposition analysis): The claim that 'once the poisoned document is retrieved, adversarial framing—not retrieval optimization—drives the majority of CorruptRAG-AK's advantage for three of four architectures' requires explicit experimental controls and metrics showing how retrieval success is isolated from downstream reasoning. It is unclear whether the decomposition uses oracle retrieval, controlled injection rates, or post-hoc analysis of retrieved documents, which is load-bearing for the localization of vulnerability to the reasoning stage.
minor comments (2)
  1. [Abstract] The abstract states 'comparable clean accuracy (~92%)' but does not report per-architecture clean accuracies or confidence intervals. Adding a table with exact clean and attacked metrics for all four architectures would improve transparency.
  2. The seven-category behavioral taxonomy is introduced but its inter-annotator agreement or mapping to the LLM judge prompts is not detailed. Clarifying the taxonomy definitions and judge prompt templates would aid reproducibility.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for their detailed and insightful comments on our manuscript. We address each of the major comments below and have updated the paper accordingly to strengthen the presentation of our results and limitations.

read point-by-point responses

  1. Referee: [Abstract] Abstract and evaluation methodology: The headline 58-percentage-point spread in attack success rates (81.9% vanilla to 24.4% RLM) and the decomposition attributing most of CorruptRAG-AK's advantage to adversarial framing at the content-reasoning stage are both produced by the same LLM judge whose precision is reported as only ~48.5%. If judge errors are not uniform across architectures (e.g., higher false-positive rates on hedging or multi-agent systems), both the magnitude of the architecture effect and the localization to reasoning could be artifacts of the evaluator rather than true differences.

    Authors: We acknowledge this valid concern regarding the reliability of the LLM judge. The manuscript already reports the judge's precision at ~48.5% and qualifies all contradiction detection rates as upper bounds. We did not conduct a dedicated analysis of error uniformity in the original submission. In the revised version, we will expand the limitations section to discuss the possibility of non-uniform errors across architectures and their implications for the reported gaps. Additionally, we will release the complete set of model outputs and judgments to allow for external auditing. revision: yes

  2. Referee: [Abstract] Abstract: The MADAM-RAG reimplementation is reported to achieve the highest apparent contradiction-detection rate, yet it produces a 41.4% non-answer rate on clean inputs; the authors flag possible implementation divergences from the original paper. Without a direct side-by-side validation (e.g., matching non-answer rates or detection behavior on the original authors' test set), it is difficult to interpret whether the reported detection advantage is real or an artifact of the reimplementation.

    Authors: We agree that the reimplementation of MADAM-RAG introduces interpretative challenges, as noted in the manuscript where we flag possible divergences from the original work. Since the original authors' code and specific test set are not publicly available, a direct side-by-side validation on their exact setup is not feasible. Our reimplementation adheres to the published description, and the 41.4% non-answer rate on clean inputs is presented as an observed behavior. In the revision, we will include more detailed pseudocode and hyperparameter settings for the reimplementation to facilitate reproducibility and community scrutiny. revision: partial

  3. Referee: [Evaluation] Evaluation section (decomposition analysis): The claim that 'once the poisoned document is retrieved, adversarial framing—not retrieval optimization—drives the majority of CorruptRAG-AK's advantage for three of four architectures' requires explicit experimental controls and metrics showing how retrieval success is isolated from downstream reasoning. It is unclear whether the decomposition uses oracle retrieval, controlled injection rates, or post-hoc analysis of retrieved documents, which is load-bearing for the localization of vulnerability to the reasoning stage.

    Authors: The decomposition relies on post-hoc analysis of retrieval logs from our experiments. For each query, we record whether the poisoned document was retrieved within the top-k results and compute attack success rates conditional on successful retrieval of the poison. This approach uses controlled single-document injection into the knowledge base rather than oracle retrieval. We have revised the evaluation section to explicitly describe this methodology, including the addition of retrieval success metrics per architecture and conditional performance tables to clarify how the reasoning-stage vulnerability is isolated. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: purely empirical evaluation with direct experimental measurements

full rationale

The paper conducts a controlled experimental comparison of four RAG architectures on 921 QA pairs under clean, naive-injection, and CorruptRAG-AK conditions. All reported quantities—attack success rates (81.9% to 24.4%), clean accuracy (~92%), contradiction detection rates, non-answer rates, and the seven-category taxonomy—are obtained by running the systems and applying an LLM judge to the outputs. No equations, derivations, fitted parameters, or self-citations are used to generate or justify the central claims; the results are measured directly from the experimental runs. The noted ~48.5% judge precision and possible MADAM-RAG reimplementation divergences are presented as limitations on measurement validity, not as part of any derivation chain that reduces to its own inputs. This is a standard empirical study whose findings stand or fall on the reproducibility of the experiments rather than on any self-referential construction.

Assumptions & free parameters 0 free parameters · 2 assumptions · 0 invented entities

The evaluation rests on standard assumptions about the Natural Questions dataset and the relevance of single-document poisoning; no new entities are introduced and no free parameters are fitted to produce the central robustness claim.

assumptions (2)
  • domain assumption Natural Questions QA pairs are representative of typical retrieval-augmented tasks.
    Used as the 921-question evaluation set.
  • domain assumption Single-document (N=1) poisoning is a controlled and relevant threat model.
    Basis for the clean, naive, and CorruptRAG-AK conditions.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning." pith.science (2026). https://pith.science/paper/2605.05632

@misc{pith2026260505632,
  author       = {Pith},
  title        = {Pith review of: Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2605.05632}},
  note         = {Machine review of arXiv:2605.05632}
}
read the original abstract

Retrieval-Augmented Generation (RAG) systems are vulnerable to knowledge base poisoning, yet existing attacks have been evaluated almost exclusively against vanilla retrieve-then-generate pipelines. Architectures designed to handle conflicting retrieved information - multi-agent debate, agentic retrieval, recursive language models - remain untested against adversarially optimized contradictions. We evaluate four RAG architectures (vanilla RAG, agentic RAG, MADAM-RAG, and Recursive Language Models) under controlled single-document (N=1) poisoning on 921 Natural Questions QA pairs, comparing a clean baseline, naive injection, and CorruptRAG-AK - an adversarial attack whose meta-epistemic framing targets credibility assessment. Architecture is a high-impact variable in adversarial robustness: under CorruptRAG-AK, attack success rates range from 81.9% (vanilla) to 24.4% (RLM) - a spread of nearly 58 percentage points across architectures with comparable clean accuracy (~92%). Decomposing this gap, once the poisoned document is retrieved, adversarial framing - not retrieval optimization - drives the majority of CorruptRAG-AK's advantage for three of four architectures, localizing the cross-architecture vulnerability at the content-reasoning stage. Our MADAM-RAG reimplementation shows the highest apparent contradiction detection rate, though our LLM judge over-identifies this behavior (~48.5% precision), so reported rates are upper bounds. Regardless of detection, MADAM-RAG cannot resolve contradictions reliably, producing a 41.4% non-answer rate even on clean inputs - though implementation divergences from the original may contribute. We introduce a seven-category behavioral taxonomy capturing contradiction detection, hedging, and failure modes beyond binary accuracy. Code, data, and analysis notebooks are publicly available.

Figures

Figures reproduced from arXiv: 2605.05632 by the authors.

Figure 1
Figure 1. Architecture produces a nearly 58 percentage point spread in attack success rate under CorruptRAG-AK adversarial poisoning. Bars show clean-conditioned ASR (restricted to questions each architecture answers correctly on clean inputs) with 95% bootstrap confidence intervals. Vanilla, agentic, and RLM all achieve ∼92% clean accuracy, so these differences reflect architectural robustness, not baseline capability. MADAM… view at source ↗
Figure 2
Figure 2. Vanilla RAG: single-pass retrieve-then-generate. Retrieved passages are concatenated into the prompt for a single LLM call, with no explicit conflict-handling mechanism. Agentic RAG. Our agentic implementation uses PydanticAI to create an LLM agent with two tools: search knowledge base(question), which returns the top-K=10 passages via semantic search over the knowledge base, and get document by id(doc id), which re… view at source ↗
Figure 3
Figure 3. Agentic RAG: a PydanticAI agent operates in an open-ended tool-use loop over search knowledge base and get document by id, deciding autonomously when to search, reformulate queries, or stop. 7 view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: MADAM-RAG: each of the K=10 retrieved documents is assigned to a separate LLM agent; agents generate initial answers independently, engage in multi-round debate over each other’s responses, and a separate aggregator synthesizes the final answer from the debate transcri…
Figure 5
Figure 5. Figure 5
Figure 6
Figure 6. Figure 6: Accuracy by architecture and attack condition. Under clean conditions all architectures except MADAM-RAG achieve ∼92% accuracy; attack conditions reveal large architectural differences in robustness. Error bars show 95% bootstrap confidence intervals
Figure 7
Figure 7. Figure 7: Fully-conditioned attack success rate by architecture, comparing naive injection and CorruptRAG-AK. Restricted to questions where the architecture answers correctly on clean and the poison document is retrieved, isolating architectural robustness from retrieval luck an…
Figure 8
Figure 8. Figure 8: Poison document retrieval rates by architecture and attack type. CorruptRAG-AK achieves near-universal retrieval; naive injection retrieval varies substantially across architectures. CD Correct Hedging Unknown Incorrect merged_category Vanilla RAG Agentic RAG RLM MADAM…
Figure 9
Figure 9. Figure 9: Response category distribution by architecture and attack type. Categories are ordered from safest (CD, left) to most dangerous (INCORRECT, right). Each row sums to 100%. 4.2 Contradiction Detection Behavior Binary ASR captures whether an architecture is fooled but not…
Figure 10
Figure 10. Figure 10: Safety profile under CorruptRAG-AK. Categories stacked from most dangerous (INCORRECT, bottom) to safest (CD, top). A taller INCORRECT segment indicates a more dangerous failure mode. Meta-epistemic framing propagation. When architectures produce INCORRECT responses u…
Figure 11
Figure 11. Figure 11: Decomposition of the ASR gap between naive injection and CorruptRAG-AK into retrieval and content effects. Retrieval effect (blue) captures the contribution of higher poison retrieval rates; content effect (orange) captures the additional persuasiveness of adversarial…
Figure 12
Figure 12. Figure 12: Seven-category confusion matrix: LLM judge predictions vs. human labels on the 384-response validation set. Left: raw counts; right: row-normalized (recall perspective). Overall agreement: 86.5%. C.2 Five-Category Confusion Matrix CORRECT CORRECT_WITH_DETECTION HEDGIN…
Figure 13
Figure 13. Figure 13: Five-category confusion matrix after category merging (UC→CORRECT, UI→INCORRECT). Left: raw counts; right: row-normalized. Overall agreement: 88.0%. 34
Figure 14
Figure 14. Figure 14: Embedding similarity threshold calibration for target-present determination. The optimal threshold of 0.80 maximizes F1 against human labels. The embedding signal is used alongside LLM judgment and substring matching as a validation signal; the LLM signal is used for …
Figure 15
Figure 15. Figure 15: Per-question latency distribution by architecture. Median latencies: vanilla 6.4s, agentic 11.0s, RLM 79.5s, MADAM-RAG 336.9s. MADAM-RAG’s latency is dominated by sequential agent execution and would be substantially reduced by trivial parallelization. Total compute a…
Figure 16
Figure 16. Figure 16: Clean-conditioned decomposition of the ASR gap between naive injection and CorruptRAG-AK. Compare with

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates

    cs.CR 2026-08 conditional novelty 6.0 of 10

    A black-box poisoning attack that frames false information as a fact-compatible update defeats conflict-resolution safeguards in RAG on most tested settings.

Reference graph

Works this paper leans on

18 extracted references · 18 canonical work pages · cited by 1 Pith paper

  1. [1]

    Choquette-Choo and Milad Nasr and Cristina Nita-Rotaru and Alina Oprea , title =

    Harsh Chaudhari and Giorgio Severi and John Abascal and Matthew Jagielski and Christopher A. Choquette-Choo and Milad Nasr and Cristina Nita-Rotaru and Alina Oprea , title =. 2024 , eprint =

    work page 2024

  2. [2]

    Findings of the Association for Computational Linguistics: EMNLP 2025 , pages =

    Zhiyuan Chang and Mingyang Li and Xiaojun Jia and Junjie Wang and Yuekai Huang and Ziyou Jiang and Yang Liu and Qing Wang , title =. Findings of the Association for Computational Linguistics: EMNLP 2025 , pages =

    work page 2025

  3. [3]

    Proceedings of the 37th International Conference on Machine Learning (ICML) , year =

    Kelvin Guu and Kenton Lee and Zora Tung and Panupong Pasupat and Ming-Wei Chang , title =. Proceedings of the 37th International Conference on Machine Learning (ICML) , year =

    work page

  4. [4]

    Transactions on Machine Learning Research , year =

    Gautier Izacard and Mathilde Caron and Lucas Hosseini and Sebastian Riedel and Piotr Bojanowski and Armand Joulin and Edouard Grave , title =. Transactions on Machine Learning Research , year =

    work page

  5. [5]

    Dai and Jakob Uszkoreit and Quoc Le and Slav Petrov , title =

    Tom Kwiatkowski and Jennimaria Palomaki and Olivia Redfield and Michael Collins and Ankur Parikh and Chris Alberti and Danielle Epstein and Illia Polosukhin and Jacob Devlin and Kenton Lee and Kristina Toutanova and Llion Jones and Matthew Kelcey and Ming-Wei Chang and Andrew M. Dai and Jakob Uszkoreit and Quoc Le and Slav Petrov , title =. Transactions o...

    work page

  6. [6]

    Retrieval-Augmented Generation for Knowledge-Intensive

    Patrick Lewis and Ethan Perez and Aleksandra Piktus and Fabio Petroni and Vladimir Karpukhin and Naman Goyal and Heinrich K\". Retrieval-Augmented Generation for Knowledge-Intensive. Advances in Neural Information Processing Systems (NeurIPS) , year =

    work page

  7. [7]

    Fei Wang and Xingchen Wan and Ruoxi Sun and Jiefeng Chen and Sercan \". Astute. 2024 , eprint =

    work page 2024

  8. [8]

    Conference on Language Modeling (COLM) , year =

    Han Wang and Archiki Prasad and Elias Stengel-Eskin and Mohit Bansal , title =. Conference on Language Modeling (COLM) , year =

    work page

Show all 18 references
  1. [9]

    International Conference on Learning Representations (ICLR) , year =

    Xi Wang and Taketomo Isazawa and Liana Mikaelyan and James Hensman , title =. International Conference on Learning Representations (ICLR) , year =

  2. [10]

    2025 , eprint =

    Arie Cattan and Alon Jacovi and Ori Ram and Jonathan Herzig and Roee Aharoni and Sasha Goldshtein and Eran Ofek and Idan Szpektor and Avi Caciularu , title =. 2025 , eprint =

    2025

  3. [11]

    2025 , eprint =

    Baolei Zhang and Yuxi Chen and Zhuqing Liu and Lihai Nie and Tong Li and Zheli Liu and Minghong Fang , title =. 2025 , eprint =

    2025

  4. [12]

    Zhang and Tim Kraska and Omar Khattab , title =

    Alex L. Zhang and Tim Kraska and Omar Khattab , title =. 2025 , eprint =

    2025

  5. [13]

    34th USENIX Security Symposium , year =

    Wei Zou and Runpeng Geng and Binghui Wang and Jinyuan Jia , title =. 34th USENIX Security Symposium , year =

  6. [14]

    Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , year =

    Zhaochen Su and Jun Zhang and Xiaoye Qu and Tong Zhu and Yanshu Li and Jiashuo Sun and Juntao Li and Min Zhang and Yu Cheng , title =. Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , year =

  7. [15]

    2025 , eprint =

    Baolei Zhang and Haoran Xin and Jiatong Li and Dongzhe Zhang and Minghong Fang and Zhuqing Liu and Lihai Nie and Zheli Liu , title =. 2025 , eprint =

    2025

  8. [16]

    International Conference on Learning Representations (ICLR) , year =

    Shunyu Yao and Jeffrey Zhao and Dian Yu and Nan Du and Izhak Shafran and Karthik Narasimhan and Yuan Cao , title =. International Conference on Learning Representations (ICLR) , year =

  9. [17]

    Toolformer: Language Models Can Teach Themselves to Use Tools , booktitle =

    Timo Schick and Jane Dwivedi-Yu and Roberto Dess\`. Toolformer: Language Models Can Teach Themselves to Use Tools , booktitle =

  10. [18]

    Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , year =

    Nandan Thakur and Nils Reimers and Andreas R\". Advances in Neural Information Processing Systems (NeurIPS), Datasets and Benchmarks Track , year =

Pith tools

Reviewed May 8, 2026 · model on record in the stance chip above.