Pith. sign in

REVIEW 4 major objections 5 minor 4 cited by

Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Skeptical prompting can partially defend RAG systems against poisoned passages, but only for models with strong internal reasoning.

desk verdict A carefully controlled empirical study of RAG poisoning with a useful context taxonomy and a cheap defense; the headline numbers lack statistical grounding and generalize only to the one attack recipe tested. read the letter →

arxiv 2412.16708 v2 pith:QAO5KIFP submitted 2024-12-21 cs.IR

Jinyan Su , Jin Peng Zhou , Zhengxin Zhang , Preslav Nakov , Claire Cardie This is my paper · ORCID
classification cs.IR
keywords retrieval-augmentedgenerationadversarialpoisoningskepticalpromptingretrieverrobustnessLLMself-defensepoisonedcontextsRAGsecuritycontexttaxonomy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether retrieval-augmented generation (RAG) can be made more robust to adversarial poisoning without changing the system architecture. It claims that a 'skeptical prompt'—which explicitly authorizes the model to override misleading context with its own judgment—enables a partial self-defense, and that this helps capable models such as GPT-4, GPT-4o, Llama-70b, and Claude-3.5 while hurting weaker models such as GPT-3.5 and Llama-8b. The paper also claims that retriever choice strongly mediates attack exposure, with DPR-based retrievers surfacing adversarial passages less often than Contriever-based ones, and that increasing the number of retrieved passages does little to dilute the impact of a single adversarial passage. These findings matter because they point to low-cost, deployment-time defenses that do not require retraining.

What carries the argument

The load-bearing mechanism is the 'skeptical prompting' template, which adds two extra answer options—'D(A): the context is incorrect, the answer is A' and 'D(B): the context is incorrect, the answer is B'—alongside the standard multiple-choice options. This explicit authorization to distrust the context is what triggers the model to compare retrieved passages against its internal knowledge rather than blindly obeying them. The complementary machinery is the three-way context taxonomy (adversarial, untouched, and guiding) used to isolate generation-side effects, together with retrieval-rate measurements that track whether at least one injected passage lands in the top-k results. This setup lets the paper separate whether a drop in accuracy comes from retrieval exposure or from generation-side obedience.

What would settle it

Re-run the combined retrieval-and-generation evaluation with adversarial passages optimized using the target retriever's own scores or gradients, then compare DPR's adversarial retrieval rate to Contriever's; if the gap disappears and skeptical prompting no longer restores F1, the claimed retriever-robustness ordering and self-defense result would not generalize beyond the black-box attack.

Watch

Extended reading notes

Core claim

The paper claims that adversarial passages win retrieval by being explicitly tailored to the query, outranking factually correct but loosely matched corpus passages. In controlled generation experiments, a single adversarial passage sharply lowers F1 across all tested LLMs, and the damage grows as the pollution rate rises; guiding passages—query-relevant passages leading to the correct answer—consistently counteract the damage. The central result is that skeptical prompting activates the LLM's internal knowledge so that GPT-4, GPT-4o, Llama-70b, and Claude-3.5 largely resist adversarial contexts, while GPT-3.5 and Llama-8b perform worse under skepticism. On the retrieval side, the paper finds that DPR-based retrievers retrieve adversarial passages less often than Contriever-based ones, and that this retriever difference translates into an F1 gap of more than ten points in end-to-end settings. The paper concludes that retriever choice and skeptical prompting are practical, complementary defenses, but that even combined they do not bring a poisoned RAG system back to the Non-RAG baseline.

Load-bearing premise

The load-bearing assumption is that the adversarial passages generated by the black-box PoisonedRAG recipe are representative of the poisoning attacks a RAG system will face; if attackers craft retriever-aware passages, the retriever ranking and the value of skeptical prompting could change.

Editorial extensions

If this is right

  • RAG deployments can gain robustness immediately by switching from Contriever-style retrievers to DPR-style retrievers and adding a skeptical instruction to the prompt, with no retraining required.
  • Skeptical prompting is not a universal patch: for models with weaker internal reasoning, such as GPT-3.5 and Llama-8b, it can lower accuracy, so any defense must be matched to the model's capability.
  • Increasing the number of retrieved passages will not rescue a poisoned pipeline; the absolute number of adversarial passages in the top-k, not their proportion, drives the damage.
  • Even with the best retriever and skeptical prompting, a poisoned RAG system stays below the Non-RAG baseline, implying that ultimate robustness is bounded by the LLM's own knowledge.
  • Retriever evaluation should become a standard part of RAG security testing, since retrievers differ by tens of percentage points in how often they expose the generator to adversarial content.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If attackers move from the black-box PoisonedRAG recipe to retriever-aware optimization, the measured DPR advantage may shrink or vanish; the paper itself lists retriever-tailored attacks as future work.
  • The abstention data suggest that instruction-tuning biases models toward trusting context, so an alternative to prompting would be to train selective skepticism directly into the model.
  • The flat dilution curves imply that defense budgets should concentrate on filtering or downranking the top few passages rather than on increasing retrieval recall.
  • An adaptive prompting scheme that enables skepticism only when the model's internal confidence is high could avoid the harm seen in weaker models.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. This paper reports a controlled empirical study of retrieval-augmented generation (RAG) under adversarial corpus poisoning. It introduces a three-way taxonomy of retrieved contexts (adversarial, untouched, guiding), evaluates the generation side with six LLMs under neutral and skeptical prompts, evaluates the retrieval side with five retrievers, and then combines both in an end-to-end attack scenario. The main claims are that skeptical prompting partially defends strong LLMs while hurting weaker ones, that DPR-based retrievers expose adversarial passages less often than Contriever-based ones, and that increasing the number of retrieved passages does little to dilute the effect of a single adversarial passage. The code, model versions, and prompt templates are documented.

Significance. The study is useful and actionable if its claims hold: it identifies two cheap mitigation levers (prompt change, retriever choice) and a structured way of reasoning about context quality. The controlled split between generation and retrieval interactions and the release of code and implementation details are notable strengths. However, the empirical conclusions are less robust than the presentation suggests: they rest on a single black-box attack recipe and on point estimates without any uncertainty quantification. The paper is a solid diagnostic contribution rather than a definitive robustness benchmark.

major comments (4)
  1. [§4 and §5 (all figures and tables)] The paper does not state the number of queries sampled per dataset anywhere in the main text or appendices, and no result reports error bars, confidence intervals, or significance tests. This is load-bearing for every headline claim: for example, Figure 2's conclusion that skeptical prompting improves GPT-4 but hurts GPT-3.5 is based on a single F1 point per condition, and Table 1's '47% of queries' for DPR-Single on NQ is uninterpretable without knowing whether the denominator is 50 or 1,000 queries. I request the per-dataset query counts, and for at least the key pairwise comparisons (neutral vs. skeptical per model in Figures 2-6; retriever retrieval rates in Tables 1 and 13) either query-level bootstrap confidence intervals or repeated-run estimates with a significance test.
  2. [§3, §5.2, §7] All headline results are measured under a single attack generator, the PoisonedRAG black-box recipe described in Section 3 and Appendix B. This recipe is not retriever-aware, so DPR's lower adversarial retrieval rate in Table 1 and the benefits of skeptical prompting in Section 5.3 may be properties of this particular attack distribution rather than of RAG robustness generally. Section 7 explicitly lists 'benchmarking retrievers under more tailored attacks' as future work, so the limitation is acknowledged internally; my concern is that the abstract and conclusion present the findings as general properties of RAG under adversarial poisoning. Please either add experiments with a retriever-aware attack (e.g., the gradient-based methods in Zhong et al. 2023 or Su et al. 2024) or restrict the claims in the abstract and conclusion to the PoisonedRAG attack class.
  3. [§5.1, Table 3] The neutral and skeptical prompts differ in two ways at once: the skeptical instruction and the answer format, since the skeptical prompt adds D(A)/D(B) options and tells the model the context may be incorrect. Consequently the F1 gains attributed to 'activating LLMs' internal reasoning' could instead reflect the model being given an explicit mechanism to override the context. A control condition that keeps the A/B/C/D structure but omits the skeptical wording (or keeps A/B/C and adds only the skeptical wording) is needed to support the paper's central defense claim.
  4. [§5.1.2, Figure 5] The dilution experiment fixes one adversarial passage and adds k-1 'untouched' passages, i.e., the top-1 clean-corpus passages. Because Section 5.1.1 shows that untouched passages can themselves hurt performance, the flat F1 curve in Figure 5 does not uniquely establish that 'the primary determinant is the absolute number of adversarial passages rather than their proportion.' The design confounds the number of adversarial passages with the quality of the added clean passages. To support this conclusion the authors should vary the type of added passages (e.g., guiding passages or randomly selected passages) and report the same k-sweep for each type.
minor comments (5)
  1. [§2] The sentence on Huang et al. lacks a year, and the phrase 'More discussion on these related works can be find in Appendix A.1' contains a grammatical error; please fix these and similar copyediting issues throughout the manuscript.
  2. [Appendix A.3] The sentence 'This suggests that reasoning ability and robustness drive the observed performance differences, rather than because the evaluation datasets used are fairly common and likely included in the training sets of state-of-the-art models' is not supported by any contamination analysis; either add such an analysis or remove the claim.
  3. [Table 12] The caption says the parentheses highlight changes 'when changing the prompt from skeptical to neutral', but the displayed values appear to be neutral minus skeptical; the direction should be stated explicitly.
  4. [§5.2] The speculation that retrievers are 'biased toward retrieving guiding contexts over adversarial ones' is a plausible hypothesis but is not tested; it should be labeled as a hypothesis or supported by an embedding-space analysis.
  5. [References] The reference for Wei et al. (InstrucRAG) has no year; please add the publication year.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper reports controlled empirical measurements with independently generated attack passages, external retrievers, and no fitted parameter that is later renamed as a prediction.

full rationale

This is an empirical measurement paper rather than a derivation or modeling paper. The adversarial and guiding passages are generated by a fixed black-box LLM prompting recipe taken from PoisonedRAG (Zou et al., 2024), independent of the evaluated LLMs, retrievers, and F1 metrics. The retrieval experiments measure how often these pre-generated passages appear in top-k results; the generation experiments feed controlled context sets into LLMs and score outputs. There is no fitted parameter, no equation that defines the output in terms of the input, and no claim that reduces by construction to a measured value. The 'skeptical prompting' intervention is a fixed prompt template, and its effect is evaluated on held-out evaluation queries, not tuned on those queries. The paper does cite prior work by the same authors (Su et al., 2024) and uses the same datasets as prior work, but these citations are contextual and are not load-bearing: the attack recipe and datasets are external benchmarks, and the central findings (retriever ranking differences, skeptical-prompting effects, and dilution ineffectiveness) are measured directly rather than imported from the cited papers. The acknowledged limitation in Section 7 — that only PoisonedRAG-style black-box attacks are studied and retriever-aware attacks are future work — is a scope restriction, not a circular step; it does not make any conclusion equivalent to its inputs. Accordingly, the appropriate circularity score is 0.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

The study's conclusions depend on representativeness assumptions about the attack recipe, datasets, metric, and Non-RAG proxy, all of which are acknowledged in the limitations section. No parameters are fitted to data and no new entities are postulated.

assumptions (5)
  • domain assumption Adversarial passages from the PoisonedRAG black-box recipe represent realistic poisoning attacks.
    All retrieval and generation experiments use this single attack generation method; the limitations section calls out retriever-specific and hybrid attacks as future work.
  • domain assumption Non-RAG performance is a valid proxy for an LLM's internal knowledge.
    Used as the reference point throughout Section 5; limitations acknowledge this proxy is imperfect and needs a more accurate approach.
  • domain assumption The authors' F1 definition (with abstention penalizing recall) is an adequate measure of answer quality.
    Precision and Recall are defined in Appendix D; treating 'I don't know' as a recall penalty shapes all reported F1 numbers.
  • domain assumption The three QA datasets are representative of RAG deployment conditions.
    Limitations admit these benchmarks 'may not fully represent the diverse use cases and challenges encountered in RAG systems'.
  • domain assumption LLM outputs are stable enough for point-estimate comparison without repeated sampling.
    No decoding temperature, number of runs, or variance is reported; all conclusions use single-run F1 values.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks." pith.science (2026). https://pith.science/paper/QAO5KIFP

@misc{pith2026241216708,
  author       = {Pith},
  title        = {Pith review of: Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QAO5KIFP}},
  note         = {Machine review of arXiv:2412.16708}
}
read the original abstract

Retrieval-Augmented Generation (RAG) systems have emerged as a promising solution to mitigate LLM hallucinations and enhance their performance in knowledge-intensive domains. However, these systems are vulnerable to adversarial poisoning attacks, where malicious passages injected into the retrieval corpus can mislead models into producing factually incorrect outputs. In this paper, we present a rigorously controlled empirical study of how RAG systems behave under such attacks and how their robustness can be improved. On the generation side, we introduce a structured taxonomy of context types-adversarial, untouched, and guiding-and systematically analyze their individual and combined effects on model outputs. On the retrieval side, we evaluate several retrievers to measure how easily they expose LLMs to adversarial contexts. Our findings also reveal that "skeptical prompting" can activate LLMs' internal reasoning, enabling partial self-defense against adversarial passages, though its effectiveness depends strongly on the model's reasoning capacity. Together, our experiments (code available at https://github.com/JinyanSu1/eval_PoisonRaG) and analysis provide actionable insights for designing safer and more resilient RAG systems, paving the way for more reliable real-world deployments.

Figures

Figures reproduced from arXiv: 2412.16708 by the authors.

Figure 1
Figure 1. An example query from the NQ (Kwiatkowski et al., 2019) dataset, comparing the most relevant re￾trieved passage from the original corpus to a crafted adversarial passage. allowing adversarial contexts to influence the re￾trieval and ultimately compromise the model’s out￾put. As demonstrated in PoisonedRAG (Zou et al., 2024), adversarial contexts can be easily generated using a black-box approach by prompting any LLM… view at source ↗
Figure 2
Figure 2. F1 score of RAG with a single adversarial passage under skeptical and neutral prompting, in comparison [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. F1 score of RAG with a single untouched context under skeptical and neutral prompting, in comparison to [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (13 more)
Figure 4
Figure 4. Figure 4: F1 scores with different pollution rates on the NQ dataset. All models perform worse when the pollution [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: F1 scores on the NQ dataset when increasing the number of untouched contexts retrieved from the [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]
Figure 6
Figure 6. Figure 6: Impact of guiding passages on counteracting adversarial contexts on the NQ dataset. The figure shows [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Heatmap of Counteracting adversarial passages on the NQ dataset. The [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]
Figure 8
Figure 8. Figure 8: Prompt template for generating adversarial contexts and guiding contexts. The adversarial context is [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: F1 scores with different pollution rates on the HotPotQA dataset. All models exhibit decreased performance [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]
Figure 10
Figure 10. Figure 10: F1 scores with different pollution rates on the MS-MARCO dataset. All models exhibit decreased [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]
Figure 11
Figure 11. Figure 11: F1 scores on the HotPotQA dataset when increasing the number of untouched contexts retrieved from [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]
Figure 12
Figure 12. Figure 12: F1 scores on the MS-MARCO dataset when increasing the number of untouched contexts retrieved [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]
Figure 13
Figure 13. Figure 13: Counteract experiment on the HotPotQA dataset. The x-axis represents the number of adversarial [PITH_FULL_IMAGE:figures/full_fig_p021_13.png]
Figure 14
Figure 14. Figure 14: Counteract experiment on the MS-MARCO dataset. The x-axis represents the number of adversarial [PITH_FULL_IMAGE:figures/full_fig_p021_14.png]
Figure 15
Figure 15. Figure 15: Impact of guiding passages on counteracting adversarial contexts on the MS-MARCO dataset. The [PITH_FULL_IMAGE:figures/full_fig_p021_15.png]
Figure 16
Figure 16. Figure 16: Impact of guiding passages on counteracting adversarial contexts on the HotpotQA dataset. The figure [PITH_FULL_IMAGE:figures/full_fig_p022_16.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Mechanism Design for Generative Engines: From Exploitation toward Win-Win Outcomes

    cs.LG 2026-08 conditional novelty 7.0 of 10

    A repeated-game analysis of generative-engine optimization shows that penalty-only defenses stall, and a verifiable-content reward mechanism (VCR) improves the joint defense-utility outcome in simulations on three benchmarks.

  2. Understanding Sparse Attention Selectivity in Long-Context Foundation Models via Counterfactual Evaluation

    cs.CL 2026-08 conditional novelty 6.0 of 10

    Sparse attention changes which prompt content influences model answers, an effect that can cancel out in aggregate accuracy and is visible through a dense-calibrated counterfactual audit.

  3. Epistemic Bias Injection: Manipulating LLM Opinion via Selective Context Retrieval

    cs.CR 2025-11 conditional novelty 6.0 of 10

    Factually correct but one-sided passages injected into a RAG database can shift LLM answers toward an attacker's stance, and a PCA/KL-based filter (BiasDef) reduces that shift.

  4. Never Come Up Empty: Adaptive HyDE Retrieval for Improving LLM Developer Support

    cs.SE 2025-07 conditional novelty 4.0 of 10

    A HyDE retrieval pipeline with full-answer context and adaptive similarity thresholding improves LLM answers to Stack Overflow questions over zero-shot prompting for three of four open-source models.

Reference graph

Works this paper leans on

35 extracted references · 4 canonical work pages · cited by 4 Pith papers

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Muhammad Aurangzeb Ahmad, Ilker Yaramis, and Taposh Dutta Roy. 2023. Creating trustworthy llms: Dealing with hallucinations in healthcare ai. arXiv preprint arXiv:2311.01463

    arXiv 2023

  4. [4]

    Akari Asai, Zeqiu Wu, Yizhong Wang, Avirup Sil, and Hannaneh Hajishirzi. 2023. Self-rag: Learning to retrieve, generate, and critique through self-reflection. arXiv preprint arXiv:2310.11511

    arXiv 2023

  5. [5]

    Payal Bajaj, Daniel Campos, Nick Craswell, Li Deng, Jianfeng Gao, Xiaodong Liu, Rangan Majumder, Andrew McNamara, Bhaskar Mitra, Tri Nguyen, et al. 2016. Ms marco: A human generated machine reading comprehension dataset. arXiv preprint arXiv:1611.09268

    arXiv 2016

  6. [6]

    Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. 2024. Phantom: General trigger attacks on retrieval augmented language generation. arXiv preprint arXiv:2405.20485

    arXiv 2024

  7. [7]

    Jiawei Chen, Hongyu Lin, Xianpei Han, and Le Sun. 2024. Benchmarking large language models in retrieval-augmented generation. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 17754--17762

    2024

  8. [8]

    Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. 2024. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models. arXiv preprint arXiv:2405.13401

    arXiv 2024

Show all 35 references
  1. [9]

    Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tianwei Zhang, and Yang Liu. 2024. Pandora: Jailbreak gpts by retrieval augmented generation poisoning. arXiv preprint arXiv:2402.08416

    2024 arXiv

  2. [10]

    Kelvin Guu, Kenton Lee, Zora Tung, Panupong Pasupat, and Mingwei Chang. 2020. Retrieval augmented language model pre-training. In International conference on machine learning, pages 3929--3938. PMLR

    2020

  3. [11]

    Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, et al. 2024. Trustllm: Trustworthiness in large language models. arXiv preprint arXiv:2401.05561

    2024 arXiv

  4. [12]

    To trust or not to trust? enhancing large language models' situated faithfulness to external contexts

    Yukun Huang, Sanxing Chen, Hongyi Cai, and Bhuwan Dhingra. To trust or not to trust? enhancing large language models' situated faithfulness to external contexts. In The Thirteenth International Conference on Learning Representations

  5. [13]

    Jason Kirchenbauer and Caleb Barns. 2024. Hallucination reduction in large language models with retrieval-augmented generation using wikipedia knowledge

    2024

  6. [14]

    Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, et al. 2019. Natural questions: a benchmark for question answering research. Transactions of the Association for C...

    2019

  7. [15]

    u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt \

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich K \"u ttler, Mike Lewis, Wen-tau Yih, Tim Rockt \"a schel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in Neural Information Proc...

    2020

  8. [16]

    Jiarui Li, Ye Yuan, and Zehua Zhang. 2024. Enhancing llm factual accuracy with rag to counter hallucinations: A case study on domain-specific queries in private knowledge-bases. arXiv preprint arXiv:2403.10446

    2024 arXiv

  9. [17]

    Quanyu Long, Yue Deng, LeiLei Gan, Wenya Wang, and Sinno Jialin Pan. 2024. Backdoor attacks on dense passage retrievers for disseminating misinformation. arXiv preprint arXiv:2402.13532

    2024 arXiv

  10. [18]

    Yuning Mao, Pengcheng He, Xiaodong Liu, Yelong Shen, Jianfeng Gao, Jiawei Han, and Weizhu Chen. 2020. Generation-augmented retrieval for open-domain question answering. arXiv preprint arXiv:2009.08553

    2020 arXiv

  11. [19]

    Ankit Pal, Logesh Kumar Umapathi, and Malaikannan Sankarasubbu. 2023. Med-halt: Medical domain hallucination test for large language models. arXiv preprint arXiv:2307.15343

    2023 arXiv

  12. [20]

    Yikang Pan, Liangming Pan, Wenhu Chen, Preslav Nakov, Min-Yen Kan, and William Wang. 2023. https://doi.org/10.18653/v1/2023.findings-emnlp.97 On the risk of misinformation pollution with large language models . In Findings of the Association for Computational Linguistics: EMNL...

    2023 doi

  13. [21]

    Ayush RoyChowdhury, Mulong Luo, Prateek Sahu, Sarbartha Banerjee, and Mohit Tiwari. 2024. Confusedpilot: Confused deputy risks in rag-based llms. arXiv preprint arXiv:2408.04870

    2024 arXiv

  14. [22]

    Jinyan Su, Preslav Nakov, and Claire Cardie. 2024. Corpus poisoning via approximate greedy gradient descent. arXiv preprint arXiv:2406.05087

    2024 arXiv

  15. [23]

    glue pizza and eat rocks

    Zhen Tan, Chengshuai Zhao, Raha Moraffah, Yifan Li, Song Wang, Jundong Li, Tianlong Chen, and Huan Liu. 2024. " glue pizza and eat rocks"--exploiting vulnerabilities in retrieval-augmented generative models. arXiv preprint arXiv:2406.19417

    2024 arXiv

  16. [24]

    Fei Wang, Xingchen Wan, Ruoxi Sun, Jiefeng Chen, and Sercan \"O Ar k. 2024. Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models. arXiv preprint arXiv:2410.07176

    2024 arXiv

  17. [25]

    Instructrag: Instructing retrieval-augmented generation via self-synthesized rationales

    Zhepei Wei, Wei-Lin Chen, and Yu Meng. Instructrag: Instructing retrieval-augmented generation via self-synthesized rationales. In The Thirteenth International Conference on Learning Representations

  18. [26]

    Kevin Wu, Eric Wu, and James Zou. 2024. How faithful are rag models? quantifying the tug-of-war between rag and llms' internal prior. arXiv preprint arXiv:2404.10198

    2024 arXiv

  19. [27]

    Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateek Mittal. 2024. Certifiably robust rag against retrieval corruption. arXiv preprint arXiv:2405.15556

    2024

  20. [28]

    Guangzhi Xiong, Qiao Jin, Zhiyong Lu, and Aidong Zhang. 2024. Benchmarking retrieval-augmented generation for medicine. arXiv preprint arXiv:2402.13178

    2024 arXiv

  21. [29]

    Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. 2024. Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv preprint arXiv:2406.00083

    2024 arXiv

  22. [30]

    Shi-Qi Yan, Jia-Chen Gu, Yun Zhu, and Zhen-Hua Ling. 2024. Corrective retrieval augmented generation. arXiv preprint arXiv:2401.15884

    2024 arXiv

  23. [31]

    Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William W Cohen, Ruslan Salakhutdinov, and Christopher D Manning. 2018. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. arXiv preprint arXiv:1809.09600

    2018 arXiv

  24. [32]

    Xunjian Yin, Baizhou Huang, and Xiaojun Wan. 2023. Alcuna: Large language models meet new knowledge. arXiv preprint arXiv:2310.14820

    2023 arXiv

  25. [33]

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. 2023. Poisoning retrieval corpora by injecting adversarial passages. arXiv preprint arXiv:2310.19156

    2023 arXiv

  26. [34]

    Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, and Zhenhao Li. 2025. Trustrag: Enhancing robustness and trustworthiness in rag. arXiv e-prints, pages arXiv--2501

    2025

  27. [35]

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2024. Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models. arXiv preprint arXiv:2402.07867

    2024 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.