对比四种RAG架构在知识库投毒下的鲁棒性，发现架构设计影响巨大。
Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning
- 测试四种RAG架构在单文档投毒下的表现，重点评估对抗性矛盾框架的影响。
- 攻击成功率从81.9%（普通RAG）到24.4%（递归语言模型）不等，差距近58个百分点。
- 漏洞主要出现在内容推理阶段，而非检索环节，适合关注系统安全的研究者参考。
检索增强生成（RAG）系统易受知识库投毒攻击，但现有研究多针对基础检索-生成流程。本文评估四种RAG架构（普通RAG、代理式RAG、MADAM-RAG、递归语言模型）在921个自然问题问答对上，针对单文档（N=1）投毒的鲁棒性。对比干净基线、简单注入与CorruptRAG-AK——一种基于元认知框架的对抗攻击。结果显示：在CorruptRAG-AK下，攻击成功率从81.9%（普通RAG）降至24.4%（递归语言模型），差距近58个百分点，而各架构在干净数据上的准确率均约92%。分解分析表明，一旦污染文档被检索，攻击优势主要源于对抗性表述，而非检索优化，揭示跨架构脆弱点集中于内容推理阶段。重现实验显示MADAM-RAG检测矛盾能力最强，但大模型判断器误判率高达51.5%，报告值为上限。即便在干净输入下，其非回答率仍达41.4%，可能受实现差异影响。本文提出七类行为分类体系，涵盖矛盾检测、模糊表达及失败模式。代码、数据与分析笔记已公开。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) systems are vulnerable to knowledge base poisoning, yet existing attacks have been evaluated almost exclusively against vanilla retrieve-then-generate pipelines. Architectures designed to handle conflicting retrieved information - multi-agent debate, agentic retrieval, recursive language models - remain untested against adversarially optimized contradictions. We evaluate four RAG architectures (vanilla RAG, agentic RAG, MADAM-RAG, and Recursive Language Models) under controlled single-document (N=1) poisoning on 921 Natural Questions QA pairs, comparing a clean baseline, naive injection, and CorruptRAG-AK - an adversarial attack whose meta-epistemic framing targets credibility assessment. Architecture is a high-impact variable in adversarial robustness: under CorruptRAG-AK, attack success rates range from 81.9% (vanilla) to 24.4% (RLM) - a spread of nearly 58 percentage points across architectures with comparable clean accuracy (~92%). Decomposing this gap, once the poisoned document is retrieved, adversarial framing - not retrieval optimization - drives the majority of CorruptRAG-AK's advantage for three of four architectures, localizing the cross-architecture vulnerability at the content-reasoning stage. Our MADAM-RAG reimplementation shows the highest apparent contradiction detection rate, though our LLM judge over-identifies this behavior (~48.5% precision), so reported rates are upper bounds. Regardless of detection, MADAM-RAG cannot resolve contradictions reliably, producing a 41.4% non-answer rate even on clean inputs - though implementation divergences from the original may contribute. We introduce a seven-category behavioral taxonomy capturing contradiction detection, hedging, and failure modes beyond binary accuracy. Code, data, and analysis notebooks are publicly available.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。