---
title: "Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2611.04264v1"
permalink: "https://feed.astralor.com/items/itm_a69c8b3d6f36020edcc75f60"
published: "2026-11-03T03:52:58.000Z"
score: 59
channel: "ai"
tags: ["RAG","Reliability Stress Testing","RAG Retrieval","Query-Relevant Corpus Poisoning","External","Across"]
---

# Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning

## At a glance

External text can affect a retrieval-augmented generation (RAG) system only after the retriever admits it to the model context. We stress this admission step while varying document content, attacker query information, p…

## Key points

- External text can affect a retrieval-augmented generation (RAG) system only after the retriever admits it to the model context.
- We stress this admission step while varying document content, attacker query information, per-target poison budget, and contamination scope.
- Across 623 Benchmarking Information Retrieval (BEIR) queries from SciFact and NFCorpus, five query-targeted documents per query reduce classical-retriever nDCG@10 by 40.2-61.5% in isolated-target stress.

## Full text

External text can affect a retrieval-augmented generation (RAG) system only after the retriever admits it to the model context. We stress this admission step while varying document content, attacker query information, per-target poison budget, and contamination scope. Across 623 Benchmarking Information Retrieval (BEIR) queries from SciFact and NFCorpus, five query-targeted documents per query reduce classical-retriever nDCG@10 by 40.2-61.5% in isolated-target stress. Full-query anchoring explains most Best Matching 25 (BM25) degradation, whereas appended text also shifts latent semantic analysis (LSA) and Hybrid rankings. A pretrained BGE-small validation reaches 100% target exposure for query-only P=5 on both datasets; adding the injection payload changes SciFact nDCG only from 0.269 to 0.271 and lowers NFCorpus exposure slightly to 98.8%, indicating that query anchoring remains the dominant retrieval-side factor for this dense model. Query length materially changes the interpretation of partial-information attacks: on 162 long SciFact queries, two random terms cover 19.9% of eligible terms and still yield 39.5% Hybrid target exposure. Multi-target contamination adds cross-target interference. Overlap-based admission can remove full-query poisons but may sharply reduce clean retrieval utility, and maximal marginal relevance (MMR) leaves exposure unchanged under the tested configuration. The study measures retrieval-layer failures, not downstream instruction following.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_a69c8b3d6f36020edcc75f60