Epistemic Bias Injection: Biasing LLMs via Selective Context Retrieval

1. Problem Definition

The paper addresses a subtle but critical vulnerability in Retrieval-Augmented Generation (RAG) systems. While prior research on RAG poisoning focused on injecting factually false or toxic content (which can be detected via fact-checking or linguistic analysis), this paper introduces Epistemic Bias Injection (EBI).

• The Threat: Adversaries inject factually correct but epistemically biased passages into the RAG knowledge base. These passages are linguistically coherent and truthful but systematically emphasize one side of a multi-viewpoint issue.
• The Mechanism: Because the injected content is factually accurate, it evades standard fact-checking and linguistic anomaly detection. However, when the retriever selects these passages (due to their high relevance to the query), they "crowd out" alternative viewpoints. Consequently, the LLM generates answers that reflect a specific, attacker-chosen ideological stance, undermining the objectivity of the system.
• The Challenge: Existing defenses (e.g., diversity-based retrieval, fact-checking) fail because the adversarial passages are designed to be highly relevant (high similarity scores) and lack obvious "fingerprints" like false statements or prompt injections.

2. Methodology

A. Quantifying Epistemic Bias: The Polarization Score (PS)

The core theoretical contribution is a geometric metric called the Polarization Score (PS) to quantify bias in text embeddings without human annotation.

1. Anchor Passages: A small set of "anchor" passages with diverse viewpoints on a specific topic is collected.
2. Polarization Axis: Principal Component Analysis (PCA) is performed on the embeddings of these anchors. The leading principal component is identified as the polarization axis, representing the direction of maximum variance (i.e., the strongest disagreement) in the embedding space.
3. Scoring: Any text passage is projected onto this axis to generate a scalar PS.
   • $PS(d) = u_{polar}^T E(d)$
   • Epistemic Bias is measured as the shift in PS ($\Delta PS$) relative to a neutral reference passage.
4. Validation: The authors demonstrated a strong Spearman correlation (0.896) between PS values and viewpoint rankings provided by an LLM judge, confirming that PS effectively captures epistemic stance.

B. The EBI Attack Workflow

The attack is fully automated and requires no human intervention:

1. Synthesis: An LLM generates candidate passages for a target query.
2. Selection: The attacker computes PS for these candidates and selects the most extreme (biased) passage ($d_{bias}$).
3. Generation: The attacker prompts the LLM to generate $n$ adversarial variants that mimic the viewpoint of $d_{bias}$ while maintaining high factual accuracy and semantic coherence.
4. Injection: These adversarial passages are injected into the RAG database.
5. Properties of Successful Attack:
   • High Relevance: High cosine similarity (SS) to the query to ensure retrieval.
   • Epistemic Bias: Extreme PS values (consistently high or low).
   • Stealth: Factually correct and linguistically natural to evade detection.

C. The Defense: BiasDef

The authors propose BiasDef, a lightweight, plug-and-play defense mechanism that operates post-retrieval but pre-generation.

• Core Logic: It exploits the statistical distribution of passages in the PS-SS space (Polarization Score vs. Similarity Score).
• Algorithm:
  1. Base Detector: It searches for a similarity threshold ($t_{ss}$) that maximizes the Kullback-Leibler (KL) divergence between the PS distributions of the high-similarity subset and the low-similarity subset. This identifies a boundary where adversarial content (extreme PS) separates from benign content.
  2. False Positive Mitigation: Iteratively removes benign passages from the high-similarity set that have PS values close to the benign distribution (using KL divergence changes).
  3. False Negative Mitigation: Uses Mahalanobis distance to identify adversarial outliers in the embedding space that were missed by the similarity threshold, recovering them for filtering.
• Advantage: It requires no retraining of the LLM and works with any existing RAG system.

3. Key Contributions

1. Formalization of EBI: Defined a new class of RAG attacks where factually correct content is used to manipulate the framing of answers rather than the facts themselves.
2. Geometric Metric (PS): Introduced a continuous, interpretable metric to quantify epistemic bias directly from text embeddings using PCA.
3. Automated Attack: Demonstrated a fully automated workflow to generate and inject high-relevance, high-bias adversarial passages.
4. BiasDef Defense: Developed a principled defense that filters adversarial content based on viewpoint distribution, significantly reducing bias without sacrificing retrieval quality.
5. Comprehensive Benchmark: Created a benchmark across multiple LLMs (Llama-3, DeepSeek-R1, GPT-4.1) and datasets (WIKI-BALANCE, HotpotQA, Reddit-Dialogues) to evaluate vulnerability and defense efficacy.

4. Experimental Results

Vulnerability of Existing Systems

• Retrieval Failure: Standard retrievers (No Defense) and diversity-based methods (MMR, SMART, BRRA) failed to block EBI.
  • No Defense: Retrieved up to 98% of adversarial passages when 10 were injected.
  • Diversity Methods: While they reduced adversarial recall, they significantly degraded Recall@5 (retrieving fewer relevant benign passages) and still allowed ~20% of adversarial content to pass.
• LLM Susceptibility: All tested LLMs (including large models like GPT-4.1) exhibited significant PS shifts in their generated answers when exposed to biased contexts. The bias in the answer directly correlated with the bias in the retrieved context.
• Fact-Checking Ineffectiveness: Automated fact-checking APIs (e.g., WikiCheck) failed to distinguish adversarial from benign passages because the adversarial content was factually correct.

Effectiveness of BiasDef

• Adversarial Recall (A-Recall): BiasDef reduced A-Recall@5 to near zero for over 70% of queries, completely filtering out adversarial passages in most cases.
• Preservation of Benign Content: Unlike diversity-based methods, BiasDef maintained high Recall@5 (only a 12% drop compared to the unattacked baseline, whereas other defenses dropped significantly more).
• Bias Reduction: BiasDef reduced the PS shift in generated answers by 6.2× to 8.8× compared to the unmitigated baseline.
• Efficiency: The defense adds a negligible overhead (~465ms) and requires no model fine-tuning.

5. Significance and Implications

• New Threat Vector: The paper reveals that "truthful" content can be weaponized to manipulate AI reasoning, a threat that current safety filters (fact-checking, toxicity detection) are blind to.
• Geometric Approach to Safety: It demonstrates that epistemic bias can be mathematically modeled and detected in embedding space, offering a new paradigm for content sanitization beyond semantic analysis.
• Practical Defense: BiasDef offers a deployable solution for RAG systems to maintain objectivity without the heavy computational cost of retraining models or the information loss associated with aggressive diversity filtering.
• Future Directions: The authors suggest extending the metric to multi-dimensional axes (beyond binary support/oppose) and integrating BiasDef with other model-based defenses for a holistic security framework.

In conclusion, the paper establishes that RAG systems are highly vulnerable to subtle, fact-preserving bias injection and provides a robust, geometrically grounded method to detect and mitigate this threat.