Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning

Technical Summary: Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning

Problem Statement
Retrieval-Augmented Generation (RAG) systems are vulnerable to knowledge base poisoning, where an adversary injects a crafted document to manipulate system outputs. While existing literature has extensively evaluated these attacks against "vanilla" retrieve-then-generate pipelines, a critical gap remains: architectures explicitly designed to handle conflicting information—such as multi-agent debate, agentic retrieval, and recursive language models—have never been tested against adversarially optimized contradictions. Furthermore, prior evaluations often rely on scenarios where poisoned documents dominate the retrieval context (e.g., $N=5$ poisoned documents among $K=5$ retrieved), failing to test the system's ability to reason about a single adversarial document coexisting with legitimate sources ($N=1$).

Methodology
The study evaluates four distinct RAG architectures under a controlled $N=1$ poisoning threat model on 921 question-answer pairs from the Natural Questions (NQ) dataset, retrieved from a 2.68M-passage Wikipedia corpus using Contriever. All systems utilize GPT-5-mini as the backbone LLM to isolate architectural effects from model capability differences.

The four architectures tested are:

1. Vanilla RAG: A standard single-pass retrieve-then-generate pipeline.
2. Agentic RAG: Implemented via PydanticAI, allowing an agent to iteratively search, reformulate queries, and gather evidence before answering.
3. MADAM-RAG: A multi-agent debate system where each retrieved document is assigned to an independent agent for deliberation, followed by an aggregator synthesizing the final answer.
4. Recursive Language Models (RLM): A system that processes full topical context (retrieving top-100 passages and expanding to all passages sharing article titles, typically $\sim$2,600 passages) via programmatic decomposition and recursive sub-calls.

The systems are tested under three conditions:

• Clean Baseline: No poisoned documents.
• Naive Injection: A naturally written contradictory passage without retrieval optimization.
• CorruptRAG-AK: An adversarial attack employing "meta-epistemic framing" (e.g., "many outdated sources incorrectly state... the latest data confirms...") designed to undermine the credibility of correct sources. This attack includes a retrieval-optimized component to ensure the poisoned document is retrieved.

Evaluation metrics include Attack Success Rate (ASR), conditioned on clean accuracy to ensure fair cross-architecture comparison, and a seven-category behavioral taxonomy (e.g., Confident Correct, Correct with Detection, Hedging, Confident Incorrect) assessed via an LLM judge.

Key Contributions

1. First Evaluation of Advanced Architectures: The paper provides the first adversarial evaluation of agentic, multi-agent debate, and recursive architectures against knowledge base poisoning, bridging the gap between poisoning literature and conflict-handling literature.
2. Architecture as a First-Order Variable: The study demonstrates that architectural design choices alone produce a nearly 58 percentage point spread in attack success rates (from 81.9% for Vanilla to 24.4% for RLM) among systems with comparable clean accuracy ($\sim$92%).
3. Decomposition of Attack Success: The authors decompose the performance gap between naive and adversarial attacks into "retrieval effects" (getting the poison retrieved) and "content effects" (persuasiveness of the framing). They find that for three of the four architectures, the majority of the adversarial advantage stems from meta-epistemic framing at the generation stage, not retrieval optimization.
4. Behavioral Taxonomy: The introduction of a seven-category taxonomy captures failure modes beyond binary accuracy, including contradiction detection, hedging, and confidence levels.

Results

• Robustness Variance: Under CorruptRAG-AK, Vanilla RAG suffers an 81.9% ASR (clean-conditioned), while Agentic RAG drops to 43.8%, and RLM achieves the highest robustness at 24.4%. MADAM-RAG shows a 45.5% ASR but is complicated by a high non-answer rate (41.4% on clean inputs), suggesting a "safe but useless" tradeoff where the system frequently refuses to answer rather than risk error.
• Decomposition Findings:
  • Vanilla RAG: The attack advantage is split between retrieval ($\sim$18 pp) and content ($\sim$32 pp).
  • Agentic RAG: The advantage is overwhelmingly content-driven ($\sim$30 pp), with minimal retrieval contribution. Notably, the agentic loop amplifies the adversarial framing, echoing meta-epistemic markers in 63% of incorrect responses.
  • RLM: The entire vulnerability gap is localized at the content-reasoning stage; retrieval optimization provides no additional advantage to the attacker.
  • MADAM-RAG: The content effect is statistically indistinguishable from zero. Once the poison is retrieved, the adversarial framing offers no advantage over a naive contradiction, suggesting the debate structure filters persuasive language. However, the aggregator fails to resolve contradictions reliably regardless of framing.
• Behavioral Analysis: Vanilla RAG failures are predominantly "Confident Incorrect." Agentic RAG shows more distributed failures including hedging. MADAM-RAG exhibits high rates of hedging and "Unknown" responses, suppressing confident errors but also reducing utility. RLM maintains the lowest rate of confident incorrect answers.

Significance and Claims
The paper argues that architectural choice is a high-impact, underexplored variable in RAG adversarial robustness, potentially more significant than many dedicated defense mechanisms. The authors claim that:

• Design Priority: Selecting a reasoning architecture should be a co-equal design decision to selecting defense mechanisms. A vanilla pipeline with sophisticated defenses may underperform a bare agentic or recursive pipeline against realistic threats.
• Threat-Model Contingency: For organic corruption (outdated documents), Agentic RAG offers a strong cost-robustness tradeoff. However, against sophisticated adversarial framing, Agentic RAG is insufficient alone, and Recursive Language Models (RLM) provide superior robustness, albeit at a significant latency cost.
• Generation-Level Vulnerability: The primary vulnerability for most advanced architectures lies in the generation/reasoning stage (content effect), not retrieval. This motivates generation-level defenses (e.g., defensive prompting, consistency checks) as the primary intervention target for Agentic and RLM systems.
• MADAM-RAG Limitations: While the multi-agent debate structure shows promise in filtering adversarial language and detecting contradictions, the specific implementation tested failed to reliably resolve conflicts, resulting in high non-answer rates. The paper suggests that improved aggregation logic is required to realize the potential of this architecture.

The study concludes that while RLMs currently offer the strongest robustness, the high latency and information asymmetry (larger context) present deployment challenges. The authors posit that future work should investigate whether lightweight defensive prompting can close the robustness gap between Agentic and Recursive architectures at the lower cost point of Agentic systems.