In RAG We Trust? Poisoning Halves Fact-Checking Accuracy
A quantized Llama 3.1 8B model that hits 77.9% on FEVER fact-checking collapses to 43.5% when all three retrieved passages are silently corrupted.
In RAG We Trust? Poisoning Halves Fact-Checking Accuracy
A quantized Llama 3.1 8B model that hits 77.9% on FEVER fact-checking collapses to 43.5% when all three retrieved passages are silently corrupted. That is the headline from a September 2026 arXiv study on RAG robustness under document poisoning (arXiv:2609.09243), and it lands exactly where retrieval engineers have been feeling the pressure: the retriever is now the attack surface, not the model.
The 588-run experiment
The authors ran 588 fact-check trials against a FEVER-derived task, injecting three poisoning variants into retrieved passages: entity swap, number swap, and negation. Entity swap was the most damaging. When corruption was total, the model preferred to abstain rather than fabricate — a small mercy, but not a defense.
That behaviour matters for anyone running RAG in regulated settings. The NIST AI Risk Management Framework lists data integrity as a governance-level control, and ENISA’s report on securing machine learning algorithms names retrieval poisoning as a distinct threat class from prompt injection. If your evaluation pipeline only measures answer accuracy on clean corpora, you are measuring the wrong thing.
The 34-point gap between clean and fully-poisoned context is not noise. It is the cost of trusting a retriever without provenance checks. And the abstention behaviour, while safer than hallucination, still breaks downstream automation that expects a decision.
Engineering response
We treat retrieval integrity as a first-class SLO. That means signed corpus manifests, per-chunk hashes, and drift alerts on embedding centroids. A minimal hygiene block from one of our production configs:
retrieval_integrity:
chunk_hash_algo: sha256
manifest_signing: ed25519
drift_alert_threshold_cosine: 0.08
poison_canaries_per_1000_chunks: 3
abstain_on_manifest_mismatch: true
audit_retention_days: 365Canary chunks — deliberately planted, known-answer passages — let us detect entity or number swaps at ingestion, before they reach the retriever. This is the same discipline we describe in our teardown of Graph RAG debugging, and it pairs with the multi-agent countermeasures in our note on how backdoors survive across agent hops.
The MITRE ATLAS matrix catalogues these techniques under ML supply-chain attacks; the European Commission’s AI Act text puts data governance obligations on high-risk systems under Article 10. The regulatory floor is rising; the empirical floor, per this paper, is 43.5%.
What we build for
CAI Technology reads this result as vindication for retrieval-side observability rather than model-side hardening. Larger models will not fix a poisoned index — they will just be more confident when they are wrong. Abstention is a feature only if your product can route to a human when the retriever refuses. If it cannot, you have a silent failure mode dressed as caution. See how we instrument that boundary in our threat map across retrieval and generation.