RAGStress: A controlled benchmark for evaluating retrieval-augmented generation under knowledge-base degradation
Organizations: Amazon
Abstract
Retrieval-Augmented Generation (RAG) is typically evaluated under the implicit assumption that the underlying knowledge base (KB) is clean, leaving the behaviour of RAG systems under realistic KB degradation poorly characterised. We introduce RAGStress, a controlled evaluation benchmark for stress-testing RAG systems under systematic KB corruption. The benchmark pairs four naturalistic corruption types (factual corruption, numeric typo, relevance poisoning, and contradiction injection) with three severity levels (subtle, moderate, and obvious) over a single-KB, metadata-filtered experimental design built from 57 MMLU subjects and 182,546 documents. Across 52,500 model-question-condition evaluations, RAGStress reveals that clean retrieval can mask robustness differences, semantic-fidelity corruptions are substantially more harmful than signal-utility perturbations, no-retrieval accuracy does not predict corrupted-retrieval robustness, and mixed-KB accuracy should not be treated as worst-case robustness. We document the benchmark's intended use, supported claims, and limitations, and provide an artifact bundle including generation scripts, corruption prompts, metadata schema, and evaluation code. RAGStress is intended as a controlled stress test for RAG robustness under KB corruption, not as a general model leaderboard.
Figures & tables
| Condition | Sonnet 4 | Opus 4.6 | DeepSeek R1 | Qwen3-32B | Llama 3.1 8B |
|---|---|---|---|---|---|
| baseline_no_rag | 86.7 2.5 | 78.6 3.0 | 77.1 3.1 | 83.1 2.8 | 42.3 3.7 |
| clean_only | 99.4 0.6 | 99.7 0.4 | 99.9 0.3 | 100.0 0.0 | 98.6 0.9 |
| unfiltered | 82.4 2.8 | 95.0 1.6 | 91.3 2.0 | 81.6 2.9 | 74.7 3.2 |
| factual_corruption_subtle | 51.4 3.7 | 74.9 3.2 | 51.1 3.7 | 30.6 3.4 | 28.4 3.3 |
| factual_corruption_moderate | 52.9 3.7 | 73.3 3.3 | 50.4 3.7 | 29.9 3.4 | 25.4 3.2 |
| factual_corruption_obvious | 52.4 3.7 | 75.9 3.2 | 49.6 3.7 | 29.3 3.4 | 27.7 3.3 |
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
| Work | Focus | Corruption | Severity |
|---|---|---|---|
| PoisonedRAG [ 6 ] | Attack | Adversarial | Binary |
| Phantom [ 7 ] | Attack | Trigger-based | Binary |
| BadRAG [ 8 ] | Attack | Adversarial | Binary |
| RobustRAG [ 12 ] | Defense | Adversarial | Binary |
| Zhang et al. [11] | Benchmark | Adversarial | Binary |
| Worse-than-zero-shot [ 21 ] | Measure | Misleading | Binary |
| Condition | Filter | Purpose |
|---|---|---|
| Baseline (no retr.) | — | Parametric knowledge reference |
| Clean only | is_corrupted=false | RAG upper bound |
| Unfiltered | None | Mixed KB ( corrupted retrievals) |
| Type sev. (12) | type= , severity= | Isolate each perturbation class |
| Parameter | Value |
|---|---|
| Retrieved chunks per query ( ) | 5 |
| Random seed | 42 |
| Questions per run | 700, stratified across 57 MMLU subjects |
| Embedding model | Titan Embeddings V2 |
| Vector index type | Approximate nearest-neighbour search |
| Chunking strategy | Document-level, one chunk per document |
| System | Provider | Capability tier |
|---|---|---|
| Claude Sonnet 4 | Anthropic | Proprietary (frontier) |
| Claude Opus 4.6 | Anthropic | Proprietary (frontier) |
| DeepSeek R1 | DeepSeek (hosted) | Reasoning-tuned |
| Qwen3-32B | Alibaba | Open-weight (mid) |
| Llama 3.1 8B Inst. | Meta | Open-weight (small) |
| Condition | Sonnet 4 | Opus 4.6 | DeepSeek R1 | Qwen3-32B | Llama 3.1 8B |
|---|---|---|---|---|---|
| baseline_no_rag | 86.7 ( 12.7) | 78.6 ( 21.1) | 77.1 ( 22.8) | 83.1 ( 16.9) | 42.3 ( 56.3) |
| clean_only | 99.4 | 99.7 | 99.9 | 100.0 | 98.6 |
| unfiltered | 82.4 ( 17.0) | 95.0 ( 4.7) | 91.3 ( 8.6) | 81.6 ( 18.4) | 74.7 ( 23.9) |
| Factual corruption | 52.2 ( 47.2) | 74.7 ( 25.0) | 50.4 ( 49.5) | 29.9 ( 70.1) | 27.2 ( 71.4) |
| Numeric typo | 92.2 ( 7.2) | 96.2 ( 3.5) | 95.2 ( 4.7) | 92.5 ( 7.5) | 88.6 ( 10.0) |
| Relevance poisoning | 98.2 ( 1.2) | 99.3 ( 0.4) | 98.9 ( 1.0) | 99.0 ( 1.0) | 94.0 ( 4.6) |
Retrieval-Augmented Generation
Retrieval-augmented generation connects language models to external knowledge so answers can use current, domain-specific evidence.
See all 792 papers