RAG-Stress: Probing the Limits of Evidence Reliance in Retrieval-Augmented Generation

Shunyuan Zhou; Hao Chen; Tianyu Wang; Goose Lin; Zaiyuan Wang; Haiying Zhao

cs.CLOct 8, 2026

RAG-Stress: Probing the Limits of Evidence Reliance in Retrieval-Augmented Generation

Authors: Shunyuan Zhou, Hao Chen, Tianyu Wang, Goose Lin, Zaiyuan Wang, Haiying Zhao

Organizations: Beijing University of Posts and Telecommunications · Humanlaya Data · Beijing Key Laboratory of Key Technologies for AI+ Domain Applications · North China University of Technology

Abstract

Following retrieved evidence does not guarantee factual correctness: misleading evidence can induce a model to replace an answer it previously gave correctly. Standard accuracy measures obscure this behavior by combining answer replacement with preexisting errors. We introduce RAG-Stress, a controlled diagnostic protocol for examining the limits of evidence reliance in retrieval-augmented generation. The protocol holds the question and reference answer fixed, edits one assertion to support a designated incorrect answer, and crosses two source priority policies with three positions of the answer span within the evidence text. We measure misleading rate (MR) on each model's subset of questions answered correctly without retrieval, alongside clean accuracy on the full evaluation set. We evaluate fifteen systems spanning API models, open models, and search agents trained with reinforcement learning on TriviaQA-RC, HotpotQA, and SearchQA, with additional English and Chinese MedQA evaluations. Instructions that prioritize documents consistently produce higher MR than those permitting reliance on prior knowledge. Averaged over models and positions, the gap ranges from 10.9 to 13.5 percentage points across the three QA datasets. Mean MR follows End $>$ Beginning $>$ Middle under both policies, although individual models do not uniformly follow this ordering. A separate paired audit of 500 questions and two checkpoints supports increased harmful override without establishing a corresponding improvement in beneficial correction. These findings distinguish evidence adherence from factual reliability and motivate evaluating whether retrieved evidence preserves, replaces, or corrects a model's answers.

Figures & tables

Figure 1: One saved trajectory: the same edit, two instructions, different answers. With clean evidence, both soft and strict prompting return the reference (Tomb Raider); with the edited evidence, soft prompting keeps the reference while strict prompting adopts the foil (Uncharted). The closed-book answer is also Tomb Raider.

Figure 2: RAG-Stress overview. Left : paired evidence construction and the instruction–Word Position design. Right : original- and edited-evidence results for five API models on TriviaQA-RC, organized into six instruction–position panels.

API-based
TriviaQA-RC	Beginning			Middle			End			Mean
Model	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	$\overline{\boldsymbol{\Delta}}_{\mathbf{instr}}$
GPT-5.6	91.1 $\downarrow$ 20.4	95.7 $\downarrow$ 7.9	-4.6 $\downarrow$ 12.5	90.6 $\downarrow$ 20.7	93.2 $\downarrow$ 9.3	-2.6 $\downarrow$ 11.4	91.4 $\downarrow$ 19.9	91.8 $\downarrow$ 7.8	-0.4 $\downarrow$ 12.1	-2.5 $\downarrow$ 12.0
Claude Opus 4.6	92.7 $\downarrow$ 16.1	92.4 $\downarrow$ 6.6	0.3 $\downarrow$ 9.5	93.2 $\downarrow$ 12.6	92.6 $\downarrow$ 2.8	0.6 $\downarrow$ 9.8	92.9 $\downarrow$ 19.1	95.6 $\downarrow$ 8.4	-2.7 $\downarrow$ 10.7	-0.6 $\downarrow$ 10.0
Qwen3.8-Max	84.5 $\downarrow$ 15.7	89.7 $\downarrow$ 7.9	-5.2 $\downarrow$ 7.8	87.9 $\downarrow$ 17.5	91.3 $\downarrow$ 8.5	-3.4 $\downarrow$ 9.0	90.1 $\downarrow$ 26.6	88.5 $\downarrow$ 12.9	1.6 $\downarrow$ 13.7	-2.3 $\downarrow$ 10.2
DeepSeek-V4-Pro	93.0 $\downarrow$ 18.9	87.7 $\downarrow$ 7.2	5.3 $\downarrow$ 11.7	87.2 $\downarrow$ 20.5	88.2 $\downarrow$ 7.7	-1.0 $\downarrow$ 12.8	89.9 $\downarrow$ 28.2	90.9 $\downarrow$ 16.3	-1.0 $\downarrow$ 11.9	1.1 $\downarrow$ 12.1

Table 1: TriviaQA-RC. Beginning/Middle/End: Word Position within the target evidence text. Strict/Soft cells: bold full-set clean accuracy;

\downarrow

MR on closed-book-correct items (%). Each

\Delta

cell: bold clean-accuracy contrast and

\downarrow

MR contrast, both Strict minus Soft (pp); Mean averages positions. The arrow identifies the MR component, not an accuracy drop or a sign.

Dataset / model	Instruction	$\|K_{M}\|$	End $-$ Middle [95% CI]	Beginning $-$ Middle [95% CI]	Beginning $-$ End [95% CI]
QA/A	Soft	220	$5.0\ [-0.5,10.5]$	$0.9\ [-5.0,6.8]$	$-4.1\ [-10.0,2.3]$
QA/A	Strict	220	$10.9\ [4.5,17.7]$	$4.1\ [-1.8,10.5]$	$-6.8\ [-13.6,-0.5]$
QA/B	Soft	198	$6.6\ [-1.0,14.1]$	$5.1\ [-2.0,12.1]$	$-1.5\ [-9.1,5.6]$
QA/B	Strict	198	$9.6\ [2.5,16.7]$	$2.5\ [-4.5,9.6]$	$-7.1\ [-13.6,-0.5]$

Table 2: Paired Word Position validation on 300 questions per model. QA/A and QA/B retain the supplied dataset/model identifiers. Contrasts are MR percentage points with pointwise 95% paired-bootstrap intervals (

B=2{,}000

Model ( $\|K_{M}\|$ )	Version	Soft MR	Strict MR	$\Delta_{\mathrm{instr}}$ [95% CI]	$\Delta_{\mathrm{instr}}-\Delta_{\mathrm{original}}$ [95% CI]
A (220)	Original	18.6	29.3	$10.8\ [7.7,13.9]$	0.0 (ref.)
A (220)	Paraphrase 1	19.4	31.0	$11.6\ [8.7,14.7]$	$0.8\ [-1.4,3.1]$
A (220)	Paraphrase 2	17.7	28.9	$11.2\ [8.1,14.1]$	$0.4\ [-1.3,2.1]$
B (198)	Original	28.9	38.2	$9.3\ [6.3,12.3]$	0.0 (ref.)
B (198)	Paraphrase 1	29.3	37.2	$7.9\ [4.7,11.2]$	$-1.4\ [-3.7,0.9]$
B (198)	Paraphrase 2	28.7	36.4	$7.8\ [4.4,11.0]$	$-1.6\ [-3.9,0.8]$

Table 3: Source-policy paraphrase robustness on QA, with 300 questions per model. MR averages three positions (%); contrasts and pointwise 95% intervals are in pp. Supplied contrasts are retained at their reported precision; differences of rounded displayed values can differ by 0.1 pp. Ref. denotes the original-to-itself contrast.

API-based
MedQA	English (USMLE)				Chinese (MCMLE)
Model	$\boldsymbol{n_{K}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	$\boldsymbol{n_{K}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	$\boldsymbol{\Delta}_{\mathbf{lang}}$
GPT-5.6	912	96.8 $\downarrow$ 21.4	95.8 $\downarrow$ 9.8	1.0 $\downarrow$ 11.6	874	90.5 $\downarrow$ 23.1	91.0 $\downarrow$ 10.6	-0.5 $\downarrow$ 12.5	-6.3 $\downarrow$ +1.7
Claude Opus 4.6	905	96.2 $\downarrow$ 18.7	88.7 $\downarrow$ 8.2	7.5 $\downarrow$ 10.5	861	96.9 $\downarrow$ 20.5	95.2 $\downarrow$ 9.1	1.7 $\downarrow$ 11.4	0.7 $\downarrow$ +1.8
Qwen3.8-Max	871	92.1 $\downarrow$ 24.9	91.2 $\downarrow$ 11.7	0.9 $\downarrow$ 13.2	903	93.1 $\downarrow$ 22.8	89.2 $\downarrow$ 10.9	3.9 $\downarrow$ 11.9	1.0 $\downarrow$ -2.1
DeepSeek-V4-Pro	889	86.3 $\downarrow$ 23.6	84.2 $\downarrow$ 10.4	2.1 $\downarrow$ 13.2	911	89.3 $\downarrow$ 21.9	83.3 $\downarrow$ 9.8	6.0 $\downarrow$ 12.1	3.0 $\downarrow$ -1.7

Table 4: MedQA ( Jin et al., 2020 ) , averaged over Word Position. Strict/Soft cells: bold clean accuracy on the full set;

\downarrow

MR on closed-book-correct items (%).

n_{K}

: eligible count out of 1,000. Each

\Delta

cell: bold clean-accuracy contrast and

\downarrow

MR contrast (pp). Instruction contrasts are Strict minus Soft; language contrasts are Chinese minus English under Strict. The arrow identifies the MR component, not an accuracy drop or a sign.

		Pass rate (%) $\uparrow$						$\boldsymbol{\Delta}_{\mathbf{instr}}$ (pp)
Dataset	$\boldsymbol{n}$	Foil support	Relation kept	Fluency	No leakage	All pass	$\boldsymbol{\kappa}$ $\uparrow$	All	Valid.
TriviaQA-RC	200	96.5	97.0	95.5	98.5	91.5	0.81	11.8	12.3
HotpotQA	200	93.0	92.5	94.0	96.0	86.0	0.77	13.6	14.2
SearchQA	200	94.5	95.5	92.0	97.5	88.5	0.79	10.9	11.4
MedQA (EN)	200	95.0	93.5	96.5	97.0	88.0	0.76	12.9	13.3
MedQA (ZH)	200	94.0	92.0	95.5	96.5	86.5	0.74	12.4	12.9

Table 5: Human validation of 1,000 edited passages by six cross-validating annotators. Pass rates (%) after adjudication; last two columns:

\Delta_{\mathrm{instr}}

(pp) on all vs. validated edits.

	Human label
Matcher	Gold	Foil	Hedge	Other	$\boldsymbol{n}$	Agr. %
Gold	146	0	3	1	150	97.3
Foil-only	2	143	4	1	150	95.3
Unmatched	9	6	71	64	150	90.0
Total	157	149	78	66	450	94.2

Table 6: Matcher error analysis on 450 stratified outputs. Matcher–human

\kappa=0.91

after mapping human Hedge/Other to Unmatched. Left: label counts. Right: causes of the 26 errors.

	Sampling (5 seeds)			Long generation (256 tokens)
Model	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$
GPT-5.6	21.2 $\pm$ 0.9	10.1 $\pm$ 0.7	11.1 $\pm$ 0.6	18.6	8.1	10.5
DeepSeek-V4-Pro	23.9 $\pm$ 1.1	11.4 $\pm$ 0.8	12.5 $\pm$ 0.7	21.3	9.5	11.8
Llama-3-8B	41.3 $\pm$ 1.4	27.0 $\pm$ 1.2	14.3 $\pm$ 0.9	36.8	23.6	13.2
Qwen3-8B	37.0 $\pm$ 1.3	23.2 $\pm$ 1.0	13.8 $\pm$ 0.8	33.4	20.8	12.6
Search-R1	51.2 $\pm$ 1.6	42.5 $\pm$ 1.5	8.7 $\pm$ 1.1	48.1	39.6	8.5

Table 7: Decoding profiles on TriviaQA-RC (MR %, mean over Word Position conditions). Sampling: temperature 0.7, top-

p

0.9, five seeds (mean

\pm

s.d.). Long generation: greedy decoding, 256-token cap.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Model	$\|K\|$	HOR soft	HOR strict	$\Delta$ HOR (pp)	$\|U\|$	BCR soft	BCR strict	$\Delta$ BCR (pp)
Llama-3-8B	338	50.5%	64.5%	$14.0\ [11.1,17.0]$	162	72.4%	70.4%	$-2.1\ [-5.1,1.0]$
Qwen3-8B	259	54.2%	63.8%	$9.7\ [6.8,12.6]$	241	72.9%	73.0%	$0.1\ [-1.5,1.8]$

Appendix

Table 8: Primary 500-item audit: prompt-specific rates and paired contrasts with 95% bootstrap intervals.

Model	Clean arm	Edited arm	Edited $-$ clean
Llama-3-8B	$-2.4\ [-4.1,-0.7]$	$-11.8\ [-14.1,-9.6]$	$-9.4\ [-11.9,-6.9]$
Qwen3-8B	$-0.4\ [-1.7,0.9]$	$-5.7\ [-7.5,-4.1]$	$-5.3\ [-7.5,-3.3]$

Appendix

Table 9: Post-hoc common-cohort gold-score interaction on all 500 prepared questions. Values are strict minus soft gold-match percentage points; the last column is edited minus clean, with question-level 95% bootstrap intervals.

Model	Prompt	Clean	Edited	Edited $-$ clean
Llama-3-8B	Strict	0.0%	64.5%	$64.5\ [59.9,69.1]$
Llama-3-8B	Soft	0.3%	50.5%	$50.2\ [45.5,55.0]$
Qwen3-8B	Strict	0.0%	63.8%	$63.8\ [58.3,69.2]$
Qwen3-8B	Soft	0.0%	54.2%	$54.2\ [48.5,59.8]$

Appendix

Table 10: Exploratory matched clean-versus-edited control on baseline-exact-correct questions. Rates are exact designated-foil-only outputs across the three positions; edited-minus-clean contrasts and question-level 95% bootstrap intervals are in percentage points. This is not a human semantic validity rate.

Shared stratum	Llama-3-8B	Qwen3-8B
Baseline-correct ( $n=232$ ), HOR	$17.7\ [13.9,21.4]$	$9.9\ [6.8,13.2]$
Baseline-wrong ( $n=135$ ), BCR	$-0.7\ [-3.5,2.0]$	$0.5\ [-2.2,3.2]$

Appendix

Table 11: Post-hoc cross-model common-stratum check. Values are strict–soft percentage-point contrasts with question-level 95% bootstrap intervals.

Recorded quantity	Llama-3-8B	Qwen3-8B
Prepared questions	500	500
Baseline exact-correct / remaining	338 / 162	259 / 241
Actual requests	6,500	6,500
Closed-book input tokens (range)	35–92	37–94
Grid input tokens (range)	235–360	241–370
Total input tokens	1,740,804	1,795,682

Appendix

Table 12: Execution totals independently checked against saved request and prediction ledgers. Reaching the output cap is a diagnostic count, not a semantic-error label. No new inference is performed by this audit.

API-based
HotpotQA	Beginning			Middle			End			Mean
Model	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	$\overline{\boldsymbol{\Delta}}_{\mathbf{instr}}$
GPT-5.6	85.4 $\downarrow$ 20.3	84.7 $\downarrow$ 12.4	0.7 $\downarrow$ 7.9	89.8 $\downarrow$ 17.6	89.7 $\downarrow$ 5.5	0.1 $\downarrow$ 12.1	85.9 $\downarrow$ 25.7	87.1 $\downarrow$ 14.8	-1.2 $\downarrow$ 10.9	-0.1 $\downarrow$ 10.3
Claude Opus 4.6	90.5 $\downarrow$ 16.0	87.6 $\downarrow$ 11.5	2.9 $\downarrow$ 4.5	88.0 $\downarrow$ 19.7	88.3 $\downarrow$ 9.0	-0.3 $\downarrow$ 10.7	88.7 $\downarrow$ 29.1	88.3 $\downarrow$ 16.0	0.4 $\downarrow$ 13.1	1.0 $\downarrow$ 9.4
Qwen3.8-Max	85.7 $\downarrow$ 26.9	87.5 $\downarrow$ 12.9	-1.8 $\downarrow$ 14.0	83.8 $\downarrow$ 26.6	84.1 $\downarrow$ 8.7	-0.3 $\downarrow$ 17.9	82.0 $\downarrow$ 23.8	88.0 $\downarrow$ 12.3	-6.0 $\downarrow$ 11.5	-2.7 $\downarrow$ 14.5
DeepSeek-V4-Pro	83.2 $\downarrow$ 23.6	83.9 $\downarrow$ 16.8	-0.7 $\downarrow$ 6.8	83.8 $\downarrow$ 21.6	86.2 $\downarrow$ 11.5	-2.4 $\downarrow$ 10.1	84.1 $\downarrow$ 27.0	81.4 $\downarrow$ 13.4	2.7 $\downarrow$ 13.6	-0.1 $\downarrow$ 10.2

Appendix

Table 13: HotpotQA. Beginning/Middle/End: Word Position within the target evidence text. Strict/Soft cells: bold full-set clean accuracy;

\downarrow

MR on closed-book-correct items (%). Each

\Delta

cell: bold clean-accuracy contrast and

\downarrow

MR contrast, both Strict minus Soft (pp); Mean averages positions. The arrow identifies the MR component, not an accuracy drop or a sign.

API-based
SearchQA	Beginning			Middle			End			Mean
Model	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	Strict	Soft	$\boldsymbol{\Delta}_{\mathbf{instr}}$	$\overline{\boldsymbol{\Delta}}_{\mathbf{instr}}$
GPT-5.6	90.4 $\downarrow$ 13.9	90.0 $\downarrow$ 4.6	0.4 $\downarrow$ 9.3	89.2 $\downarrow$ 9.9	87.4 $\downarrow$ 3.6	1.8 $\downarrow$ 6.3	91.0 $\downarrow$ 23.0	87.1 $\downarrow$ 14.5	3.9 $\downarrow$ 8.5	2.0 $\downarrow$ 8.0
Claude Opus 4.6	95.1 $\downarrow$ 14.6	90.2 $\downarrow$ 7.1	4.9 $\downarrow$ 7.5	92.4 $\downarrow$ 17.0	86.0 $\downarrow$ 6.6	6.4 $\downarrow$ 10.4	91.3 $\downarrow$ 16.7	89.3 $\downarrow$ 9.0	2.0 $\downarrow$ 7.7	4.4 $\downarrow$ 8.5
Qwen3.8-Max	91.5 $\downarrow$ 14.8	91.6 $\downarrow$ 5.9	-0.1 $\downarrow$ 8.9	90.3 $\downarrow$ 17.4	91.1 $\downarrow$ 8.9	-0.8 $\downarrow$ 8.5	88.0 $\downarrow$ 24.3	85.9 $\downarrow$ 10.3	2.1 $\downarrow$ 14.0	0.4 $\downarrow$ 10.5
DeepSeek-V4-Pro	90.3 $\downarrow$ 18.1	88.2 $\downarrow$ 5.7	2.1 $\downarrow$ 12.4	87.7 $\downarrow$ 16.4	88.4 $\downarrow$ 5.9	-0.7 $\downarrow$ 10.5	90.1 $\downarrow$ 22.7	91.0 $\downarrow$ 9.7	-0.9 $\downarrow$ 13.0	0.2 $\downarrow$ 12.0

Appendix

Table 14: SearchQA. Beginning/Middle/End: Word Position within the target evidence text. Strict/Soft cells: bold full-set clean accuracy;

\downarrow

MR on closed-book-correct items (%). Each

\Delta

cell: bold clean-accuracy contrast and

\downarrow

MR contrast, both Strict minus Soft (pp); Mean averages positions. The arrow identifies the MR component, not an accuracy drop or a sign.

Explore similar work

SURE-RAG: Sufficiency and Uncertainty-Aware Evidence Verification for Selective Retrieval-Augmented Generation
May 5, 2026Jingxi Qiu, Zeyu Han, Cheng HuangRetrieval-Augmented Generation LLM Answer Verification
ZenWeave AI · Georgetown University · Southern Methodist University
Why Retrieval-Augmented Generation Fails: A Graph Perspective
May 13, 2026Kai Guo, Xinnan Dai, Zhibo Zhang +5Retrieval-Augmented Generation LLM Grounding
Michigan State University · Massachusetts Institute of Technology
Evaluating RAG Reliability under Clean, Misleading, and Mixed Retrieval
Jun 5, 2026Sevgi Yigit-SertRetrieval-Augmented Generation Knowledge Conflicts in Language Models
Computer Engineering Department, Ankara University, Golbasi Campus, 06830, Ankara, Turkey · Golbasi Campus, 06830, Ankara, Turkey

May 5, 2026, cs.CLJ/K move · Enter open · S save

SURE-RAG: Sufficiency and Uncertainty-Aware Evidence Verification for Selective Retrieval-Augmented Generation

Jingxi Qiu, Zeyu Han, Cheng Huang

ZenWeave AI · Georgetown University · Southern Methodist University

Retrieval-Augmented Generation LLM Answer Verification Question Answering Evidence-Grounded Generation

Open paper AskPDF arXiv

Retrieval-augmented generation (RAG) grounds answers in retrieved passages, but retrieval is not verification: a passage can be topical and still fail to justify the answer. We frame this gap as evidence sufficiency verification for selective RAG answering: given a question, a candidate answer, and retrieved evidence, predict whether the evidence supports, refutes, or is insufficient, and abstain unless support is established. We present SURE-RAG, a transparent aggregation protocol built on the observation that evidence sufficiency is a set-level property: missing hops and unresolved conflicts cannot be detected by independent passage scoring. A shared pair-level claim-evidence verifier produces local relation distributions, which SURE-RAG aggregates into interpretable answer-level signals -- coverage, relation strength, disagreement, conflict, and retrieval uncertainty -- yielding a three-way decision and an auditable selective score. We evaluate on HotpotQA-RAG v3, a controlled multi-hop benchmark, under an artifact-aware protocol (shortcut baselines, counterfactual swaps, no-oracle checks, GPT-4o audits). Calibrated SURE-RAG reaches 0.9075 Macro-F1 (0.8951 +/- 0.0069), substantially above DeBERTa mean-pooling (0.6516) and a GPT-4o judge (0.7284), while matching a strong but opaque concat cross-encoder (0.8888 +/- 0.0109) with full auditability. Risk at 30% coverage drops from 0.2588 to 0.1642, a 37% reduction in unsafe answers. To deliberately probe the task boundary, we further contrast SURE-RAG with GPT-4o on HaluBench unsafe detection: the ranking reverses (0.3343 vs 0.7389 unsafe-F1), establishing that controlled sufficiency verification and natural hallucination detection are distinct problems.

Abstract

Explore similar work

SURE-RAG: Sufficiency and Uncertainty-Aware Evidence Verification for Selective Retrieval-Augmented Generation

Why Retrieval-Augmented Generation Fails: A Graph Perspective

Evaluating RAG Reliability under Clean, Misleading, and Mixed Retrieval