C$^2$U in RAG: Compositional Concept Unlearning in Retrieval-Augmented Generation

Yiyang Duan; Fan Wu; Tiantong Wu; Che Wang; Zhiren Gong; Wei Guo; Yang Cao; Wei Yang Bryan Lim

cs.CLOct 21, 2026

C $^2$ U in RAG: Compositional Concept Unlearning in Retrieval-Augmented Generation

Authors: Yiyang Duan, Fan Wu, Tiantong Wu, Che Wang, Zhiren Gong, Wei Guo, Yang Cao, Wei Yang Bryan Lim

Organizations: Midori Lab, Nanyang Technological University · Beihang University · Institute of Science Tokyo (formerly Tokyo Institute of Technology)

Abstract

Retrieval-augmented generation can expose unwanted concepts through retrieved evidence even when the generator is moderated. We study query-side concept suppression with a fixed encoder and document index. Compositional Concept Unlearning (C $^2$ U) routes a profile-derived direction through an augmented atom bank, adding only a bounded edited-minus-original delta to the raw query. Across five datasets, four encoders, and three seeds, the validation-selected configuration reduces pooled binary target Hit@5 by 4.25 percentage points with non-positive control degradation and target-exposure changes. Under the evaluated query transforms, it suppresses target density without increasing budgeted control-query exposure. Separately, ArXiv four-concept composition improves over an averaged-direction comparator after independent validation gates and first-use test evaluation.

Figures & tables

Figure 1: Intervention locations in RAG. Retraining changes the representation model; linear erasure transforms representations; C 2 U edits atom coordinates and bounds the resulting raw-query update. Its encoder, document index, and downstream generator remain fixed.

Figure 2: Deployed C 2 U pipeline. The frozen encoder’s raw query

q

feeds ACR and, via the bypass, the bounded update. Profile-guided editing adds the scaled coefficients

k_{q}b_{\beta}

to the weights

w_{q}

; the difference

\delta_{q}

and the update

q^{\prime}=\operatorname{normalize}(q+\eta\delta_{q})

\theta\leq\theta_{\max}=0.2

rad, return one edited query to the index.

Dataset	Target	Control	Queries
ArXiv	topic	category g	title/abstract
TOFU	sensitive topic	author identity	questions
Amazon	sentiment	product category	review titles
IMDB	movie genre	sentiment	template d
MNLI	text genre	logic label	hypotheses

Table 1: Task overview : what each dataset suppresses and preserves, and its query source ( Appendix B ). g Relaxed global controls. d One synthetic template per role.

Method	H5 Drop $\uparrow$	CN $\downarrow$	TE $\downarrow$
Amazon
C 2 U	+6.33	-0.64	-12.44
Delta-Edit	0.00	0.00	-0.08
PISCES	-0.33	-0.25	+2.69
Random	+1.17	-0.17	+3.00
INLP	+12.17	-0.50	+18.86

Table 2: Single-concept suppression and utility by dataset. Percentage-point changes from Raw, averaged over four encoders and three seeds; Pooled weights datasets equally. Tints mark access classes; full results are in Appendix E .

Figure 3: Bounded editing behavior. (a) Share of target queries (

n{=}6{,}000

) and control queries (

n{=}18{,}000

) that are unedited, edited below the

0.2

rad cap, or edited at the cap; each bar sums to its group. (b) Cosine to the target-document centroid for target queries before and after editing; Control (raw) is the unedited control state.

Amazon Method Density $\Delta\downarrow$ CER $\Delta\downarrow$ Utility loss $\downarrow$ C 2 U -16.4 -13.7 0.0 PISCES -1.2 +4.3 0.0 Random -0.4 +6.4 0.0 INLP -15.8 +17.6 0.0 LEACE -21.9 +2.4 0.0 RAG-Emb-Ctrl -34.7 -31.4 0.0 CURE 0.0 0.0 0.0 DARE-GRL -9.2 +46.0 0.0	MNLI Method Density $\Delta\downarrow$ CER $\Delta\downarrow$ Utility loss $\downarrow$ C 2 U -14.9 -6.8 +0.3 PISCES -2.3 +0.4 -0.2 Random -3.9 +1.2 +1.2 INLP -17.7 +4.8 -0.9 LEACE -8.4 +3.3 -0.3 RAG-Emb-Ctrl -40.6 -47.5 +5.7 CURE 0.0 0.0 0.0 DARE-GRL -29.8 +6.6 +6.9
ArXiv r Method Density $\Delta\downarrow$ CER $\Delta\downarrow$ Utility loss $\downarrow$ C 2 U -17.7 -11.7 -2.2 PISCES -2.0 +0.6 -0.2 Random -5.6 +4.6 +4.7 INLP -34.1 +2.0 +4.1 LEACE -14.0 +11.8 +2.2 RAG-Emb-Ctrl -72.4 -21.9 +5.3 CURE 0.0 0.0 0.0 DARE-GRL -50.7 +33.8 +63.6	TOFU Method Density $\Delta\downarrow$ CER $\Delta\downarrow$ Utility loss $\downarrow$ C 2 U -4.4 -4.5 -0.1 PISCES -0.6 +1.3 +0.1 Random -0.1 +1.5 +0.9 INLP -5.6 +14.0 +2.2 LEACE -5.1 +3.2 0.0 RAG-Emb-Ctrl -20.0 -30.6 +0.4 CURE 0.0 0.0 0.0 DARE-GRL -0.3 +18.4 +13.8
IMDB d Method Density $\Delta\downarrow$ CER $\Delta\downarrow$ Utility loss $\downarrow$ C 2 U -11.1 -0.8 0.0 PISCES -0.6 +0.2 0.0 Random -5.4 +14.7 +0.7 INLP -16.7 +10.1 -0.1 LEACE -5.6 +5.7 +0.1 RAG-Emb-Ctrl -34.3 +8.9 -0.1 CURE 0.0 0.0 0.0 DARE-GRL -29.4 +27.9 0.0	Pooled p Method Density $\Delta\downarrow$ CER $\Delta\downarrow$ Utility loss $\downarrow$ C 2 U -12.9 -7.5 -0.4 PISCES -1.4 +1.4 -0.1 Random -3.1 +5.7 +1.5 INLP -18.0 +9.7 +1.1 LEACE -11.0 +5.3 +0.4 RAG-Emb-Ctrl -40.4 -24.5 +2.2 CURE 0.0 0.0 0.0 DARE-GRL -23.9 +26.5 +16.9

Table 3: Suppression and control exposure under query transforms. Paired percentage-point changes from Raw, averaged over the three query conditions (Standard, Injection, Zou-noise) per dataset; Pooled weights the five datasets equally. Cell counts and signed worst values: Table 14 ; full per-condition matrix: Table 15 .

Figure 4: ArXiv

K=4

per-concept H5 lift. Compose minus the averaged-direction comparator: means and all twelve encoder–seed unit differences; these conceptwise differences are not the min-concept endpoint reported in the text.

Appendix figures & tables16 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Raw H5 (%)	C 2 U H5 (%)	Drop (pp)	95% CI (pp)
Amazon	96.83	90.50	+6.33	[4.83, 7.92]
ArXiv r	97.83	92.17	+5.67	[4.42, 7.00]
IMDB d	100.00	97.42	+2.58	[1.75, 3.50]
MNLI	94.58	91.17	+3.42	[2.25, 4.50]
TOFU	84.42	81.17	+3.25	[1.92, 4.58]

Appendix

Table 4: Absolute target Hit@5 and dataset uncertainty. Raw and C 2 U levels are aggregate-derived; intervals describe C 2 U’s binary H5 Drop.

Dataset	Domain	Target Concept ( $t$ )	Control Attribute ( $y$ )	Query Source
ArXiv	Scientific Papers	Specific Topic	ArXiv Category	Title / Abstract
TOFU	Fictional QA	Sensitive Topic	Author Identity	Natural Question
Amazon	Product Reviews	Sentiment	Product Category	Review Title
IMDB	Movie Reviews	Movie Genre	Sentiment	Synthetic Template
MNLI	Logic Inference	Text Genre	Logic Label	Hypothesis

Appendix

Table 5: Overview of datasets used in evaluation. The Target Concept represents the semantic information to be suppressed, while the Control Attribute represents the utility signal to be maintained.

Dataset	Query	Target	Base top-5 labels	Method top-5 labels	TC drop	Angle
Amazon	WORTH THE MONEY	Positive	Negative, Positive, Negative, Negative, Positive	Negative, Negative, Negative, Negative, Negative	+0.101	0.196
ArXiv	Research about AI-based code generators have gained a fundamental role in assisting developers in writing software starting from natural language (NL)	System Attacks	Software Engineering, Software Engineering, Software Engineering, System Attacks, Artificial Intelligence	Software Engineering, Software Engineering, Artificial Intelligence, Software Engineering, Machine Translation	+0.166	0.200
IMDB	Positive feedback on Horror cinema	Horror	Romance, Action, Romance, Sci-Fi, Horror	Action, Sci-Fi, Romance, Sci-Fi, Sci-Fi	+0.103	0.200
MNLI	The marauders rounded up the villagers.	fiction	travel, travel, travel, travel, fiction	travel, travel, travel, travel, travel	+0.114	0.200
TOFU	Who is the person described in the text: ’In Luka Khachidze’s works, readers can expect a diverse range of characters, but predominantly they are male leads exploring their love interests and overcom…	Work	General, General, General, Work, Work	General, General, General, General, Family	+0.123	0.200

Appendix

Table 6: Case study: target-suppression flips under C 2 U. One locked test-stage target query per dataset, selected by the pre-registered rule (base Hit@5

=1\to

method Hit@5

=0

flips only; maximum target-cosine drop; deterministic tie-breaks), frozen before any query text was read. Top-5 columns list the retrieved document labels. Illustrative only; drawn from the locked posthoc extension of the frozen test units (evaluated exactly once, no test-time tuning).

Atom ID	Post-hoc Label	Purity	Representative Keywords
492	Genomics	0.60	assembly, datasets, single
485	Biomolecules	0.50	protein, network, security
901	GR and Cosmology	0.50	structures, field, nucleat
564	Biomolecules	0.40	domain, learning, neto2
475	Crypto and Security	0.30	vulnerabilities, software

Appendix

Table 7: Representative high-usage atoms on ArXiv (paper-reported, original pipeline). Labels are post-hoc summaries of high-activation documents and are used only for qualitative interpretation.

Method	Hit@5 Drop $\uparrow$	Target Cos. $\uparrow$	Ctrl./Neigh. $\Delta$ $\downarrow$	Target Exp. $\Delta$ $\downarrow$
Amazon
C 2 U	0.0633	0.0565	-0.0064	-0.1244
Raw	0.0000	0.0000	0.0000	0.0000
Delta-Edit	0.0000	0.0015	0.0000	-0.0008
PISCES	-0.0033	0.0014	-0.0025	0.0269
Random	0.0117	0.2226	-0.0017	0.0300

Appendix

Table 8: RAG retrieval unlearning under the locked unified protocol. Test-stage behaviour of the validation-selected configuration on the 60 frozen units (24,000 queries). Bold and underline are computed only inside the profile-only access group; no cross-access-group dominance is claimed. The Pooled block pools all twenty dataset

\times

encoder cells per method.

Dataset	Encoder	C 2 U	Raw	INLP	LEACE	RAG-Emb- Ctrl	CURE	PISCES	DARE- GRL	Random	Delta- Edit	Filter-and- Refill ‡	Rank- Router §
Amazon	minilm	0.0633	0.0000	0.0733	0.1367	0.4867	0.0000	-0.0100	-0.0167	-0.0100	0.0000	0.0033	0.0900
	bge	0.0200	0.0000	0.0100	0.6300	0.9800	0.0000	0.0000	0.4700	0.0000	0.0000	0.0233	0.0200
	e5	0.1400	0.0000	0.1567	0.4867	0.4767	0.0000	0.0000	0.3333	0.0333	0.0000	0.0000	0.1400
	qwen3	0.0300	0.0000	0.2467	0.2100	0.8100	0.0000	-0.0033	0.1133	0.0233	0.0000	0.0100	0.0300
ArXiv	minilm	0.0500	0.0000	0.0467	0.0033	0.9600	0.0000	0.0000	0.2133	0.0200	0.0000	0.5833	0.0500
	bge	0.0800	0.0000	0.0900	0.0067	0.5000	0.0000	0.0000	0.3167	0.0100	0.0000	0.2567	0.0800

Appendix

Table 9: Hit@5 Drop for every dataset

\times

encoder cell (locked test stage; per-cell mean over seeds 1–3). Higher values indicate stronger target suppression. Bold and underline mark the best and second-best values inside the exact profile-only access class of each row; no cross-access-class dominance is claimed.

Dataset	Encoder	C 2 U	Raw	INLP	LEACE	RAG-Emb- Ctrl	CURE	PISCES	DARE- GRL	Random	Delta- Edit	Filter-and- Refill ‡	Rank- Router §
Amazon	minilm	0.0279	0.0000	0.0604	0.0717	0.0861	0.0000	0.0003	0.3298	0.0818	-0.0000	0.0000	0.0245
	bge	0.0555	0.0000	0.0384	0.0525	0.1702	0.0000	0.0030	0.6610	0.2786	0.0025	0.0000	0.0555
	e5	0.0505	0.0000	0.0174	0.0057	0.0099	0.0000	-0.0023	0.8229	0.3486	0.0009	0.0000	0.0481
	qwen3	0.0921	0.0000	0.0415	0.0246	0.0832	0.0000	0.0047	0.3683	0.1812	0.0025	0.0000	0.0884
ArXiv	minilm	0.1317	0.0000	0.2284	0.1124	0.4639	0.0000	0.0300	0.3187	0.0994	0.0036	0.0000	0.1286
	bge	0.0710	0.0000	0.0922	0.0340	0.0862	0.0000	0.0081	0.6618	0.2913	0.0031	0.0000	0.0681

Appendix

Table 10: Target Cosine Drop for every dataset

\times

encoder cell (locked test stage; per-cell mean over seeds 1–3). Higher values indicate stronger reduction of the target-centroid cosine. Marking as in Table 9 .

Dataset	Encoder	C 2 U	Raw	INLP	LEACE	RAG-Emb- Ctrl	CURE	PISCES	DARE- GRL	Random	Delta- Edit	Filter-and- Refill ‡	Rank- Router §
Amazon	minilm	-0.0011	0.0000	0.0000	-0.0011	-0.0011	0.0000	0.0000	-0.0011	0.0000	0.0000	0.0011	-0.0011
	bge	-0.0167	0.0000	-0.0144	-0.0178	-0.0178	0.0000	-0.0067	0.0056	-0.0056	0.0000	-0.0167	-0.0167
	e5	-0.0033	0.0000	-0.0011	-0.0022	-0.0033	0.0000	-0.0011	-0.0033	0.0000	0.0000	-0.0033	-0.0033
	qwen3	-0.0044	0.0000	-0.0044	-0.0033	-0.0056	0.0000	-0.0022	-0.0056	-0.0011	0.0000	-0.0033	-0.0044
ArXiv	minilm	-0.0122	0.0000	0.0178	0.0233	0.0978	0.0000	-0.0044	0.6544	0.0044	0.0000	-0.0167	-0.0089
	bge	-0.0078	0.0000	0.0422	0.0256	0.0100	0.0000	-0.0011	0.7244	0.0156	0.0000	-0.0189	-0.0111

Appendix

Table 11: Control/Neighbor

\Delta

for every dataset

\times

encoder cell (locked test stage; per-cell mean over seeds 1–3). Lower values indicate less non-target degradation; the utility-clean gate requires CN

\leq 10^{-9}

. Marking as in Table 9 .

Dataset	Encoder	C 2 U	Raw	INLP	LEACE	RAG-Emb- Ctrl	CURE	PISCES	DARE- GRL	Random	Delta- Edit	Filter-and- Refill ‡	Rank- Router §
Amazon	minilm	-0.0700	0.0000	0.0811	0.0178	-0.3533	0.0000	0.0067	0.3678	0.0189	-0.0011	-0.0100	-0.1011
	bge	-0.1356	0.0000	0.2922	-0.0611	-0.2644	0.0000	0.0111	0.3956	0.0200	0.0000	-0.0933	-0.1411
	e5	-0.1800	0.0000	0.2733	-0.0267	-0.2556	0.0000	0.0644	0.3778	0.0600	0.0000	-0.0256	-0.1833
	qwen3	-0.1122	0.0000	0.1078	0.0367	-0.4678	0.0000	0.0256	0.4000	0.0211	-0.0022	-0.0367	-0.1278
ArXiv	minilm	-0.0389	0.0000	0.0567	0.1922	-0.1756	0.0000	-0.0033	0.5067	0.0211	0.0000	-0.1467	-0.0389
	bge	-0.0878	0.0000	0.0500	0.1789	-0.1789	0.0000	0.0078	0.4700	0.0333	0.0000	-0.1478	-0.0878

Appendix

Table 12: Target Exposure

\Delta

for every dataset

\times

encoder cell (locked test stage; per-cell mean over seeds 1–3). Lower values indicate less false-positive retrieval of target documents by control queries; the utility-clean gate requires TE

\leq 10^{-9}

. Marking as in Table 9 .

Figure 5: Full suppression–utility Pareto view. All twelve displayed methods on every dataset, pooled over four encoders and three seeds, with access-class colors. CURE coincides with Raw because its utility gate locks it to identity. Stronger suppression and its costs remain visible.

Arm	Pools	Design	Selection $\Delta$ [CI95]	Confirmation $\Delta$ [CI95]	Test $\Delta$ [CI95]	Verdict
v1	original	MNLI $K{=}4$ ; ArXiv $K{=}4$	+0.0300 [+0.0167, +0.0450]	+0.0250 [+0.0050, +0.0467]	—	PASS v
v2	new d	Amazon $K{=}4$ ; ArXiv $K{=}8$ ; MNLI $K{=}3$	+0.0244 [+0.0122, +0.0389]	-0.0044 c	—	FAIL d
v3	cursor-disjoint	ArXiv $K{=2}$ e	+0.0100 g	— f	—	FAIL d
v3	cursor-disjoint	ArXiv $K{=4}$ e	+0.0067 g	— f	—	FAIL d
v4	cursor-disjoint	ArXiv $K{=}2$ e	-0.0008 [-0.0075, +0.0058]	— f	—	FAIL d
v4	cursor-disjoint	ArXiv $K{=}4$ e	+0.0425 [+0.0279, +0.0575]	+0.0517 [+0.0375, +0.0663]	+0.0412 [+0.0325, +0.0506]	PASS t

Appendix

Table 13: Multi-concept composition ladder. Primary endpoint: paired per-unit difference of min-concept Hit@5 Drop, GR-C2U-ACR-compose minus the internal ablation GR-C2U-Fixed-m3-multi (positive favors compose). v1 (original pools) passes validation only; v2 (new pools) fails selection and carries a registered split-overlap construction defect; v3 (cursor-disjoint) is scope-limited to ArXiv and fails selection on both designs; v1–v3 touch no test rows and their test stages stay hard-closed. v4 (cursor-disjoint tier-T3 capacity expansion on fresh rows) fails selection at

K{=}2

but passes selection, confirmation, and the hard-gated test stage at

K{=}4

. F&R-multi is a document-membership oracle upper reference, non-gating.

Figure 8: Descriptive composition view of locked ArXiv $K=4$ outcomes. (a,b) Raw and edited queries in one deterministic PCA basis on the pre-registered bge/seed-1 illustration (variance share $0.157$ ); centroid shifts are $0.022$ for controls and $0.058$ – $0.118$ for targets. (c) Residual-atom cosines, not the Gram matrix of full O2 edit directions: SE–NT $0.022$ , NC–NT $0.015$ , SE–AI $0.560$ . (d) Paired per-concept H5 differences; AI is smallest ( $+0.0142$ ). Selection/confirmation/test endpoints are $+0.0425/0.0517/0.0412$ (test CI95 $[+0.0325,+0.0506]$ ); oracle refill is $+0.7181$ . $K=2$ failed selection and never entered test. This preserves the first-use, no-test-tuning scope of the locked $K=4$ test.

Method	Suppressing /15	Divergent /15	Worst CER $\Delta$	Worst utility loss
C 2 U	15/15	0/15	0.0	+2.6
PISCES	14/15	11/15	+4.9	+0.1
Random	12/15	11/15	+22.3	+5.7
INLP	15/15	13/15	+25.0	+5.4
LEACE	15/15	13/15	+12.5	+3.4
RAG-Emb-Ctrl	15/15	3/15	+16.7	+14.0

Appendix

Table 14: Cross-condition behavior over the fifteen dataset–condition cells. Suppressing: density

\Delta<0

; divergent: suppressing with CER

\Delta>0

; worst values are signed maxima over the fifteen cells (pp). Counts use unrounded values; the per-condition cells are in Table 15 .

	Standard (no attack)			Injection			Zou-noise			Mean
Method	Target density $\Delta$	Control CER $\Delta$	Hit@10 loss $\downarrow$	Target density $\Delta$	Control CER $\Delta$	Hit@10 loss $\downarrow$	Target density $\Delta$	Control CER $\Delta$	Hit@10 loss $\downarrow$	Target density $\Delta$	Control CER $\Delta$	Hit@10 loss $\downarrow$
Amazon
C 2 U	-18.0	-12.2	-0.1	-14.3	-16.7	0.0	-16.7	-12.4	0.0	-16.4	-13.7	0.0
PISCES	-3.5	+3.4	-0.1	+0.2	+4.9	0.0	-0.5	+4.6	0.0	-1.2	+4.3	0.0
Random	-5.7	+2.2	0.0	+2.5	+11.2	0.0	+2.1	+5.7	0.0	-0.4	+6.4	0.0
INLP	-31.2	+20.1	-0.1	-5.4	+16.9	0.0	-10.7	+15.8	0.0	-15.8	+17.6	0.0

Appendix

Table 15: Retrieval under standard and transformed queries. Per-query paired percentage-point changes relative to the Raw reference under the same condition; Target density

\Delta

, CER

\Delta

on control queries (context budget

B{=}512

, at most

50

documents), and control own-label Hit@10 loss are all lower-is-better. Bold/underline are computed only inside the exact profile-only group (C 2 U, PISCES, Random), excluding the Raw reference; no cross-access-group dominance is claimed. The Mean columns pool the three query conditions per dataset.

Retrieval-Augmented Generation

Retrieval-augmented generation connects language models to external knowledge so answers can use current, domain-specific evidence.

See all 786 papers

RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation
Aug 13, 2026Xinlong Xu, Yoshua Y. LiRAG Poisoning Attacks RAG Security
Nanjing University of Information Science and Technology · Meituan
Know Before You Fetch: Calibrated Retrieval-Budget Allocation for Retrieval-Augmented Generation
Jun 29, 2026Zhe Dong, Fang Qin, Manish Shah +1Retrieval-Augmented Generation Selective Prediction
University of Maine at Presque Isle · Stanford University · Independent Researcher
Retrieval Augmented Generation Compositionality
Oct 21, 2026Ido Levy, Segev Shlomov, Leshem ChoshenRetrieval-Augmented Generation RAG Evaluation
IBM · Weizmann Institute of Science

Aug 13, 2026J/K move · Enter open · S save

RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation

Xinlong Xu, Yoshua Y. Li

Nanjing University of Information Science and Technology · Meituan

RAG Poisoning Attacks RAG Security RAG Robustness Anomaly Detection

Open paper AskPDF arXiv

Retrieval-augmented generation uses an external corpus as inference-time evidence, allowing an attacker to promote a false answer by injecting a handful of documents. Detection must distinguish this manipulation from ordinary relevance without knowing which queries or documents are targeted. Existing detectors use text irregularity, candidate consensus, or corpus-level graph structure, whose reliability varies with the attack and local context. We present RAGSieve, which constructs a reference matched to each detection scope. At query time, RAGSieve-Query (RSQ) compares generation candidates with the lower-ranked tail of the same retrieval, exposing answer-token concentration and carrier-payload seams. At corpus time, RAGSieve-Graph (RSG) compares each document's strongest semantic relations with its own neighborhood floor to measure coordinated density. Neither requires poison labels, a trusted corpus, or training. Across three QA datasets, three dense retrievers, and six poisoning constructions, RSQ reaches 95.2% AUROC and detects 82.2% of poison at a 5% clean-removal budget, against 81.1% and 52.5% for the strongest query-time baseline; RSG reaches 93.3% and 79.8% against 79.4% and 37.6% for the strongest corpus-time baseline, with a 79.6% versus 1.4% detection rate on camouflaged injections. Joint deployment cuts attack success from 67.4% to 16.1% while retaining unpoisoned-retrieval F1 at 41.0%, compared with 42.1% without filtering. Source code is available at https://github.com/XrazyMee/RAGSieve.

Abstract

Retrieval-Augmented Generation

Explore similar work

RAGSieve: Self-Referenced Local Contrast for Knowledge-Poison Detection in Retrieval-Augmented Generation

Know Before You Fetch: Calibrated Retrieval-Budget Allocation for Retrieval-Augmented Generation

Retrieval Augmented Generation Compositionality