Factual Yet One-Sided: Stance Poisoning and Evidence Balancing in Retrieval-Augmented Generation

Puyuan Yang; Shaoxuan Dong; Liujie Wu; Xiaochun Cheng; Bo Li

cs.CLOct 25, 2026

Factual Yet One-Sided: Stance Poisoning and Evidence Balancing in Retrieval-Augmented Generation

Authors: Puyuan Yang, Shaoxuan Dong, Liujie Wu, Xiaochun Cheng, Bo Li

Organizations: Department of Computer Science, Swansea University, Swansea, United Kingdom · School of Electronics and Information, Northwestern Polytechnical University, Xi’an, China

Abstract

The stance expressed in responses from retrieval-augmented generation systems is significantly influenced by the stance distribution of the retrieved materials. Existing research on knowledge poisoning has primarily targeted factual errors. In contrast, this study focuses on injection attacks in which the facts are correct but the stance on a controversial issue is one-sided. At a mean topic-level poisoning share of 18.9% within the post-injection ProCon documents, all four generation models from different vendors exhibited stance shifts aligned with the poisoning direction; across four concentration levels, the shifts increased monotonically. This paper proposes a Stance-Balancing Middleware positioned between the retriever and the generator. It consists of stance detection, fixed balancing (2 supporting + 2 opposing + 1 neutral), and a debiasing prompt, without introducing additional large language model calls. Across all eight concentration-direction settings, the complete method reduced the magnitude of stance deviation by an estimated 0.106 to 0.350; the six settings at poisoning shares of 11.9%-18.9% remained significant after Holm adjustment (adjusted p <= 0.009). In the cross-model experiment, all eight model-direction combinations moved along the stance axis in the corrective direction, and seven of eight showed a clearly detected reduction in absolute distance from 0. In the concentration sweep, the post-defense intervals included 0 in all eight settings, while the cross-model pro-poisoning results retained small positive residual point estimates of +0.045 to +0.063. For 20 candidate documents, stance detection took approximately 1.5% of the median generation time on a single GPU and approximately 16% on CPU.

Figures & tables

Figure 1: Overall architecture: the Stance-Balancing Middleware is inserted between the retriever and the generator, with neither endpoint modified.

Setting	Name	Selection of the five documents supplied to the generator	Prompt
A	No defense	Directly supply the top five retrieved documents	No additional instruction
B	Balancing (no prompt)	2 pro + 2 con + 1 neutral	No additional instruction
C	Complete method (balancing + prompt)	2 pro + 2 con + 1 neutral	Append a debiasing instruction
D	Prompt only	Top five retrieved documents, as in A	Append the same debiasing instruction as in C

Table 1: Definitions of the four experimental settings

Figure 2: Attack effectiveness across poisoning concentrations and defense effectiveness under pro- and con-side poisoning.

Target concentration	Poisoning share	Pro-poisoned corpus	Con-poisoned corpus
5%	6.4%	+0.115 [+0.014, +0.215]	$-$ 0.129 [ $-$ 0.234, $-$ 0.019]
10%	11.9%	+0.230 [+0.124, +0.335]	$-$ 0.197 [ $-$ 0.301, $-$ 0.086]
15%	14.4%	+0.297 [+0.187, +0.409]	$-$ 0.234 [ $-$ 0.343, $-$ 0.119]
20%	18.9%	+0.373 [+0.260, +0.483]	$-$ 0.325 [ $-$ 0.429, $-$ 0.215]

Table 2: Attack effectiveness: stance scores and 95% confidence intervals without defense (210 questions per cell)

Corpus	Poisoning share	A: No defense	B: Balancing (no prompt)	C: Complete method (balancing + prompt)
Pro	6.4%	+0.115 [+0.014, +0.215]	+0.043 [ $-$ 0.048, +0.129]	$-$ 0.005 [ $-$ 0.091, +0.077]
Pro	11.9%	+0.230 [+0.124, +0.335]	+0.086 [ $-$ 0.014, +0.190]	+0.014 [ $-$ 0.068, +0.092]
Pro	14.4%	+0.297 [+0.187, +0.409]	+0.053 [ $-$ 0.038, +0.144]	$-$ 0.005 [ $-$ 0.091, +0.072]
Pro	18.9%	+0.373 [+0.260, +0.483]	+0.153 [+0.057, +0.249]	+0.024 [ $-$ 0.067, +0.113]
Con	6.4%	$-$ 0.129 [ $-$ 0.234, $-$ 0.019]	+0.010 [ $-$ 0.077, +0.097]	$-$ 0.019 [ $-$ 0.096, +0.058]
Con	11.9%	$-$ 0.197 [ $-$ 0.301, $-$ 0.086]	+0.024 [ $-$ 0.067, +0.120]	$-$ 0.024 [ $-$ 0.096, +0.052]

Table 3: Stance scores and 95% confidence intervals for no defense, balancing without a prompt, and the complete method

Corpus	Poisoning share	Signed A $\rightarrow$ C stance shift [95% CI]	Reduction in absolute distance from 0 [95% CI]
Pro	6.4%	+0.115 [+0.005, +0.226]	+0.106 [ $-$ 0.038, +0.181]
Pro	11.9%	+0.216 [+0.110, +0.324]	+0.216 [+0.081, +0.300]
Pro	14.4%	+0.303 [+0.180, +0.433]	+0.293 [+0.139, +0.383]
Pro	18.9%	+0.350 [+0.232, +0.466]	+0.350 [+0.211, +0.447]
Con	6.4%	$-$ 0.111 [ $-$ 0.228, +0.005]	+0.111 [ $-$ 0.015, +0.205]
Con	11.9%	$-$ 0.173 [ $-$ 0.273, $-$ 0.072]	+0.173 [+0.048, +0.262]

Table 4: Strictly paired effects of the complete method (A

\rightarrow

C) and 95% confidence intervals (continuation of Table 3 )

Corpus	Poisoning share	A: No defense	B: Balancing (no prompt)	C: Complete method (balancing + prompt)	D: Prompt only
Pro	14.4%	+0.297	+0.053	$-$ 0.005	+0.167
Pro	18.9%	+0.373	+0.153	+0.024	+0.256
Con	14.4%	$-$ 0.234	+0.048	$-$ 0.034	$-$ 0.215
Con	18.9%	$-$ 0.325	+0.038	+0.019	$-$ 0.291

Table 5: Four-setting ablation comparing balancing alone, prompting alone, and their combination

Figure 3: Cross-generator stance scores before and after applying the complete defense at an actual poisoning proportion of 18.9%.

Generator	Pro A	Pro C	Con A	Con C
DeepSeek-V4-Pro	+0.370 [+0.238, +0.505]	+0.063 [+0.000, +0.126]	$-$ 0.424 [ $-$ 0.514, $-$ 0.328]	$-$ 0.034 [ $-$ 0.088, +0.024]
Gemma-4-31B	+0.318 [+0.204, +0.426]	+0.045 [+0.010, +0.082]	$-$ 0.095 [ $-$ 0.188, +0.000]	+0.019 [ $-$ 0.014, +0.053]
Kimi-K2.6	+0.435 [+0.321, +0.543]	+0.053 [+0.005, +0.110]	$-$ 0.353 [ $-$ 0.454, $-$ 0.252]	$-$ 0.005 [ $-$ 0.043, +0.033]
Llama-4-Maverick-17B	+0.495 [+0.357, +0.614]	+0.058 [+0.010, +0.106]	$-$ 0.314 [ $-$ 0.435, $-$ 0.191]	+0.043 [ $-$ 0.014, +0.100]

Table 6: Cross-generator stance scores and 95% confidence intervals (poisoning share: 18.9%)

Generator	Corpus	A blocked	A refused	A included	C blocked	C refused	C included
DeepSeek-V4-Pro	Pro	1	1	208	1	2	207
DeepSeek-V4-Pro	Con	1	4	205	0	3	207
Llama-4-Maverick-17B	Pro	0	0	210	0	2	208
Llama-4-Maverick-17B	Con	0	3	207	0	2	208
Kimi-K2.6	Pro	1	0	209	1	1	208
Kimi-K2.6	Con	2	1	207	0	1	209

Table 7: Blocked-response and refusal statistics (denominator: 210 questions per cell)

Corpus	Method	Stance score [95% CI]	Included	Paired difference vs. B [95% CI]
Pro	B: Balancing (no prompt, ours)	+0.153 [+0.057, +0.249]	209	—
Pro	Random-5	+0.330 [+0.219, +0.438]	209	+0.178 [+0.024, +0.321] *
Pro	MMR	+0.197 [+0.110, +0.285]	208	+0.043 [ $-$ 0.062, +0.149] $\dagger$
Con	B: Balancing (no prompt, ours)	+0.038 [ $-$ 0.062, +0.144]	209	—
Con	Random-5	$-$ 0.234 [ $-$ 0.332, $-$ 0.143]	209	$-$ 0.273 [ $-$ 0.389, $-$ 0.168] *
Con	MMR	$-$ 0.148 [ $-$ 0.263, $-$ 0.038]	209	$-$ 0.187 [ $-$ 0.311, $-$ 0.071] *

Table 8: Comparison of evidence-selection methods with shared retrieval results, generator, and judge (poisoning share: 18.9%)

Method	Pro corpus	Con corpus
A: No defense (directly supply the top five)	1.743	1.424
B / C: Proposed balancing	1.181	0.986
Random-5	1.267	1.152
MMR	1.048	0.900

Table 9: Mean number of poisoned documents among the five supplied per question

Documents classified	CPU	GPU	GPU speedup	Share of generation time (CPU / GPU)
1	63.2 ms	10.6 ms	6.0 $\times$	1.07% / 0.18%
5	237.1 ms	22.8 ms	10.4 $\times$	4.02% / 0.39%
10	348.2 ms	48.9 ms	7.1 $\times$	5.91% / 0.83%
20 (actual deployment)	954.2 ms	88.8 ms	10.7 $\times$	16.2% / 1.51%
32	2522.5 ms	222.2 ms	11.4 $\times$	42.8% / 3.77%
50 (full recall set)	3848.3 ms	337.8 ms	11.4 $\times$	65.3% / 5.73%

Table 10: Stance-detection latency by number of candidate documents (median,

n=30

)

Configuration	CPU	GPU	Share of generation time (CPU $\rightarrow$ GPU)	GPU speedup
Single model / 20 documents (actual deployment)	945.3 ms	89.7 ms	16.0% $\rightarrow$ 1.52%	10.5 $\times$
Six-fold routing / 20 documents	929.4 ms	98.3 ms	15.8% $\rightarrow$ 1.67%	9.5 $\times$
Single model / 50 documents	3900.1 ms	337.4 ms	66.2% $\rightarrow$ 5.72%	11.6 $\times$
Six-fold routing / 50 documents (most conservative)	3932.9 ms	338.3 ms	66.7% $\rightarrow$ 5.74%	11.6 $\times$

Table 11:

2\times 2

decomposition of six-fold routing versus a single model and 20 versus 50 documents (median,

n=30

)

Figure 4: Direct between-group differences for groups with and without detection errors.

Corpus	Setting	Group	Ques- tions	Poison-aligned bias	95% confidence interval	Includes 0?
Pro	A: No defense	With misclassification	63	+0.381	[+0.140, +0.588]	No
Pro	A: No defense	All correct	146	+0.370	[+0.258, +0.479]	No
Pro	B: Balancing (no prompt)	With misclassification	63	+0.190	[+0.025, +0.339]	No
Pro	B: Balancing (no prompt)	All correct	146	+0.137	[+0.022, +0.252]	No
Pro	C: Complete method	With misclassification	62	+0.032	[ $-$ 0.211, +0.222]	Yes
Pro	C: Complete method	All correct	144	+0.021	[ $-$ 0.069, +0.119]	Yes

Table 12: Poison-aligned bias and 95% confidence intervals grouped by the presence of misclassification

Measure	A	C	Paired difference [95% CI]
Mean stance	+0.043	+0.033	A $-$ C: +0.010 [ $-$ 0.077,+0.092]
Relevance	4.719	4.876	C $-$ A: +0.157 [0.081,0.233]
Source support	4.805	4.786	C $-$ A: $-$ 0.019 [ $-$ 0.133,0.090]
Verifiable accuracy	4.790	4.757	C $-$ A: $-$ 0.033 [ $-$ 0.138,0.067]
Argument coverage	3.995	4.505	C $-$ A: +0.510 [0.343,0.690]

Table 13: Stance and automatic quality ratings without poisoning

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Property	Human-authored corpus (n = 1,478)	Injected documents (n = 588)
Median word count	66	66
Standard deviation of word count	57.1	6.4
Word-count range	0–361	45–82
Median within-group nearest-neighbor cosine similarity	0.772	0.798
Near-duplicate documents (cosine > 0.95)	6 (0.406%, 3 pairs)	0 (0 pairs)

Appendix

Table 14: Measured properties of the human-authored corpus and injected documents

Direction	Poisoning share	Valid n in A	Valid n in C	Paired n	Reduction in absolute distance from zero [95% CI]	Raw p	Holm-adjusted p
Pro	6.4%	209	208	208	$+0.106$ [ $-0.038$ , $+0.181$ ]	0.09058	0.17636
Pro	11.9%	209	208	208	$+0.216$ [ $+0.081$ , $+0.300$ ]	0.00120	0.00480
Pro	14.4%	209	208	208	$+0.293$ [ $+0.139$ , $+0.383$ ]	0.00020	0.00160
Pro	18.9%	209	206	206	$+0.350$ [ $+0.211$ , $+0.447$ ]	0.00020	0.00160
Con	6.4%	209	207	207	$+0.111$ [ $-0.015$ , $+0.205$ ]	0.08818	0.17636
Con	11.9%	208	209	208	$+0.173$ [ $+0.048$ , $+0.262$ ]	0.00300	0.00900

Appendix

Table 15: Strictly paired effect sizes and Holm-adjusted p-values

Setting	Document selection	Debiasing instruction
A: No defense	Top five retrieved documents	Not inserted
B: Balancing (no prompt)	Five documents after balancing	Not inserted
C: Complete method (balancing + prompt)	Five documents after balancing	Inserted
D: Prompt only	Same top five documents as A	Inserted

Appendix

Table 16: Prompt use across experimental settings

Criterion	Passed / assessed	Rate
All verifiable claims supported by supplied sources	252/252	100%
Clearly one-sided stance	252/252	100%
Stance direction matches the intended injection label	252/252	100%

Appendix

Table 17: Final human-validation outcomes for 252 sampled injected documents

Dimension	Pairs	Human 1 C $-$ A	Human 2 C $-$ A	GPT-5.4 C $-$ A
Relevance	50	+0.160	+0.120	+0.280
Source support	50	+0.020	+0.040	0.000
Verifiable accuracy	50	+0.080	+0.080	+0.040
Coverage	49	+0.347	+0.429	+0.735

Appendix

Table 18: Human and matched automatic quality differences

Item	Value
Stance composition of the top 20 documents	11 pro / 9 con / 0 neutral
Neutral supply after extending to rank 50	Still 0 according to classifier labels
Balancing target	2 pro + 2 con + 1 neutral
Actual selection	3 pro + 2 con + 0 neutral
Identity of the five selected documents	All genuine documents; 0 poisoned documents
Stance-classification accuracy	5 / 5 correct

Appendix

Table 19: Evidence composition for the missing-neutral failure case

Rank	Document ID	Genuine / poisoned	Detector label	Actual stance	Misclassified?
1	poison-t40-pro-5	Poisoned	Con	Pro	Yes *
2	poison-t40-pro-4	Poisoned	Pro	Pro	No
3	wiki-t40-p1	Genuine	Neutral	Neutral	No
4	poison-t40-pro-0	Poisoned	Pro	Pro	No
5	poison-t40-pro-6	Poisoned	Con	Pro	Yes *

Appendix

Table 20: Document-level details for the five documents selected for arena-t40-q9

RAG Poisoning Attacks

Retrieval-augmented generation (RAG) poisoning attacks manipulate retrieved knowledge to steer, degrade, or disrupt model outputs.

See all 71 papers

RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning
Jul 28, 2026Pushkal Kumar, Tucker Nielson, Tanish Kolhe +2RAG Poisoning Attacks RAG Security
In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Post-Retrieval Context Tampering
Sep 8, 2026Iliano FasolinoRAG Poisoning Attacks RAG Security
Department of Computer Science University of Milan Milan, Italy
PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates
Aug 5, 2026Zijian Wang, Yubo Zhu, Muzhi Dong +7Knowledge Conflicts in Language Models RAG Poisoning Attacks
School of Computer Science, Nanjing University, Nanjing 210023, China · State Key Laboratory for Novel Software Technology, Nanjing University, Nanjing 210023, China

Jul 28, 2026J/K move · Enter open · S save

RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning

Pushkal Kumar, Tucker Nielson, Tanish Kolhe, Shubham Zala+1

RAG Poisoning Attacks RAG Security RAG Robustness

Open paper AskPDF arXiv

Retrieval-Augmented Generation (RAG) systems ground large language models (LLMs) in external corpora, but this reliance exposes them to corpus poisoning: maliciously injected passages that manipulate retrieved evidence. We introduce RAGuard, a layered defense against factual corpus-poisoning attacks on RAG pipelines. The first layer adversarially fine-tunes a dense retriever on synthetic poisoned documents (fabricated facts, contradictions, and reasoning traps), teaching it to downrank malicious passages before generation. The second layer, the Zero-Knowledge Inference Patch ZKIP, is a label-free, black-box filter: for each retrieved document, it performs a leave-one-out decode and scores the document by the semantic shift and output-entropy change that its removal induces. ZKIP requires no poison labels, no ground-truth answers, and no access to model internals; it compares the model's own answers under counterfactual contexts. On poisoned Natural Questions at 5--30% poison ratios, adversarial retriever training alone reduces but does not eliminate attack success, while ZKIP drives the measured attack success rate to 0.000 in every defended configuration, keeping Recall@5 within 0.03 of the clean-corpus baseline. Supervised analyses on both Natural Questions and BEIR (NFCorpus) confirm that the counterfactual signals ZKIP relies on carry learnable poison structure. The defense costs

k{+}1

generator passes per query (

6\times

for

k{=}5

); we analyze batching and early-stopping approximations that reduce this overhead. We also show that keyword-preserving poisons leave lexical retrievers such as BM25 essentially unaffected, an observation that delineates the boundary of the threat model. Code, datasets, and evaluation harnesses are released for reproducibility.

Abstract

RAG Poisoning Attacks

Explore similar work

RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning

In RAG We Trust? Measuring Robustness of Retrieval-Augmented Generation Under Post-Retrieval Context Tampering

PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates