Toward Robust RALMs: Revealing the Impact of Imperfect Retrieval on Retrieval-Augmented Language Models
On the map: Retrieval-augmented generation → Privacy and security of RAG
Abstract (arXiv)
Retrieval Augmented Language Models (RALMs) have gained significant attention for their ability to generate accurate answer and improve efficiency. However, RALMs are inherently vulnerable to imperfect information due to their reliance on the imperfect retriever or knowledge source. We identify three common scenarios-unanswerable, adversarial, conflicting-where retrieved document sets can confuse RALM with plausible real-world examples. We present the first comprehensive investigation to assess how well RALMs detect and handle such problematic scenarios. Among these scenarios, to systematically examine adversarial robustness we propose a new adversarial attack method, Generative model-based ADVersarial attack (GenADV) and a novel metric Robustness under Additional Document (RAD). Our findings reveal that RALMs often fail to identify the unanswerability or contradiction of a document set, which frequently leads to hallucinations. Moreover, we show the addition of an adversary significantly degrades RALM's performance, with the model becoming even more vulnerable when the two scenarios overlap (adversarial+unanswerable). Our research identifies critical areas for assessing and enhancing the robustness of RALMs, laying the foundation for the development of more robust models.
Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 49 of its 52 references that are in the map. First posted on arXiv 19 Oct 2024.
Builds on
49 of 52 references.
References · 49
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2023GPT-4 Technical Reportcited by 18,396
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
- 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
- 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
- 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
- 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
- 2023Qwen Technical Reportcited by 3,344
- 2023Mistral 7Bcited by 3,164
- 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,955
- 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
- 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
37 more
- 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
- 2023PaLM 2 Technical Reportcited by 1,162
- 2022When Not to Trust Language Models: Investigating Effectiveness of Parametric and Non-Parametric Memoriescited by 1,128
- 2022Atlas: Few-shot Learning with Retrieval Augmented Language Modelscited by 952
- 2024Gemma: Open Models Based on Gemini Research and Technologycited by 916
- 2023Large Language Models Can Be Easily Distracted by Irrelevant Contextcited by 841
- 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 792
- 2017Reading Wikipedia to Answer Open-Domain Questionscited by 777
- 2023In-Context Retrieval-Augmented Language Modelscited by 702
- 2019Latent Retrieval for Weakly Supervised Open Domain Question Answeringcited by 695
- 2019Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailmentcited by 671
- 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 571
- 2023Is ChatGPT a General-Purpose Natural Language Processing Task Solver?cited by 488
- 2021ColBERTv2: Effective and Efficient Retrieval via Lightweight Late Interactioncited by 476
- 2023Making Retrieval-Augmented Language Models Robust to Irrelevant Contextcited by 369
- 2021Entity-Based Knowledge Conflicts in Question Answeringcited by 356
- 2023Adaptive Chameleon or Stubborn Sloth: Revealing the Behavior of Large Language Models in Knowledge Conflictscited by 341
- 2022Selection-Inference: Exploiting Large Language Models for Interpretable Logical Reasoningcited by 334
- 2023RECOMP: Improving Retrieval-Augmented LMs with Compression and Selective Augmentationcited by 256
- 2022Out-of-Distribution Detection and Selective Generation for Conditional Language Modelscited by 197
- 2023RA-DIT: Retrieval-Augmented Dual Instruction Tuningcited by 195
- 2023Chain-of-Note: Enhancing Robustness in Retrieval-Augmented Language Modelscited by 184
- 2020How Context Affects Language Models' Factual Predictionscited by 181
- 2022Large Language Models with Controllable Working Memorycited by 169
- 2019Combating Adversarial Misspellings with Robust Word Recognitioncited by 163
- 2023Orca 2: Teaching Small Language Models How to Reasoncited by 159
- 2023Investigating the Factual Knowledge Boundary of Large Language Models with Retrieval Augmentationcited by 147
- 2022Rich Knowledge Sources Bring Complex Knowledge Conflicts: Recalibrating Models to Reflect Conflicting Evidencecited by 144
- 2020Contextualized Perturbation for Textual Adversarial Attackcited by 136
- 2023Evaluating Open-Domain Question Answering in the Era of Large Language Modelscited by 111
- 2023Won't Get Fooled Again: Answering Questions with False Premisescited by 48
- 2020Challenges in Information-Seeking QA: Unanswerable Questions and Paragraph Retrievalcited by 44
- 2022Synthetic Disinformation Attacks on Automated Fact Verification Systemscited by 44
- 2021Attacking Open-domain Question Answering by Injecting Misinformationcited by 41
- 2022Standing on the Shoulders of Giant Frozen Language Modelscited by 33
- 2022Phrase-level Textual Adversarial Attack with Label Preservationcited by 23
- 2022TASA: Deceiving Question Answering Models by Twin Answer Sentences Attackcited by 15
Built on by
Citing papers per year: 2025: 3; 2026: 5.
8 papers.
- 2025Medical large language models are easily distractedcited by 9
- 2025MultiHoax: A Dataset of Multi-hop False-Premise Questionscited by 9
- 2025Do Retrieval Augmented Language Models Know When They Don't Know?cited by 5
- 2026MemGuard: Preventing Memory Contamination in Long-Term Memory-Augmented Large Language Modelscited by 3
- 2026Same Agent, Different Answers: A Repeat-Aware Audit of Corpus-Induced Answer Churn in Retrieval-Augmented QAcited by 1
- 2026DEEPMED Search: An Open-Source Agentic Platform for Medical Deep Research with Introspective Verificationcited by 0
- 2026When RAG Fails to Equalize: Geo-bias in Factual Question Answering over Public Companiescited by 0
- 2026BENCHCOMPASS: From Scores to Signals for Training and Harness Decisions in Payment-Domain LLMscited by 0
- 2026BENCHCOMPASS: From Scores to Signals for Training and Harness Decisions in Payment-Domain LLMs16 Sep 2026
- 2026When RAG Fails to Equalize: Geo-bias in Factual Question Answering over Public Companies26 Aug 2026
- 2026Same Agent, Different Answers: A Repeat-Aware Audit of Corpus-Induced Answer Churn in Retrieval-Augmented QA24 Aug 2026
- 2026DEEPMED Search: An Open-Source Agentic Platform for Medical Deep Research with Introspective Verification29 Jun 2026
- 2026MemGuard: Preventing Memory Contamination in Long-Term Memory-Augmented Large Language Models27 May 2026
- 2025Do Retrieval Augmented Language Models Know When They Don't Know?1 Sep 2025
- 2025MultiHoax: A Dataset of Multi-hop False-Premise Questions30 May 2025
- 2025Medical large language models are easily distracted1 Apr 2025
Similar, not cited
Close in wording, no citation either way
- 2024Enhancing Noise Robustness of Retrieval-Augmented Language Models with Adaptive Adversarial Training
- 2025Do Retrieval-Augmented Language Models Adapt to Varying User Needs?
- 2023Why So Gullible? Enhancing the Robustness of Retrieval-Augmented Models against Counterfactual Noise
- 2024Evaluating Robustness of Generative Search Engine on Adversarial Factual Questions
- 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains
- 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generation
- 2024Towards More Robust Retrieval-Augmented Generation: Evaluating RAG Under Adversarial Poisoning Attacks
- 2025Evaluating the Retrieval Robustness of Large Language Models