An adversary inserts factually defensible documents that disproportionately support one stance. The retrieval system ranks them as content, and the generator treats the selected evidence mix as a representative sample. At an average 18.9% share of poisoned documents in the evaluated ProCon corpus, each of four generator models shifted its stance in the…
Inspect the ClaimsCase · DiggingBeagle record
Accurate but selectively one-sided retrieved documents shifted RAG model positions
The attack changes the balance of retrieved evidence rather than issuing an explicit instruction to a model.
Scope
This is controlled retrieval and stance measurement. Balanced quotas can introduce false equivalence when trustworthy real-world evidence is genuinely asymmetric.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The researchers inject factually accurate but selective documents and measure stance changes under controlled retrieval. Balanced evidence may reduce their measured shifts, but can produce false symmetry when independent facts are not equally supported. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-006-A · CLM-CP22-006-B · Factual Yet One-Sided: Stance Poisoning and Evidence Balancing in RAG
At a glance
Independent source reliability, real editorial bias and evidence-quality weighting were not resolved by the study.
Limits and uncertaintyFull account
An adversary inserts factually defensible documents that disproportionately support one stance. The retrieval system ranks them as content, and the generator treats the selected evidence mix as a representative sample.
At an average 18.9% share of poisoned documents in the evaluated ProCon corpus, each of four generator models shifted its stance in the attacker-favored direction. The researchers report their stance-balanced retrieval and prompting method reducing absolute stance deviation by roughly 0.106 to 0.350 in their controlled concentration comparison. Primary evidence.
This is controlled retrieval and stance measurement. Balanced quotas can introduce false equivalence when trustworthy real-world evidence is genuinely asymmetric.
Preserve provenance and diversity at retrieval time while allowing evidence weight to depend on corroborated quality, not equal numerical representation of opposing claims.
Claims & evidence
CLM-CP22-006-AAt an average 18.9% share of poisoned documents in the evaluated ProCon corpus, each of four generator models shifted its stance in the attacker-favored direction.supported
Basis: reported finding
- supportsFactual Yet One-Sided: Stance Poisoning and Evidence Balancing in RAGprimary disclosure
Abstract; Section 4.2, cross-generator effects
CLM-CP22-006-BThe researchers report their stance-balanced retrieval and prompting method reducing absolute stance deviation by roughly 0.106 to 0.350 in their controlled concentration comparison.supported
Basis: reported finding
- supportsFactual Yet One-Sided: Stance Poisoning and Evidence Balancing in RAGprimary disclosure
Section 4.2, Tables 3 and 4
Controls and mitigations
- Preserve provenance and diversity at retrieval time while allowing evidence weight to depend on corroborated quality, not equal numerical representation of opposing claims.
Unknowns and contradictions
- Independent source reliability, real editorial bias and evidence-quality weighting were not resolved by the study.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199