Factual Yet One-Sided: Stance Poisoning and Evidence Balancing in Retrieval-Augmented Generation

Summary

This research shows that RAG systems take on the stance of retrieved documents: at a mean poisoning share of 18.9% in ProCon documents, four generation models from different vendors shifted toward the poisoning direction, and the shift grew monotonically across four concentration levels. The authors propose a Stance-Balancing Middleware between retriever and generator, combining stance detection, fixed balancing (2 supporting, 2 opposing, 1 neutral) and a debiasing prompt, with no extra LLM calls. The method reduced stance deviation by an estimated 0.106 to 0.350 across eight settings, with residual pro-poisoning estimates of +0.045 to +0.063 in some cross-model results.

Mitigation

The source proposes a Stance-Balancing Middleware positioned between the retriever and the generator, consisting of stance detection, fixed balancing (2 supporting + 2 opposing + 1 neutral), and a debiasing prompt, without additional large language model calls.

Topics

• Retrieval-augmented generation

Related items

• HighCVE-2026-115924: Rembg unauthenticated file disclosure through public /api/remove endpointSimilar attack · NVD/CVE Database
• HighCVE-2026-115915: vLLM image loading flaw allows EPS payload dispatchSimilar attack · NVD/CVE Database
• LowThe RealReal won’t let AI agents hog designer clothingSimilar attack · The Verge (AI)
• HighCVE-2026-115912: vLLM arbitrary Python execution via forged shared-memory multimodal dataSimilar attack · NVD/CVE Database
• InfoThe Agent in the Middle: How AI-Mediated Access Reshapes Web Vulnerability ExploitationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)