RAG's problem is trust, not retrieval: poisoned context slips past relevance, preprints find

Pick the retriever per question

In a preprint posted this week, RAGCompass addresses the limitation of static retriever routing by implementing a reranker-based approach that evaluates passage sets directly. The method eliminates the need for retriever-specific parameters, allowing the system to generalise to new corpora and unseen retriever models. The preprint reports RAGCompass improves answer F1 by 28% relative to the best fixed retriever, and maintains performance gains under unseen corpora, retrievers, or readers, whereas query-only baselines degrade. The practical point is that the best retriever depends on the question, and a router that looks at the passages beats a router that only looks at the query. m:…1397

The generalisation claim is the one to watch. A router that needs retraining for every new data source is a maintenance burden, not a product. RAGCompass is designed to avoid that, and the preprint's cross-corpus results are its main evidence. As with all preprint results, they come from the authors' own experiments. m:…1397

Relevance is not truth

A second preprint names the gap RAGCompass does not address. The authors describe a security-reliability gap in retrieval-augmented generation, where high semantic relevance does not guarantee factual accuracy. Their Evaluation Agent uses a multi-signal Trust Index to detect knowledge poisoning and malicious instruction injection before generation occurs. The approach was validated on Llama 3.3 70B, and the Evaluation Agent achieves 100% recall on instruction injection attacks when tested with that model, according to the preprint. m:…6939

The preprint is honest about the limit. Cross-dataset generalisation for the Evaluation Agent requires domain-specific calibration, as shown by weaker performance on the FEVER dataset. A trust score tuned for secure coding does not transfer cleanly to fact-checking. The implication for builders is that a RAG system needs a trust layer calibrated to its own corpus, not a generic one borrowed from another domain. m:…6939

The vectors themselves can be tampered with

A third preprint finds the vulnerability underneath the retrieval layer. The authors show that signed knowledge packs do not verify the integrity of precomputed embedding vectors in offline retrieval systems, so attackers can manipulate vectors to hijack retrieval results. Integrity audits of FAISS product-quantization indexes are insufficient, according to the preprint, allowing tampered vectors to place attacker documents first in 25% of targets. Common floating-point and dynamic-INT8 inference pipelines also lack bit-reproducibility across different batch sizes or hardware architectures, which makes verification harder. m:…3351

The proposed fix is to verify quantization codes with a calibrated guard band and canonicalization, which the preprint says accepts all honest vectors while preventing vector tampering. The margin law in the paper states that the hijack rate of a RAG system equals the distribution of angular retrieval margins at the chosen cosine tolerance. For edge-deployed RAG, where the vector store ships with the device, this is not an exotic threat. It is the threat model. m:…3351

And the chunking may not matter much

A fourth preprint delivers a useful deflation. The authors systematically evaluated eight chunking strategies for retrieval systems, and found computationally expensive chunking methods rarely provide consistent gains over simpler strategies. The optimal chunking strategy is contingent on the embedding model, dataset, and corpus size, according to the preprint, and chunking methods with similar retrieval performance can differ substantially in operational costs such as indexing throughput, query latency, and memory usage. The advice is to design chunking as a multi-objective problem, balancing retrieval quality against cost, rather than buying the most elaborate splitter available. m:…9996

Taken together, the week's RAG papers redraw the priority list. Routing the retriever and simplifying the chunking save money. Verifying the vectors and scoring the trust of the context save the product. A RAG system that retrieves well and trusts blindly is, in these preprints' account, a system waiting to be poisoned. m:…1397 m:…6939 m:…3351 m:…9996