In-domain Corpus Poisoning Attack on NQ
3ASRWithout Attack
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| Without Attack2026.01 | 3 | — | — | — | — | — | — | |
| Disinformation2026.01 | 31 | — | — | — | — | — | 0.56 | |
| CEM Attacktrigger fragment length=12026.01 | 50 | — | — | — | — | — | 0.86 | |
| CEM Attacktrigger fragment length=32026.01 | 54 | — | — | — | — | — | 1 | |
| CEM Attacktrigger fragment length=52026.01 | 54 | — | — | — | — | — | 1 | |
| Baseline2026.01 | 58 | — | — | — | — | — | 0.99 | |
| CEM Attacktrigger fragment length=22026.01 | 58 | — | — | — | — | — | 1 | |
| CEM Attacktrigger fragment length=42026.01 | 58 | — | — | — | — | — | 1 | |
| CRCPModel=GPT-4o, Defense Method=TrustRAG2026.06 | 69.02 | — | — | — | — | — | — | |
| CRCPModel=GPT-4o, Defense Method=ASTUTERAG2026.06 | 73.07 | — | — | — | — | — | — | |
| CRCPModel=Qwen2.5-7B, Defense Method=TrustRAG2026.06 | 73.29 | — | — | — | — | — | — | |
| CRCPModel=DeepSeek-R1, Defense Method=SeconRAG2026.06 | 73.76 | — | — | — | — | — | — | |
| CRCPModel=DeepSeek-R1, Defense Method=TrustRAG2026.06 | 75.82 | — | — | — | — | — | — | |
| CRCPModel=Qwen2.5-7B, Defense Method=SeconRAG2026.06 | 77.17 | — | — | — | — | — | — | |
| CRCPModel=DeepSeek-R1, Defense Method=ASTUTERAG2026.06 | 77.3 | — | — | — | — | — | — | |
| CRCPModel=LLaMA-2-7B, Defense Method=ASTUTERAG2026.06 | 77.49 | — | — | — | — | — | — | |
| CRCPModel=Qwen2.5-7B, Defense Method=ASTUTERAG2026.06 | 78.36 | — | — | — | — | — | — | |
| CRCPModel=GPT-4o, Defense Method=SeconRAG2026.06 | 78.41 | — | — | — | — | — | — | |
| CRCPModel=LLaMA-2-7B, Defense Method=SeconRAG2026.06 | 78.85 | — | — | — | — | — | — | |
| CRCPModel=LLaMA-2-7B, Defense Method=TrustRAG2026.06 | 79.13 | — | — | — | — | — | — | |
| CRCPModel=Qwen2.5-7B, Defense Method=InstructRAG2026.06 | 80.94 | — | — | — | — | — | — | |
| CRCPModel=LLaMA-2-7B, Defense Method=InstructRAG2026.06 | 81.26 | — | — | — | — | — | — | |
| CRCPModel=GPT-4o, Defense Method=InstructRAG2026.06 | 84.11 | — | — | — | — | — | — | |
| CRCPModel=DeepSeek-R1, Defense Method=InstructRAG2026.06 | 86.26 | — | — | — | — | — | — | |
| CRCPModel=Qwen2.5-7B, Defense Method=VanillaRAG2026.06 | 91.53 | — | — | — | — | — | — | |
| CRCPModel=GPT-4o, Defense Method=VanillaRAG2026.06 | 92.19 | — | — | — | — | — | — | |
| CRCPModel=LLaMA-2-7B, Defense Method=VanillaRAG2026.06 | 93.09 | — | — | — | — | — | — | |
| CRCPModel=DeepSeek-R1, Defense Method=VanillaRAG2026.06 | 95.88 | — | — | — | — | — | — | |
| AGGDNumber of adversarial passages=12024.06 | — | 92.5 | 63.45 | 80.92 | 6.88 | 2.19 | — | |
| Hot FlipNumber of adversarial passages=12024.06 | — | 91.08 | 58.43 | 65.68 | 5.4 | 2.03 | — | |
| RandomNumber of adversarial passages=12024.06 | — | 80.24 | 32.5 | 31 | 3.7 | 1.66 | — |