RobustRAG
Robustness of RAG systems under corpus poisoning and query noise
Overview
RAG systems are usually evaluated on how well they answer clean questions against a clean corpus — not on what happens when either one degrades. RobustRAG builds a reproducible evaluation harness around BGE embeddings and FAISS retrieval, then deliberately breaks both sides: it poisons the corpus with near-duplicate, contradictory, and irrelevant documents, and separately perturbs query embeddings with noise, measuring retrieval quality (Recall@5, MRR) and generation quality (Exact Match, BLEU, ROUGE-L) across all 10,570 questions in SQuAD 1.1 under each condition.
Key features
- Reproducible evaluation pipeline combining BGE embeddings with FAISS retrieval over the full SQuAD 1.1 corpus
- Three designed corpus-poisoning strategies: near-duplicate injection, contradictory documents, and irrelevant documents
- Query embedding noise injection, isolated as its own failure mode rather than bundled with corpus poisoning
- Retrieval metrics (Recall@5, MRR) and generation metrics (Exact Match, BLEU, ROUGE-L) tracked side by side under every condition
- A lightweight near-duplicate suppression defense, evaluated rather than assumed to help
Architecture & engineering decisions
BGE embedding model encoding both the SQuAD corpus and incoming queries into a shared vector space
FAISS index over the full corpus for dense retrieval, rebuilt per poisoning condition to keep evaluation runs isolated
A poisoning-strategy module that injects near-duplicate, contradictory, or irrelevant documents into the corpus at a controlled rate
A separate query-noise module perturbing query embeddings directly, decoupled from corpus poisoning so each failure mode can be attributed independently
An evaluation harness scoring every condition on Recall@5, MRR, Exact Match, BLEU, and ROUGE-L against the same held-out question set
Challenges & how I solved them
Attributing a drop in answer quality to retrieval failure versus generation failure
Tracked retrieval metrics (Recall@5, MRR) and generation metrics (EM, BLEU, ROUGE-L) as separate axes per condition, instead of a single end-to-end score, so degradation could be traced to the stage that actually caused it.
A near-duplicate suppression defense that was expected to help instead hurt Recall@5 by 4.6%
Investigated rather than discarded the result — traced it to the defense suppressing legitimately similar (not just poisoned) passages, and reported it as a real structural limitation of similarity-based defenses instead of quietly dropping the experiment.
Isolating query embedding noise as a failure mode distinct from corpus poisoning
Ran query-noise trials as a fully separate experimental arm with the corpus held clean, which is what surfaced it as the dominant failure mode — a 48% relative Exact Match degradation — rather than letting it get averaged away in a combined condition.
Lessons learned
- The failure mode you designed the experiment around (corpus poisoning) isn't always the dominant one — query noise turned out to matter more, and only a decoupled evaluation design could show that.
- A defense that improves the metric it targets can quietly regress another one; evaluating on a single axis would have called the near-duplicate suppression a straightforward win.
Stack