RAG

TL;DR for operators When a translation is already mostly correct, another broad LLM rewrite can create new problems faster than it removes the remaining one. In Wang and Wu’s domain-specific machine-translation study,1 an initial EN→DE post-edit reached 89.93 COMET-22. Six of seven tested second-round editors failed to improve that result; five lowered it, one left it unchanged, and only reusing Claude Sonnet 4.5 produced a small increase to 90.07. ...

TL;DR for operators A retrieved document does not need to look malicious to corrupt a generative-search answer. In Counter-GEO-Bench, carefully constructed documents remain fluent and topically relevant while inserting a targeted false claim; in the undefended pipeline, 55.7% of these attacks move the generated answer toward that claim across three tested models.1 ...

TL;DR for operators An enterprise assistant can retrieve three passages that all look relevant and still answer from a corrupted evidence base. Once the generator has been instructed to rely on retrieved material, the integrity of that material becomes part of the system’s reliability boundary. Iliano Fasolino’s 2026 experiment1 measures this directly. In a small local RAG setup, poisoned-answer accuracy fell from 69.4% in the nominal 0-of-3 corruption condition to 43.5% when all three retrieved passages were corrupted. The rate of runs where a clean-context answer was correct but its poisoned counterpart was not rose from 9.5% to 34.0%. ...

TL;DR for operators A retrieval-security team can reasonably start by looking for poisoned documents that repeat a user’s question or arrive as an unusually tight cluster of near-duplicate vectors. CamoDocs shows why neither signal should be treated as a durable property of poisoning. In matched-budget experiments, a simple query detector keeps three earlier attacks between 5.4% and 7.6% attack success, while CamoDocs reaches 75.2%. Put the target query back into CamoDocs, and success falls to 7.8%. The paper’s ablations then isolate the harder problem: deliberately spreading poisoned-document embeddings raises attack success against the clustering-based TrustRAG defense from 11.5% to 28.7%. ...

TL;DR for operators A natural-language interface to a knowledge graph can look healthy while producing the wrong answer. In the experiments behind EXYGEN, several configurations generated executable SPARQL more than 97% of the time yet achieved zero correct execution results. The strongest configuration reached 97.8% executability and 41.9% relaxed exact match on execution results only after combining graph-derived metadata, explicit schema constraints, retrieved triples, and question-query examples. ...

TL;DR for operators An enterprise assistant may retrieve a long internal document because one sentence is relevant to a user question. If the entire passage is then handed to the generator, the model receives much more information than it needs—and a successful prompt injection has more material available to disclose. KFS-RAG addresses that exposure point after retrieval but before generation. Instead of forwarding raw passages, it identifies query-relevant evidence and converts it into a compact set of facts. In the paper’s open-domain QA evaluation, this reduced untargeted chunk recovery from 70.8% with Vanilla RAG to 21.03%, while answer BLEU-1 and ROUGE-L remained close to the raw-context baseline. ...

TL;DR for operators A retrieved prompt can contain one useful sentence or evidence distributed across several passages. Giving both requests the same compressed-context budget assumes that the amount of information worth preserving is constant. The evidence in ATACompressor1 suggests that assumption is costly: on MSMARCO with LLaMA-2-7B, removing adaptive allocation reduced F1 from 50.06 to 47.52 and compression ratio from 27.36x to 19.06x; removing selective compression reduced F1 further to 40.83. ...

TL;DR for operators A technical assistant searching thousands of papers has two competing needs: preserve enough surrounding text to understand experimental context, and connect facts that are distributed across papers. A single retrieval score can make that choice look simpler than it is. In Gupta et al.’s Polymer Literature Scholar study,1 graph-based retrieval achieved full-corpus recall of 0.903–0.938, versus 0.717 for dense text retrieval. Yet answer accuracy remained close: 0.964–0.973 for GraphRAG and 0.960 for VectorRAG. The retriever that was substantially better at recovering designated evidence was only modestly better at producing correct answers. ...

TL;DR for operators Most retrieval systems treat the external knowledge layer as fixed infrastructure: build an index or graph, then improve the model, retriever, or reranker around it. KBevo tests a different decision. It lets downstream answer quality influence how the knowledge store itself is constructed. That changes what can be optimized. After reinforcement learning, average exact match rises from 36.2 to 41.3 for the 1.7B model and from 36.8 to 46.6 for the 4B model across four QA benchmarks. The resulting structured store can also be edited and reused without retraining the language model. ...

TL;DR for operators A RAG system can return the right answer, attach a source that genuinely supports that answer, and still leave one critical question unresolved: did that source actually influence the model’s answer generation? A mechanistic study of Llama-3.1-8B-Instruct finds that inline citation behavior is not controlled by one dedicated citation feature. It emerges from a distributed sequence of attention heads and MLPs that includes early entity enrichment, matching between document and question entities, mid-layer processing, and late aggregation that shifts the model toward emitting a citation marker rather than ending the sentence.1 ...