Each section below summarizes one paper's reported method, experiments, and limits from its full review. The studies use different tasks and metrics; their results are not directly comparable.
arXiv:2611.04264
Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning
This study stress-tests the retrieval boundary of retrieval-augmented generation systems under query-targeted corpus poisoning. Across 623 BEIR queries from SciFact and NFCorpus, five poisoned documents per query sharply reduce retrieval quality and eliminate strict safe retrieval reliability in several settings, even when poisoning affects only 0.10–0.14% of the corpus. Full-query anchoring drives most BM25 degradation, while appended content additionally shifts LSA and Hybrid rankings. A BGE-small validation shows the same high target exposure for query-only poisoning, indicating that retrieval admission—not malicious payload semantics—is the dominant failure mechanism in the tested conditions.
How it works
The threat model fixes the clean corpus, benchmark query, relevance labels, retriever parameters, and k. The attacker can publish indexed documents but cannot modify the query or retrieval system. Poison documents are generated per target query, with P∈{1,3,5}, and contamination ranges from one target at a time to every evaluation target.
What the paper evaluates
The evaluation uses the BEIR test splits of SciFact, containing 5,183 documents and 300 judged queries, and NFCorpus, containing 3,633 documents and 323 judged queries. BM25, LSA, and Hybrid are evaluated with nDCG@10 and Recall@10 as ranking-utility measures. TargetExp and AnyExp measure poison admission, Evid. measures judged evidence availability, SafeR requires evidence plus zero admitted poison, and the four-state decomposition distinguishes evidence with or without poison from no evidence with or without poison. At isolated P=5, five query-targeted documents reduce Hybrid nDCG from .465 to .183 on SciFact and from .267 to .160 on NFCorpus.
Limit to keep in view
The evaluation stops at retrieval admission, so target exposure is not equivalent to downstream instruction-following or end-to-end attack success.
arXiv:2611.07928
ZeroRAG: Adaptive Semantic Peer Routing for Decentralized Retrieval-Augmented Generation
ZeroRAG is a decentralized retrieval layer for RAG that routes semantic queries across a peer overlay without a centralized index, global data structure, or centralized orchestration. Each peer maintains bounded neighbor advertisements and a cache of recently routed queries; a best-first walk uses these signals to find relevant documents while rewiring the overlay toward useful peers. Across AOL-IA, Amazon Electronics, and PubMedQA, ZeroRAG improves retrieval recall and message efficiency over Semantica and DHT-LSH, reaches 93.0% recall and 77% RAG answer accuracy versus 97.3% and 79% for centralized HNSW on PubMedQA, recovers to 95.5% recall after 50% peer failure, and maintains above 98% recall at up to 100,000 peers.
How it works
Each peer maintains local documents D, a FIFO neighbor list N with capacity δn, advertisements A received from neighbors, and a FIFO routed-query memory M with capacity δm. Advertisements summarize document embeddings that peers choose to expose. When a query arrives, the receiving peer compares the query embedding with both advertised document embeddings and cached query embeddings, allowing referrals to reflect observed query traffic as well as local inventory. The querying peer maintains a frontier of candidate peers.
What the paper evaluates
The evaluation uses three real-world workloads. AOL-IA contains query-and-click events and is evaluated as single-target retrieval; Amazon Electronics contains category-derived product queries with multiple relevant products; and PubMedQA contains 1,000 biomedical questions, each expanded with five GPT-5-nano rephrasings. PubMedQA is also used for end-to-end RAG with Phi3.5-mini-instruct. The main decentralized baselines are Semantica, which uses a globally maintained semantic trie, and DHT-LSH, which combines locality-sensitive hashing with DHT lookups. Centralized HNSW is used as an upper-bound-like comparison for end-to-end PubMedQA.
Limit to keep in view
Because ZeroRAG has no global index, retrieval is best-effort and cannot provide the routing-time guarantees associated with structures such as Kademlia.
arXiv:2611.06715
Reasoning over Non-Parametric Memory in Multilingual LLMs: A Cognitive-Based Analysis of Relational Knowledge
The paper introduces Rel-Bloom, a controlled multilingual diagnostic for testing whether language models reason over facts supplied in context rather than relying on memorized entity associations. It evaluates 450 multiple-choice questions built from 30 Wikidata relations across five Bloom-inspired task levels and three veracity conditions, covering 43 models, six languages, two multilingual settings, and 226,800 predictions. Accuracy drops sharply from Apply to Analyze in open-weight models, Evaluate remains difficult even for near-ceiling models, and Counterfactual contexts are generally harder than Factual contexts. The results show that higher model capability does not guarantee reliable evidence-conditioned relational reasoning.
How it works
The benchmark begins with candidate relations from Wikidata5M, stratified into Low, Medium, and High usage tiers using MediaWiki property-frequency counts. The authors manually select 10 relations per tier and one representative factual triple (h, p, t) per relation, prioritizing semantic clarity, domain diversity, and non-overlapping entities.
What the paper evaluates
The central benchmark is Rel-Bloom, constructed from Wikidata5M candidates and 30 manually curated Wikidata relations. It contains 90 questions per Bloom level, with 30 questions per veracity condition within each level and 10 questions per usage tier. The evaluation covers Arabic, Chinese, English, Hindi, Persian, and Spanish in hybrid cross-lingual and fully translated settings, using 41 open-weight models from seven families, eight open-weight series, and two Gemini models. Scaling generally improves accuracy.
Limit to keep in view
Each relation is represented by one source triple, so relation-level effects may partly reflect the selected entities and fact and may not generalize to unseen triples.
arXiv:2611.06481
ArcRAG: Agentic Compositional Retrieval over Knowledge Graphs
ArcRAG answers questions that require combining facts across a knowledge graph by exploring the graph around question entities, inducing a query-specific interface of available relations and paths, and executing planned traversals as read-only Cypher. On MuSiQue, HotpotQA, and TriviaQA, the same per-dataset configuration operates over both schema-guided and open-information-extraction graphs. The paper reports stronger results on the schema-guided graphs, showing that query-time adaptation supports transfer across these two constructions but does not make their accuracy equivalent.
How it works
The target is a labeled property graph whose schema is read by introspection. Given question anchors, ArcRAG explores nearby structure to produce a query-local interface: relation descriptors, observed signatures, and paths that confirm them. Exploration also surfaces candidate aliases and paraphrased relation descriptors so later steps can use variants present in noisy graphs. A planner selects a bounded set of subplans and an answer type from the question and induced interface. The generator compiles each hop as a read-only Cypher query.
What the paper evaluates
The paper evaluates MuSiQue, HotpotQA, and TriviaQA. MuSiQue composes up to four single-hop questions with bridging entities absent from the question; HotpotQA is predominantly two-hop; TriviaQA is predominantly single-hop and serves as a control. Graphs are frozen before evaluation, questions are answered end to end without gold passages, entities, or hop counts, and the main results follow the validation-sample convention of HippoRAG and IRCoT. Component ablations use a stratified 100-question sample from all three datasets on both graph families. Exact match (EM) is the primary metric; token-level F1 is included for comparison with prior work, which reports only F1 on TriviaQA.
Limit to keep in view
The transfer study covers two graph families over three encyclopedic QA benchmarks; it does not establish transfer to curated ontologies or different node granularities.
Read the full reviews
- Reliability Stress Testing of RAG Retrieval under Query-Relevant Corpus Poisoning · arXiv:2611.04264
- ZeroRAG: Adaptive Semantic Peer Routing for Decentralized Retrieval-Augmented Generation · arXiv:2611.07928
- Reasoning over Non-Parametric Memory in Multilingual LLMs: A Cognitive-Based Analysis of Relational Knowledge · arXiv:2611.06715
- ArcRAG: Agentic Compositional Retrieval over Knowledge Graphs · arXiv:2611.06481
Source note: findings and limitations above come from the linked full paper reviews. Follow each original arXiv paper for the authors' complete methods and results.