PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantifying and Improving the Robustness of Retrieval-Augmented Language Models Against Spurious Features in Grounding Data

Shiping Yang, Jie Wu, Wenbiao Ding, Ning Wu, Shining Liang, Ming Gong, Hongzhi Li, Hengyuan Zhang, Angel X. Chang, Dongmei Zhang

arXiv:2503.05587v3cs.CLcs.AIcs.LG

TL;DR

RAG robustness research has largely focused on explicit noise, with spurious features in grounding data lacking systematic study and evaluation. The paper introduces SURE to assess and mitigate this issue, and reports that spurious features are widespread and challenging while training strategies improve robustness.

  • Problem

    Research on grounding-data robustness has emphasized explicit noise (Wu et al., 2024b; Cuconasu et al., 2024), leaving semantic-agnostic spurious features without dedicated benchmarks or metrics.

    Source: §1 · p. 1

  • Method

    SURE combines a taxonomy, tailored evaluation metrics, and synthetic-data generation to assess robustness, curate SIG_Wiki, and support two training-based strategies.

    Source: §1 · p. 2

  • Results

    Evaluations indicate that spurious features are widespread and challenging, and the two training-based strategies improve RALM robustness.

    Source: §1 · p. 2, §5 · p. 9

  • Takeaways & Limitations

    SURE enables systematic evaluation and mitigation of spurious features, providing a basis for future research.

    Source: §5 · p. 9

    Some unidentifiable spurious features may fall outside SURE’s taxonomy and therefore remain unquantified.

    Source: Limitations · p. 9

Abstract

from arXiv · show

Robustness has become a critical attribute for the deployment of RAG systems in real-world applications. Existing research focuses on robustness to explicit noise (e.g., document semantics) but overlooks implicit noise (spurious features). Moreover, previous studies on spurious features in LLMs are limited to specific types (e.g., formats) and narrow scenarios (e.g., ICL). In this work, we identify and study spurious features in the RAG paradigm, a robustness issue caused by the sensitivity of LLMs to semantic-agnostic features. We then propose a novel framework, SURE, to empirically quantify the robustness of RALMs against spurious features. Beyond providing a comprehensive taxonomy and metrics for evaluation, the framework's data synthesis pipeline facilitates training-based strategies to improve robustness. Further analysis suggests that spurious features are a widespread and challenging problem in the field of RAG. Our code is available at https://github.com/maybenotime/RAG-SpuriousFeatures .

1 Introduction

The introduction identifies semantic-agnostic spurious features as an overlooked robustness issue in RAG. It presents SURE as a framework for evaluating and mitigating that issue.

1 Introduction

  • Existing RAG robustness research and benchmarks emphasize semantic-changing explicit noise, leaving spurious features without dedicated robustness benchmarks or metrics.Spurious features modify grounding data without changing its semantics.Source: §1 · p. 1
  • Golden documents with different formats can lead LLMs to produce inconsistent answers, despite containing the correct answer.The introduction notes that systematic study and effective mitigation strategies for this RAG setting had not been established.Source: §1 · p. 2
  • SURE automates robustness evaluation with a taxonomy, tailored metrics, and a synthesis pipeline, and supports SIG_Wiki, a lightweight but challenging benchmark.The framework perturbs original instances, checks that causal features remain intact, and selects challenging instances for the benchmark.Source: §1 · p. 2
  • The paper introduces two training-based strategies and reports that spurious features are not always harmful and can sometimes be beneficial.The strategies leverage synthetic data generated by SURE.Source: §1 · p. 2

2 Related Work

Prior RAG robustness research has largely examined explicit noise, while studies of implicit noise have covered only limited types. Work on prompt sensitivity provides context, but RAG spurious features occur in retrieved documents and vary across queries.

2.1 Robustness Evaluation of RAG Systems

  • RAG robustness studies have explored explicit noise, including its potential positive effects, while implicit-noise studies remain limited to types such as typos and formatting.This work frames semantic-agnostic noise as spurious features in RAG.Source: §2.1 · p. 2

2.2 Prompt Sensitivity of LLMs

  • Non-RAG studies report LLM sensitivity to prompt features including formatting, language style, and option order.These studies distinguish causal prompt features from spurious ones.Source: §2.2 · p. 2
  • Unlike static user-provided instructions in non-RAG settings, RAG spurious features occur in retrieved documents and vary dynamically by query.Source: §2.2 · p. 2

3 Proposed Framework

SURE evaluates RALM robustness to spurious features through a pipeline combining a taxonomy, controlled perturbations, preservation checks, and instance-level metrics. It formalizes comparisons between original and perturbed grounding data, then synthesizes and filters instances for evaluation.

3 Proposed Framework

  • SURE combines a five-type, 13-subtype taxonomy, spurious-feature injection, causal-feature preservation, and three fine-grained instance-level metrics.The framework is designed to assess RALM robustness against spurious features in grounding data.Source: §3 · p. 3, Figure 2 · p. 3

3.1 Problem Formulation

  • The reader prompt contains instruction, grounding data, and query; spurious-feature evaluation modifies grounding data while preserving causal features and compares the two outputs.The grounding data are a subset of retrieved documents.Source: §3.1 · p. 3

3.2 Taxonomy of Spurious Features

  • The taxonomy covers style, source, logic, format, and metadata perturbations, including readability changes, alternative document origins, sentence reordering, common formats, and timestamps.The framework identifies five types and 13 perturbation subtypes.Source: Figure 2 · p. 3, §3.2 · p. 4

3.3 Spurious Features Injection

  • The testbed uses 1,000 NQ-open queries split evenly between answerable-from-parametric-knowledge and external-knowledge queries, retrieving 100 Wikipedia documents per query for 100,000 instances.Queries were selected using Mistral-7B-Instruct-v0.3 closed-book QA results.Source: §3.3 · p. 4
  • LLMs generate style and source perturbations, while predefined rules handle logic and format changes and synthesize metadata links and HTML.Model-based perturbations use carefully crafted guidelines; metadata links represent Wikipedia or Twitter sources.Source: §3.3 · p. 4

3.4 Causal Features Preservation

  • Causal features are checked with bidirectional entailment, retaining pairs only when each version entails the other; string matching also filters documents whose answer was unexpectedly altered.The entailment check uses an LLM-based NLI system in this framework.Source: §3.4 · p. 5

3.5 Robustness Evaluation

  • RR, WR, and LR measure instance-level consistency and correctness changes by comparing responses before and after perturbation.RR is the proportion of instances whose answers remain consistent; WR and LR cover incorrect-to-correct and correct-to-incorrect changes, respectively.Source: §3.5 · p. 5
  • Dataset-level accuracy can miss instance-level sensitivity to spurious features, which the RR comparison captures.The figure contrasts dataset-level Acc with instance-level RR.Source: Figure 3 · p. 5, §3.5 · p. 5

4 Experiments

The experiments evaluate spurious-feature robustness in QA under a retrieve-read setup, finding sensitivity across queries, perturbations, model families, and retrieval settings. They also test attention shifts, model scaling, prompting, and training-based mitigation.

4.1 Experimental Setup

  • The QA experiments use SURE_Wiki, built from NQ-open queries and English Wikipedia, and evaluate Mistral-7B-Instruct-v0.3 and Llama-3.1-8B-Instruct.The evaluation follows the standard retrieve-read setting.Source: §4.1 · p. 6, §4 · p. 6

4.2 Experimental Results

  • Golden-document RR is similar for Known and Unknown queries despite accuracy differences; RR is similar within perturbation categories, but WR and LR can diverge, and some perturbations can help.On noise documents, RR remains high because models consistently answer incorrectly without ground-truth evidence.Source: §4.2 · p. 6

4.3 Further Analysis

  • SIG_Wiki selects challenging synthetic examples, including 100 instance pairs per perturbation where both models lack robustness, for a lightweight benchmark.The raw synthetic dataset is large, and class imbalance makes comparisons across feature types unfair.Source: §4.3 · p. 6
  • Sensitivity persists across six SOTA model families and architectures; GPT-4o has an 89% RR on the datasource(twitter) perturbation.The robustness comparison averages perturbation RR within each feature category.Source: §4.3 · p. 6, Figure 4 · p. 7
  • On SIG_Trivial, spurious features remain prevalent across retrieval configurations, and string-based evaluation results are similar to LLM-as-Judge results.SIG_Trivial uses Trivial_QA queries and Bing Search to retrieve open-web documents.Source: §4.3 · p. 7, Table 3 · p. 8
  • Win and Lose cases show larger attention shifts than Robust cases, and Lose cases show reduced attention to the ground-truth answer in perturbed documents.The difference in attention variation between Robust and Change groups is statistically significant (p = 0.046).Source: §4.3 · p. 8, Table 4 · p. 8

4.4 Mitigating Spurious Features

  • Across Qwen2.5 sizes, RR generally rises with scale but declines from 32B to 72B for all feature types except format and meta.Meta robustness is strong across scales and gains little to no benefit from scaling.Source: §4.4 · p. 8, Figure 5 · p. 8

Are Existing Prompting Methods Effective?

  • Chain-of-Note and DeepSeek-R1 do not improve spurious-feature robustness, while SFT works better in-domain and DPO generalizes better out-of-domain.SFT and DPO train on SURE-generated examples; both significantly improve robustness on SIG_Wiki and SIG_Trivial.Source: Are Existing Prompting Methods… · pp. 8–9, Table 5 · p. 9

5 Conclusion

The conclusion presents SURE as a framework for evaluating and mitigating RALM robustness issues from spurious features, including training-based approaches.

5 Conclusion

  • SURE combines a taxonomy, data synthesis pipeline, and evaluation metrics to assess RALM robustness against spurious features.The paper also reports introducing two training-based approaches using synthetic data generated by SURE.Source: §5 · p. 9

Limitations

The authors note that SURE may not quantify spurious features that cannot be identified within its taxonomy.

Limitations

  • Unidentifiable spurious features may fall outside SURE’s taxonomy and therefore remain unquantified.The authors state that they strive to cover all types of spurious features that may arise in RAG scenarios.Source: Limitations · p. 9

Ethical Considerations

The preliminary material distinguishes causal from spurious features in RAG and describes an experiment to examine semantic-agnostic features. The experiment uses an oracle score to compare documents and motivates controlled data synthesis.

Ethical Considerations

  • The authors state that publicly released datasets and open-source generation models are used under their licensing terms and usage policies.The passage describes the resources as released under open licenses and licensed for research use.Source: Ethical Considerations · p. 9

A Preliminary

  • The preliminary section aims to define causal and spurious RAG features and statistically demonstrate the presence of spurious features.The stated purpose is to reveal how semantic-agnostic features in real documents affect RAG outputs.Source: A Preliminary · p. 13, §A.2 · p. 13

A.1 Causal and Spurious Features in RAG

  • Causal features are grounding-data semantics, whereas spurious features are semantic-agnostic features correlated with outputs but lacking a causal relationship.The authors caution that findings from ICL classification and multiple-choice tasks may not apply to open-ended RAG generation.Source: §A.1 · p. 13

A.2 Preliminary Experiment

  • The oracle score measures the log probability of generating a correct answer given a document, enabling finer-grained comparisons than binary correctness judgments.The experiment compares top- and bottom-ranked documents by oracle score and examines feature distributions against a randomly sampled control; tested features included Flesch Score, Distinct-1, Dependency Tree Depth, PPL, and Token Length.Source: §A.2 · p. 13

A.3 Preliminary Experiment Results

The preliminary results report different feature distributions between documents ranked highest and lowest by oracle score, while implementation appendices describe perturbation and causal-feature preservation procedures.

A.3 Preliminary Experiment Results

  • The K-S test rejects equal feature-distribution hypotheses for all experimental features, while the control group fails to reject the null hypothesis.The comparison uses two sets of 2,658 samples each, selected by oracle score from NQ-open queries and Wikipedia documents.Source: §A.3 · p. 14

B Implementation Details for Injecting Spurious Features

C Implementation Details for Preserving Causal Features

  • Causal features are preserved by bidirectional entailment checks and string matching that retains answer-containing Golden documents and discards Noise documents that acquire answers.Source: C Implementation Details for… · p. 14

D Experimental Setup Details

The setup uses a retrieve-read RAG pipeline and specifies retrieval, prompting, perturbation, and evaluation components. It also reports the inference hardware and decoding temperature.

D Experimental Setup Details

  • The RAG instruction is derived from Cuconasu et al. (2024), with modifications for this setting.The instruction is part of the prompt P = (I, G, Q).Source: D Experimental Setup Details · p. 14
  • Contriever-msmarco8 serves as the default dense retriever, with Faiss used to optimize vector similarity searches.The retriever is BERT-based and fine-tuned on MS MARCO after unsupervised contrastive pretraining.Source: D Experimental Setup Details · p. 14
  • Feature distributions are visualized for Mistral-7B-Instruct-v0.3 and Llama-3.1-8B-Instruct, while K-S test results are reported for each model when used as the oracle retriever.The appendix includes prompts for an LLM-based NLI system and prompt templates for LLM-based perturbations.Source: Figure 6 · p. 15, Figure 7 · p. 16, Figure 8 · p. 17
  • The simplification and complexification perturbations ask for simpler or more complex wording while preserving the original meaning.Their prompts specify changes to sentence length, vocabulary, and style.Source: D Experimental Setup Details · p. 17
  • Read-module LLMs run on NVIDIA A100 GPUs with vLLM, and temperature is set to 0.1 for stable, reproducible outputs.The implementation details also refer to 80GB GPUs and list hyperparameters in Table 11.Source: D Experimental Setup Details · p. 20

E Statistics of the Synthetic Dataset

This block reports synthetic-dataset statistics, describes a benchmark built with web-retrieved grounding documents, and outlines the LLM-as-Judge evaluation procedure.

E Statistics of the Synthetic Dataset

F Details of SIG_Trivial Benchmark

  • SIG_Trivial uses 1,000 TriviaQA queries and three Bing Search documents per query, with 100 randomly sampled instances per subcategory.Its queries, retrieval algorithm, and data sources differ from the original SIG dataset.Source: F Details of SIG_Trivial Benchmark · p. 20

G Implementation of LLM-as-Judge

  • The LLM-as-Judge procedure uses two demonstrations and asks Llama-3.1-70B-Instruct to reason step by step before judging answer quality.The section describes this as an automatic evaluation method.Source: G Implementation of LLM-as-Judge · p. 20

H Training Setups

The training setup describes full-parameter SFT and DPO, along with QA instructions and robustness-evaluation hyperparameter references.

H Training Setups

  • Both SFT and DPO use full-parameter fine-tuning with AdamW and DeepSpeed ZeRO-3 on eight NVIDIA A100-SXM4 GPUs.The implementation passage continues with the GPU model designation.Source: H Training Setups · p. 20
  • The QA task uses the instruction shown in Figure 11.The figure provides the task instruction.Source: Figure 11 · p. 21
  • Table 10 reports Llama-3.1-8B-Instruct robustness evaluation, marking WR values above LR as beneficial perturbations.Table 11 lists SFT and DPO training hyperparameters.Source: Table 10 · p. 21, Table 11 · p. 21
Loading 2503.05587v3…