PaperlayerView exact revision on arXiv

Source-linked AI summary

Does RAG Know When Retrieval Is Wrong? Diagnosing Context Compliance under Knowledge Conflict

Yihang Chen, Pin Qian, Su Wang, Sipeng Zhang, Huan Xu, Shuhuai Lin, Xinpeng Wei

arXiv:2605.14473v4cs.CLcs.AI

TL;DR

The paper asks whether final-answer accuracy reveals which source controlled a RAG answer under knowledge conflict. It introduces CDD, a diagnostic intervention that elicits contextual and parametric answers, isolates conflicting premises, and perturbs a resolution trace. CDD improves controlled-conflict robustness while trace sensitivity differs across model families, making conflict handling an observability problem.

  • Problem

    Under knowledge conflict, final-answer accuracy does not reveal whether the model followed retrieval, relied on its parametric prior, or produced a post-hoc rationale.

  • Method

    CDD elicits contextual and parametric answers, compares them, isolates the conflicting premise, resolves the conflict, and tests the resulting trace through perturbations.

  • Results

    CDD improves controlled-conflict robustness, while trace-perturbation sensitivity is large on Gemini-2.5-Flash but remains within [-3%, +7%] across Claude runs.

  • Takeaways & Limitations

    RAG conflict handling requires diagnostics that expose which source controls the answer and whether the resolution trace is causally connected to it.

  • Takeaways & Limitations

    The mistake-injection intervention combines factual content with a behavioral directive, so a factual-only faithfulness test remains future work.

Abstract

from arXiv · show

Retrieval-Augmented Generation (RAG) is usually evaluated by whether the final answer is correct. Under knowledge conflict, this hides a key question: did the model follow retrieved evidence, rely on its parametric prior, or produce a post-hoc rationale? We study this as context compliance, the regime in which retrieved context controls the answer even when it conflicts with the model's prior knowledge. We introduce Context-Driven Decomposition (CDD), an inference-time diagnostic intervention that elicits contextual and prior answers, isolates the conflicting premise, and records a resolution trace that can be perturbed. Across Epi-Scale stress tests, TruthfulQA misconception injection, and cross-model reruns, CDD makes three behaviors visible. First, misleading retrieval can severely degrade accuracy: under a worst-case TruthfulQA misconception-injection probe, Standard RAG reaches only 15.0%. Second, better answers need not share the same mechanism: CDD improves adversarial accuracy on Gemini-2.5-Flash and shows directional gains across Claude variants, yet trace-perturbation sensitivity is high only on Gemini. Third, explicit decomposition improves controlled-conflict robustness over a conflict-aware instruction baseline on localized factual conflicts, with the clearest margins on Entity Swap (88.0% vs 79.3%) and Logical Contradiction (83.2% vs 75.4%). We frame RAG conflict handling as an observability problem.

1 Introduction

The paper argues that final-answer accuracy cannot reveal whether RAG followed retrieved evidence, relied on parametric knowledge, or produced a post-hoc rationale under knowledge conflict. It introduces CDD as a diagnostic intervention that exposes conflict-resolution behavior and tests whether the resolution trace influences answers.

  • Motivation: Under misleading retrieval, a correct or incorrect final answer does not identify which evidence source controlled the response.The paper distinguishes retrieved context, parametric knowledge, and post-hoc rationale as different mechanisms that can produce the same accuracy outcome.
  • Approach: CDD elicits contextual and parametric answers, compares them, isolates the conflicting premise, resolves the conflict, and records an intervenable trace.Trace perturbations test whether the exposed resolution process affects the final answer.
  • Scope: The paper presents CDD as a diagnostic study rather than a universal production defense or deployment recommendation.Organic multi-document retrieval, stronger faithfulness interventions, and open-weight replications remain follow-up evaluations.
  • Contributions: CDD operationalizes context compliance and makes conflict detection, premise isolation, and resolution observable at the prompt level.Context compliance refers to retrieved context controlling the answer despite conflict with the model’s parametric prior.

2 Related Work

Related work studies knowledge conflict, retrieval robustness, context-aware decoding, reasoning faithfulness, and evaluation reliability. CDD differs by keeping conflict explicit to diagnose which source controlled the answer and whether the resolution trace matters.

  • Knowledge conflict: Prior RAG studies examine when models rely on parametric knowledge versus retrieved evidence and how conflicting or substituted evidence changes outputs.These studies establish that knowledge conflict changes model behavior, motivating a diagnostic focus on source control.
  • Conflict-aware methods: ClashEval measures the tug-of-war between parametric priors and external evidence, while Astute RAG and CRAG address conflict through consolidation or retrieval evaluation.These methods primarily target conflict handling rather than trace observability.
  • Robust and filtered RAG: Self-RAG, document filtering, and related routing methods improve generation quality or retrieval reliability, whereas CDD keeps the conflicting premise visible for diagnosis.The reported reflection and filtering baselines are prompt-only approximations rather than trained systems.
  • Context-aware decoding: Context-Aware Decoding compares contextual and parametric logits, while CDD elicits corresponding answers because the evaluated closed APIs do not expose logits.CDD therefore provides a prompt-based alternative to token-level divergence measurement.
  • Faithfulness: CDD adapts causal-intervention ideas from chain-of-thought faithfulness research to retrieval-induced conflict.Its truncation and mistake-injection tests ask whether the resolution trace influences the final answer.
  • Evaluation reliability: Trace-level evaluation motivates examining intermediate behavior because identical final-answer scores can conceal different reasoning processes.The paper places CDD within broader concerns about benchmark configuration and evaluation reliability.

3 A Belief-Revision Framework for Context-Parametric Conflict

The framework distinguishes contextual and parametric beliefs and defines context compliance as retrieved evidence dominating despite disagreement with the prior. CDD turns this conflict into a five-step prompt-based probe, with optional routing into the full decomposition.

  • Conceptual formulation: The framework distinguishes the parametric prior Pθ(a | q) from the contextual posterior Pθ(a | q, c) conditioned on retrieved evidence.The belief-revision vocabulary is used as a conceptual scaffold rather than a claim about LLM internals.
  • Conceptual formulation: Context compliance occurs when the contextual posterior dominates despite divergence from the parametric prior, whereas resolution requires detecting and arbitrating that divergence.Exact token-level divergence would require white-box logit access; CDD makes the distinction observable through answer elicitation.
  • Selective routing: The CDD-α contradiction gate routes high-conflict samples into full decomposition and sends low-conflict samples through a Standard RAG bypass.Both routes converge at the final answer, making the gate a selective intervention rather than a trained or calibrated NLI model.
  • CDD probe: CDD’s five steps are contextual extraction, parametric extraction, divergence checking, premise isolation, and conflict resolution.The probe exposes belief-revision operations that remain implicit under Standard RAG.

4 Experimental Setup

The experiments combine controlled synthetic conflicts, TruthfulQA misconception injection, and cross-model reruns to test robustness and diagnostic behavior. Epi-Scale contains paired clean and adversarial records across four perturbation types, with accuracy, confidence intervals, and causal sensitivity used for evaluation.

  • Benchmarks: Epi-Scale contains 2,250 base examples from HotpotQA, Natural Questions, and FEVER, each instantiated as clean and adversarial records for 4,500 total evaluations.The benchmark spans multi-hop QA, single-hop QA, and fact verification.
  • Perturbations: The adversarial records use four mutually exclusive perturbations: Entity Swap, Temporal Shift, Logical Contradiction, and Distractor Evidence.These perturbations are generated by an LLM-based engine designed for high semantic variance.
  • Caveats: Because Gemini generated both the primary perturbations and contradiction gate, the study cannot rule out same-model bias.Claude-family reruns partially address this concern by evaluating perturbations generated by a different model.
  • Evaluation settings: TruthfulQA misconception injection is a worst-case upper-bound compliance test, whereas Epi-Scale isolates specific conflict types in a controlled stress test.Claude-family replication tests whether conflict-resolution signals are model-specific.
  • Metrics: Per-perturbation accuracy is averaged across the four groups using an unweighted macro average, with binomial confidence intervals reported for Table 1.The main adversarial analysis covers approximately 562–563 examples per perturbation type.
  • Metrics: Causal sensitivity is measured as the relative accuracy drop under Truncation and Mistake Injection interventions.The metric is defined as (Acc_clean − Acc_corrupted)/Acc_clean.
  • Significance reporting: CDD and Reflection Prompting confidence intervals do not overlap on Entity Swap (88.0% ±2.7 vs 69.5% ±3.8) or Logical Contradiction (83.2% ±3.1 vs 65.0% ±3.9).The study also compares CDD with a stronger conflict-aware RAG baseline and reports conservative CI-based checks rather than paired hypothesis tests.
  • Cross-model evaluation: The primary evaluations use Gemini-2.5-Flash, with Claude Haiku, Sonnet, and Opus reruns examining cross-architecture generalization.Closed-API behavior may drift on non-pinned dependencies, creating a reproducibility limitation.

5 Results

Across controlled conflict tests, CDD improves adversarial accuracy, but its benefits are conflict-specific and do not consistently indicate that the resolution trace causally controls answers. Results also show important evaluation and intervention caveats across datasets, models, and perturbation types.

  • Adversarial accuracy: 78.1% macro accuracy for CDD exceeded Standard RAG’s 63.0% under targeted misinformation, while gains concentrated on localized factual conflicts.The conflict-aware prompt baseline reached 73.5% macro, and CDD’s remaining margins were 88.0% vs 79.3% on Entity Swap and 83.2% vs 75.4% on Logical Contradiction.
  • Adversarial accuracy: CDD traded roughly 18 points of clean-sample accuracy for adversarial robustness in the mixed calibration run.CDD scored 67.2% clean and 78.1% adversarial, whereas Standard RAG scored 84.9% clean and 63.0% adversarial; their harmonic means were statistically tied.
  • Ablation study: Removing Premise Isolation reduced adversarial macro accuracy to 65.1%, while removing the Divergence Check produced 66.0%.The reported ablation suggests premise isolation contributed slightly more than divergence checking to the observed diagnostic signal.
  • Ablation study: The length-matched sham prompt reached 40.1% adversarial macro accuracy versus 78.1% for full CDD, supporting a role for decomposition content beyond generic multi-step structure.The authors caution that parse-failure analysis is needed before attributing the full sham drop solely to reasoning behavior.
  • TruthfulQA misconception injection: Under worst-case TruthfulQA misconception injection, CDD reached 62.0% accuracy versus 15.0% for Standard RAG.This probe injected the most common human misconception as retrieved context and was designed as an adversarial upper-bound compliance test rather than an organic retrieval evaluation.
  • Cross-model and faithfulness results: Trace-perturbation sensitivity was 64.1% on Gemini-2.5-Flash but remained within [-3%, +7%] across Claude variants despite directional accuracy gains.The cross-model evidence therefore supports transfer of an accuracy benefit, not demonstrated causal coupling between the CDD resolution trace and final answers on Claude.

6 Findings: What CDD Makes Visible

CDD reveals that controlled-conflict gains and trace-level causal sensitivity can diverge across perturbations and model families. Its clearest robustness margins occur when conflicts are localized factual claims, while several apparent gains remain directional or mechanistically uncertain.

  • Perturbation-level findings: Temporal Shift is directionally higher under CDD than Standard RAG, 71.3% vs 68.8%, but overlapping CIs preclude a robustness claim.The same caution applies to Distractor Evidence, where the directional comparison is 69.9% vs 68.8%.
  • Cross-family mechanism: Adversarial-accuracy benefits transfer across the Claude family, but trace-perturbation sensitivity remains within [-3%, +7%] outside Gemini-2.5-Flash.The reported Claude values are point estimates without paired significance tests, so they do not establish causal coupling between the resolution trace and final answer.
  • Perturbation-level findings: Entity Swap and Logical Contradiction show the clearest controlled-conflict robustness gains because each localizes the conflict as a discrete factual claim.These are the settings where explicit premise isolation is most directly applicable.
  • Future directions: Future evaluations target organic retrieval, multi-document conflicts, stricter step-specific interventions, open-weight replication, and methods that reduce decomposition overhead.These extensions address realism, causal isolation, mechanistic validation, and efficiency beyond the controlled setting.

7 Conclusion

The paper frames context compliance as a structural RAG behavior that final-answer accuracy alone cannot diagnose. CDD makes conflict arbitration observable, while its accuracy benefits and causal mechanism vary across model families.

  • Conclusion: CDD is used as an inference-time probe to expose how standard RAG handles epistemic conflict.The probe targets conflict handling rather than serving as a universal production defense.
  • Conclusion: Final-answer accuracy does not fully capture conflict handling because Standard RAG can follow misleading context, decomposition can improve robustness, and accuracy gains can lack trace-level sensitivity.These findings motivate treating conflict handling as an observability problem.
  • Release: The released materials include the Epi-Scale split, prompt templates, evaluation settings, and scoring specifications, but not the internal experimental codebase.The unreleased codebase contains nongeneralized infrastructure and API-specific wrappers.

Limitations

The paper identifies limits in causal isolation, prior measurement, model replication, benchmark realism, and prompt asymmetry. These boundaries constrain how broadly its mechanism claims should be interpreted.

  • Evidence and evaluation scope: The Claude-family sensitivity results are point estimates within [-3%, +7%], so paired significance, confidence intervals, or power analysis are needed for stronger causal claims.The 15.0% TruthfulQA result also uses a binary scorer and a worst-case misconception injection rather than an organic-retrieval estimate.
  • Protocol limitations: CDD’s Step 2 elicits the parametric answer after context exposure, making it a CDD-prompted prior rather than a context-free prior.A separate no-context elicitation would tighten the prior/posterior separation.
  • Causal and mechanistic limits: Mistake injection combines factual content with a behavioral directive, so factual-only corruption, rationale swaps, and step-specific interventions remain needed for sharper faithfulness tests.Open-weight replication would also enable token-level validation of the compliance and resolution distinction.

Reproducibility Statement

The reproducibility release covers data and evaluation specifications while retaining the internal codebase. Exact replication is additionally bounded by closed-API dependencies and endpoint availability.

  • Released materials: The release split contains 2,250 clean-context and 2,250 adversarial-context records balanced across HotpotQA, Natural Questions, FEVER, and four perturbation types.Prompt templates, evaluation settings, and scoring specifications are also planned for release.
  • Model configuration: The reported experiments use Gemini-2.5-Flash, Claude Haiku, Claude Sonnet, and Claude Opus with listed API identifiers.Runs used temperature 0.0 and greedy decoding constraints.
  • Reproducibility boundaries: Exact replication may become impossible because the Gemini endpoint has an announced discontinuation date of 2026-06-17, while surrounding closed-API infrastructure may still change.The paper treats such provider and dependency drift as a reproducibility limitation.

A Appendix: Reproducibility Details

The appendix specifies the prompting templates and CDD procedure used to compare context-based, prior-based, and conflict-resolving answers. It also reports perturbation-level adversarial accuracy for CDD on Epi-Scale.

  • Evaluation settings: The evaluation uses temperature 0.0, greedy decoding, and FEVER string normalization for binary support and refutation labels.FEVER mappings normalize supports, true, and yes to True; refutes, false, no, and contradicts to False.
  • Prompting baselines: Standard RAG, conflict-aware RAG, sham CoT, reflection prompting, and prompt-filtered RAG provide distinct prompting baselines.The conflict-aware template prioritizes retrieved context unless it conflicts with established scientific or historical knowledge, while prompt filtering removes severely implausible claims.
  • CDD procedure: CDD elicits a contextual answer and a parametric answer, compares them, isolates conflicting premises, evaluates their reliability, and produces a resolved final answer.Its contradiction gate can route high-conflict cases into the deeper decomposition trace while otherwise defaulting to Standard RAG.
  • Perturbation results: 88.0% and 83.2% are CDD's adversarial accuracies for Entity Swap and Logical Contradiction, respectively, with the clearest separations among the four perturbation types.CDD also scores 71.3% and 69.9% on Temporal Shift and Distractor Evidence, where gains are directional because confidence intervals overlap.

B Appendix: Epi-Scale Details

Epi-Scale combines examples from three established QA and fact-verification datasets with controlled adversarial context perturbations. A manual audit estimated the validity of generated conflicts while documenting limits on annotation and filtering checks.

  • Dataset construction: Epi-Scale contains 2,250 base examples from HotpotQA, Natural Questions, and FEVER, represented as 4,500 clean-context and adversarial-context records.Adversarial records are distributed across Entity Swap, Temporal Shift, Logical Contradiction, and Distractor Evidence.
  • Dataset construction: The perturbation design constrains semantic alterations to exactly one variable axis across the adversarial records.This structure supports separate evaluation of the four perturbation types rather than unrestricted context corruption.
  • Validation and limitations: 92% of 200 manually audited records were judged valid conflict generations.The audit sampled 50 adversarial records per subgroup, but inter-annotator agreement was not measured and per-record validity labels were not retained for filtered-subset sensitivity checks.
Loading 2605.14473v4…