Factually Correct but One-Sided: Stance Poisoning and Evidence Balancing in Retrieval-Augmented Generation

The researchers propose a stance poisoning attack against retrieval-augmented generation (RAG) systems: injecting into the retrieval corpus documents that are factually correct but one-sided in stance on a controversial issue can bias the generated output toward the poisoned stance. When the topic-level average poisoning proportion of ProCon documents after injection reaches 18.9%, four generation models from different vendors all show stance shifts consistent with the poisoning direction, and the shift increases monotonically with four concentration levels. The paper also proposes a Stance-Balancing Middleware located between the retriever and the generator, consisting of stance detection, fixed balancing (2 supporting, 2 opposing, 1 neutral), and a debiasing prompt, introducing no additional large language model calls; across eight concentration-direction settings it reduces the estimated stance bias magnitude by 0.106 to 0.350, among which the six settings with poisoning proportions of 11.9%-18.9% remain significant after Holm correction (adjusted p <= 0.009).