REVIEW 4 major objections 5 minor 57 references
PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates
T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read A black-box poisoning attack defeats conflict resolution in RAG by framing injected documents as consistent updates rather than contradictions.
desk verdict A genuinely new non-contradicting RAG poisoning mechanism, well evaluated, but the load-bearing proxy-fidelity assumption is never directly tested and the headline metric counts hedged answers as success. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the proxy-fact-grounded pivot update. Proxy facts $F_q$ are elicited by prompting a public LLM with the query, serving as the attacker's estimate of what the resolver will treat as settled, covering both parametric knowledge and co-retrieved passages. The pivot event $e$ is a fabricated recent development (e.g., a leadership transition or a database revision) that preserves every proxy fact while redirecting the answer; the three logical conditions in Eq. (3) define what the construction must satisfy. A five-stage prompt-based pipeline (Elicit, Perturb, IdentAuth, Compose, Align) realizes the construction with single black-box calls, and the final alignment stage repeats the query and places the target answer in the opening and closing sentences to exploit similarity-based retrieval and primacy/recency biases.
What would settle it
Measure the attack success rate of PURPOSE while intentionally corrupting the proxy facts—for example, by using a probing model with outdated knowledge for a set of queries, or by directly editing $F_q$ before composition—and compare against the default setup; if ASR stays high under corrupted $F_q$, then minimizing conflict with the proxy is not the active mechanism, and if it drops sharply, proxy fidelity is the lever the paper claims.
Extended reading notes
Core claim
The central claim is that a strict black-box attacker can defeat conflict resolution by reframing the injection as a minimal update rather than a counter-claim. For a query $q$ with correct answer $y^*$ and target answer $\tilde{y}$, the attacker constructs a poisoned document through five prompt-only stages that elicit a set $F_q$ of query-related proxy facts from a publicly accessible LLM, generate a plausible $\tilde{y}$, shortlist authoritative-sounding sources, compose a pivot event $e$ and narrative, and align the document to the query. The pivot event is engineered to satisfy $F_q \cup \{e\} \not\models \bot$, $F_q \cup \{e\} \models \tilde{y}$, and $e \models \neg y^*$: it introduces no contradiction with what the resolver may treat as settled, it yields the target answer together with those facts, and it alone already overturns the correct answer. The paper reports that this design attains the highest attack success rate in 35 of 45 conflict-resolution settings and a +9.7 mean ASR gain over the strongest prior attack, with retrieval statistics comparable to baselines, showing the gain is post-retrieval rather than a retrieval artifact.
Load-bearing premise
The attack stands on the assumption that facts elicited from a public LLM accurately approximate what the target conflict resolver treats as settled, including both parametric knowledge and co-retrieved passages; if that proxy is wrong, the fabricated event may contradict trusted evidence and the attack loses its documented advantage.
Editorial extensions
If this is right
- Contradiction-based conflict resolution is not a sufficient defense against knowledge poisoning in RAG; update-style injections that avoid frontal contradiction can still steer outputs.
- The attack's advantage persists after successful retrieval, implying it operates at the arbitration stage rather than by merely improving retrievability.
- The non-contradicting injection mode works across open- and closed-source generators and across retrievers with different similarity functions, so the vulnerability is general rather than tied to one pipeline.
- Because the gain narrows on vanilla RAG, where any retrievable assertion already works, the real impact is on exactly the systems that added safety checks.
Reading between the lines
- If proxy facts are a good model of the resolver's reference, then defenses that only check consistency will stay vulnerable; a natural next test is whether resolvers that verify event provenance or timestamps break the attack.
- The paper's decision to count hedged outputs (BOTH) as attack success implies that even without flipping the final answer, an attacker can succeed by forcing resolvers into indecision; defenders may need to treat confidence erosion as a first-class harm.
- A testable extension: force the probing LLM to elicit deliberately outdated or wrong facts for a subset of queries and measure how often the pivot still succeeds; this would isolate how much of the attack hinges on proxy fidelity.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript proposes PURPOSE, a black-box poisoning attack against RAG systems that include post-retrieval conflict resolution. The attack elicits a set of proxy facts Fq from a public LLM (Section 3.2), then constructs a pivot event e satisfying Eq. (3) so that e is consistent with Fq, Fq ∪ {e} entails the target answer, and e entails the negation of the ground truth. The poisoned document is additionally given authority-style references and query-aligned phrasing. The evaluation covers three QA benchmarks, five target generators, three conflict-resolution methods and vanilla RAG, and three prior baselines, with retrieval-conditioned, component-ablation, retriever-sensitivity, cross-attacker, and question-type analyses. The headline result is the highest ASR in 35 of 45 conflict-resolution settings and a +9.7 mean ASR gain over the strongest baseline, leading to the claim that contradiction checking alone is insufficient for secure RAG.
Significance. If the central mechanism holds, the paper identifies a practically important and understudied attack mode: non-contradicting, update-style poisoning that can bypass explicit conflict-resolution safeguards. Strengths include the unusually broad evaluation grid, the conditional retrieval analysis, the transparent discussion of why substring matching fails under conflict resolution, and an informative case study. The main qualifications are that the proxy-fact fidelity premise is not directly measured, the headline metric counts hedged answers that still contain the ground truth as attack success, and the same model family is used as prober, judge, and one target generator. The claims are therefore plausible but not yet demonstrated at the level the central conclusion requires.
major comments (4)
- [§3.2, Eq. (3)] The pivot conditions in Eq. (3) are checked only against the proxy fact set Fq, but the design claim is that the poisoned document is non-contradicting with respect to what the resolver actually treats as settled, namely its parametric knowledge plus co-retrieved clean passages. Section 3.2 explicitly concedes that exact correspondence is not guaranteed, yet no measurement of proxy fidelity is reported. The conflict scores in §5.2.2 are computed by a DeepSeek judge between the poisoned document and Fq, so they validate internal construction, not compatibility with the resolver. Consequently, the +9.7 mean ASR advantage over prior attacks could, in principle, be driven by authority scaffolding, query alignment, or persuasive wording rather than by the proxy-grounded mechanism. Please add a direct fidelity test, for example on a subset where the resolver's reference can be inspected (e.g., AstuteRAG's parametric dump), measure agreement between Fq and that reference; also compare ASR when Fq is replaced by random facts, by deliberately wrong facts, and by the resolver's actual extracted facts. This is the load-bearing premise of the paper.
- [§4, Evaluation Metrics] The headline metric ASR = Pr[INCORRECT ∪ BOTH] counts hedged answers that preserve the ground truth as attack successes, while the same BOTH outputs also count toward ACC. The paper's own analysis notes that on MADAM-RAG many gains take the form of hedging and that several cells satisfy ACC + ASR > 100. Because the abstract and Section 5.1 emphasize '35 of 45' and the +9.7 mean ASR margin, which are based on this inclusive metric, the reported attack success overstates the extent to which the final answer is steered away from y⋆. Please report the corresponding per-cell win counts and aggregate margins for ASRstrict, and separately report the BOTH rate per condition; a clean metric that excludes BOTH from both ACC and ASR would sharpen the claim.
- [§4 and §5.2.2] The default probing LLM, the conflict/support judge, and one of the target generators are all DeepSeek-V3.2. This same-family overlap creates a concrete optimism channel: the fact set used to construct the attack is elicited from the same model family that later labels outputs as INCORRECT or BOTH, and in the DeepSeek-generator condition the judging model is the attacked model itself. The cross-attacker experiments show model sensitivity but do not remove the overlap in the default configuration. Please validate on a random subset with an independent judge (e.g., a different model family and a human sample) and report ASR and ASRstrict under that judge; this directly tests whether the headline numbers are affected by self-grounded labeling.
- [Abstract, §1, Related Work, B.2] The paper's motivating claim that 'existing black-box poisoning methods all assert the target answer in frontal contradiction with what the resolver treats as settled' is contradicted by its own related work and appendix: CorruptRAG-AK (Zhang et al., 2026a) rewrites an outdated-answer claim into fluent adversarial knowledge and is described in B.2 as a closely related update-style attack. Since CorruptRAG-AK is excluded from Table 1, the '35 of 45' and '+9.7' comparisons and the novelty claim are overstated as stated. Please include CorruptRAG-AK in the main comparison (with the Gemini exclusion clearly disclosed) or revise the claim about prior attack modes to 'direct-assertion attacks' rather than 'all black-box poisoning methods.'
minor comments (5)
- [Abstract / §5.1] The +9.7 mean ASR margin is not directly derivable from the stated per-method margins (+14.7, +6.5, +7.9, +4.9); please specify how the aggregate is computed.
- [Table 1] The panel header states that attack columns report ACC↓/ASRstrict↑/ASR↑ while Clean reports ACC only, but the Clean column is also used for perplexity in Panel B; please clarify the notation.
- [§3.3 / Algorithm 1] The number of proxy facts l is a free parameter of the pipeline, but no distribution or sensitivity analysis is reported; please provide its range and a check of whether Eq. (3) satisfaction varies with l.
- [Ethics Statement] Withholding complete prompts and the poisoned-document collection limits reproducibility; consider releasing a sanitized or redacted artifact set, or detailed pseudocode of the prompts, to allow verification without enabling direct misuse.
- [Appendix B.2] The CorruptRAG-AK reproduction relies on a third-party implementation because the official one is unavailable; please report the overlap or manual verification between your reproduction and the published description.
Circularity Check
No load-bearing circularity: the central ASR results are measured end-to-end on external benchmarks, and Eq. (3) is a construction constraint, not a prediction derived from fitted inputs.
full rationale
The paper's central claim is empirical: PURPOSE generates poisoned documents via a five-stage LLM pipeline and reports ASR on NQ/HotpotQA/MS-MARCO across five generators and three conflict-resolution methods. No parameter is fitted to the evaluation set, and no 'prediction' is derived from Eq. (3); that equation is a design condition for constructing the pivot event relative to the proxy facts Fq. The load-bearing assumption that Fq approximates the resolver's reference is explicitly stated as an assumption ('exact correspondence is not guaranteed, but modern LLMs share substantial well-attested factual knowledge', Section 3.2), and while unmeasured, an unvalidated assumption is a correctness risk, not a circular reduction. The shared use of DeepSeek-V3.2 as probing LLM, evaluation judge, and one of five target generators is the closest self-reference; however, the manual judge agreement check (293/300) and the fact that the ASR advantage persists across four other generator families and five probing models show the central result does not reduce to that shared identity. The Section 5.2.2 conflict-score analysis measures consistency with the very proxy facts used in construction, but the paper uses it only as a sanity check of the pipeline, not as independent evidence for the attack's end-to-end effectiveness; the ASR comparisons carry that claim. No self-citation chain or uniqueness theorem is load-bearing. Therefore no circular step meeting the quoted-reduction standard is present.
Assumptions & free parameters
free parameters (1)
- Number of proxy facts l (proxy-fact set size)
assumptions (3)
- domain assumption Proxy facts Fq elicited from a public probing LLM approximate the target resolver's reference, including parametric knowledge and co-retrieved passages.
- domain assumption Hedged outputs that treat both y* and y~ as plausible (BOTH) count as partial attack success in the ASR metric.
- domain assumption The LLM judge's four-way labels are a valid proxy for real-world attack success.
Cite this review
Pith. "Pith review of PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates." pith.science (2026). https://pith.science/paper/MTEG75SG
@misc{pith2026260804756,
author = {Pith},
title = {Pith review of: PURPOSE: Poisoning Conflict Resolution in RAG via Proxy-Fact-Grounded Updates},
year = {2026},
howpublished = {\url{https://pith.science/paper/MTEG75SG}},
note = {Machine review of arXiv:2608.04756}
}
read the original abstract
In Retrieval-Augmented Generation (RAG), post-retrieval conflict resolution arbitrates among noisy or contradictory retrieved passages. However, the robustness of this safeguard against knowledge poisoning has not been adequately studied. Existing black-box poisoning methods all assert the target answer in frontal contradiction with what the resolver treats as settled, the very signal these methods are built to detect. We propose PURPOSE, a strict black-box poisoning attack that reframes the injection as an update that minimizes conflict, rather than as a counter-claim. PURPOSE extracts query-related facts approximating the resolver's possible reference, then grounds a pivot event in them to keep the injection consistent with what the resolver might verify while steering the generator toward the target answer. Across three QA benchmarks, five generators, and three conflict-resolution methods, PURPOSE attains the highest attack success rate (ASR) in 35 of 45 settings and exceeds the strongest prior attack with +9.7 mean ASR points. These results show that our poisoning method is effective against conflict resolution in RAG and identify non-contradicting injection as a practical mode to enhance poisoning attack.
Figures
Reference graph
Works this paper leans on
-
[1]
34th USENIX Security Symposium (USENIX Security 25) , pages=
\ PoisonedRAG \ : Knowledge corruption attacks to \ Retrieval-Augmented \ generation of large language models , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=
-
[2]
Choi, Chanwoo and Kim, Jinsoo and Cho, Sukmin and Jeong, Soyeong and Chang, Buru. The RAG Paradox: A Black-Box Attack Exploiting Unintentional Vulnerabilities in Retrieval-Augmented Generation Systems. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025. doi:10.18653/v1/2025.findings-emnlp.1291
-
[3]
One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
Chang, Zhiyuan and Li, Mingyang and Jia, Xiaojun and Wang, Junjie and Huang, Yuekai and Jiang, Ziyou and Liu, Yang and Wang, Qing. One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems. Findings of the Association for Computational Linguistics: EMNLP 2025. 2025. doi:10.18653/v1/2025.findings-emnlp.1023
-
[4]
Poisoning Retrieval Corpora by Injecting Adversarial Passages
Zhong, Zexuan and Huang, Ziqing and Wettig, Alexander and Chen, Danqi. Poisoning Retrieval Corpora by Injecting Adversarial Passages. Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing. 2023. doi:10.18653/v1/2023.emnlp-main.849
-
[5]
ACM Transactions on AI Security and Privacy , year=
Phantom: General backdoor attacks on retrieval augmented language generation , author=. ACM Transactions on AI Security and Privacy , year=
-
[6]
arXiv preprint arXiv:2406.00083 , year=
Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models , author=. arXiv preprint arXiv:2406.00083 , year=
-
[7]
Pr-attack: Coordinated prompt-rag attacks on retrieval-augmented generation in large language models via bilevel optimization , author=. Proceedings of the 48th International ACM SIGIR Conference on Research and Development in Information Retrieval , pages=
-
[8]
arXiv preprint arXiv:2410.22832 , year=
Hijackrag: Hijacking attacks against retrieval-augmented large language models , author=. arXiv preprint arXiv:2410.22832 , year=
Show all 57 references
-
[9]
Findings of the Association for Computational Linguistics: EMNLP 2024 , pages=
Typos that broke the rag’s back: Genetic attack on rag pipeline by simulating documents in the wild via low-level perturbations , author=. Findings of the Association for Computational Linguistics: EMNLP 2024 , pages=
2024
-
[10]
34th USENIX Security Symposium (USENIX Security 25) , pages=
Machine Against the \ RAG \ : Jamming \ Retrieval-Augmented \ Generation with Blocker Documents , author=. 34th USENIX Security Symposium (USENIX Security 25) , pages=
-
[11]
Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=
Flippedrag: Black-box opinion manipulation adversarial attacks to retrieval-augmented generation models , author=. Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security , pages=
2025
-
[12]
Practical Poisoning Attacks against Retrieval-Augmented Generation , booktitle =
Baolei Zhang and Yuxi Chen and Zhuqing Liu and Lihai Nie and Tong Li and Zheli Liu and Minghong Fang , editor =. Practical Poisoning Attacks against Retrieval-Augmented Generation , booktitle =. 2026 , url =. doi:10.1145/3750555.3811900 , timestamp =
2026
-
[13]
arXiv preprint arXiv:2605.05632 , year=
Architecture Matters: Comparing RAG Systems under Knowledge Base Poisoning , author=. arXiv preprint arXiv:2605.05632 , year=
-
[14]
Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
Astute rag: Overcoming imperfect retrieval augmentation and knowledge conflicts for large language models , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
-
[15]
Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
Faithfulrag: Fact-level conflict modeling for context-faithful retrieval-augmented generation , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
-
[16]
arXiv preprint arXiv:2504.13079 , year=
Retrieval-augmented generation with conflicting evidence , author=. arXiv preprint arXiv:2504.13079 , year=
-
[17]
International Conference on Learning Representations , volume=
InstructRAG: Instructing retrieval-augmented generation via self-synthesized rationales , author=. International Conference on Learning Representations , volume=
-
[18]
Proceedings of the AAAI Conference on Artificial Intelligence , volume=
Truthfulrag: Resolving factual-level conflicts in retrieval-augmented generation with knowledge graphs , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=
-
[19]
arXiv preprint arXiv:2508.20131 , year=
Argrag: Explainable retrieval augmented generation using quantitative bipolar argumentation , author=. arXiv preprint arXiv:2508.20131 , year=
-
[20]
Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
Micro-act: Mitigate knowledge conflict in question answering via actionable self-reasoning , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=
-
[21]
arXiv preprint arXiv:2405.15556 , year=
Certifiably robust rag against retrieval corruption , author=. arXiv preprint arXiv:2405.15556 , year=
-
[22]
context: Fine-grained control of knowledge reliance in language models , author=
Parameters vs. context: Fine-grained control of knowledge reliance in language models , author=. arXiv preprint arXiv:2503.15888 , year=
-
[23]
Proceedings of the AAAI Conference on Artificial Intelligence , volume=
Accommodate Knowledge Conflicts in Retrieval-augmented LLMs: Towards Robust Response Generation in the Wild , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=
-
[24]
Proceedings of the 2024 joint international conference on computational linguistics, language resources and evaluation (LREC-COLING 2024) , pages=
Tug-of-war between knowledge: Exploring and resolving knowledge conflicts in retrieval-augmented language models , author=. Proceedings of the 2024 joint international conference on computational linguistics, language resources and evaluation (LREC-COLING 2024) , pages=
2024
-
[25]
arXiv preprint arXiv:2601.06842 , year=
Seeing through the Conflict: Transparent Knowledge Conflict Handling in Retrieval-Augmented Generation , author=. arXiv preprint arXiv:2601.06842 , year=
-
[26]
Findings of the Association for Computational Linguistics: ACL 2025 , pages=
Context-dpo: Aligning language models for context-faithfulness , author=. Findings of the Association for Computational Linguistics: ACL 2025 , pages=
2025
-
[27]
Proceedings of the AAAI Conference on Artificial Intelligence , volume=
Knowpo: Knowledge-aware preference optimization for controllable knowledge selection in retrieval-augmented language models , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=
-
[28]
Conflict-Aware Soft Prompting for Retrieval-Augmented Generation
Choi, Eunseong and Park, June and Lee, Hyeri and Lee, Jongwuk. Conflict-Aware Soft Prompting for Retrieval-Augmented Generation. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 2025. doi:10.18653/v1/2025.emnlp-main.1371
2025 doi
-
[29]
Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=
Knowledge conflicts for llms: A survey , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=
2024
-
[30]
International Conference on Learning Representations , volume=
Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts , author=. International Conference on Learning Representations , volume=
-
[31]
arXiv preprint arXiv:2310.01558 , year=
Making retrieval-augmented language models robust to irrelevant context , author=. arXiv preprint arXiv:2310.01558 , year=
-
[32]
npj Digital Medicine , year=
HealthContradict: Evaluating biomedical knowledge conflicts in language models , author=. npj Digital Medicine , year=
-
[33]
arXiv preprint arXiv:2510.03418 , year=
LegalWiz: A Multi-Agent Generation Framework for Contradiction Detection in Legal Documents , author=. arXiv preprint arXiv:2510.03418 , year=
-
[34]
arXiv preprint arXiv:2503.07937 , year=
Llm-based corroborating and refuting evidence retrieval for scientific claim verification , author=. arXiv preprint arXiv:2503.07937 , year=
-
[35]
Proceedings of the Seventh Fact Extraction and VERification Workshop (FEVER) , pages=
Ragar, your falsehood radar: Rag-augmented reasoning for political fact-checking using multimodal large language models , author=. Proceedings of the Seventh Fact Extraction and VERification Workshop (FEVER) , pages=
-
[36]
2025 , month = dec, url =
OpenAI , title =. 2025 , month = dec, url =
2025
-
[37]
2025 , month = dec, howpublished =
2025
-
[38]
Qwen3.5: Towards Native Multimodal Agents , year =
-
[39]
2025 , eprint=
DeepSeek-V3.2: Pushing the Frontier of Open Large Language Models , author=. 2025 , eprint=
2025
-
[40]
2024 , eprint=
The Llama 3 Herd of Models , author=. 2024 , eprint=
2024
-
[41]
Transactions on Machine Learning Research , year=
Unsupervised Dense Information Retrieval with Contrastive Learning , author=. Transactions on Machine Learning Research , year=
-
[42]
arXiv preprint arXiv:2104.08663 , year=
Beir: A heterogenous benchmark for zero-shot evaluation of information retrieval models , author=. arXiv preprint arXiv:2104.08663 , year=
-
[43]
Transactions of the association for computational linguistics , volume=
Lost in the middle: How language models use long contexts , author=. Transactions of the association for computational linguistics , volume=
-
[44]
Transactions of the Association for Computational Linguistics , volume=
Natural questions: a benchmark for question answering research , author=. Transactions of the Association for Computational Linguistics , volume=. 2019 , publisher=
2019
-
[45]
Proceedings of the 2018 conference on empirical methods in natural language processing , pages=
HotpotQA: A dataset for diverse, explainable multi-hop question answering , author=. Proceedings of the 2018 conference on empirical methods in natural language processing , pages=
2018
-
[46]
arXiv preprint arXiv:1611.09268 , year=
MS MARCO: A human generated machine reading comprehension dataset , author=. arXiv preprint arXiv:1611.09268 , year=
-
[47]
Advances in neural information processing systems , volume=
Retrieval-augmented generation for knowledge-intensive nlp tasks , author=. Advances in neural information processing systems , volume=
-
[48]
arXiv preprint arXiv:2312.10997 , volume=
Retrieval-augmented generation for large language models: A survey , author=. arXiv preprint arXiv:2312.10997 , volume=
-
[49]
Language models as knowledge bases? , author=. Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP) , pages=
2019
-
[50]
Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: Long papers) , pages=
When not to trust language models: Investigating effectiveness of parametric and non-parametric memories , author=. Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: Long papers) , pages=
-
[51]
Proceedings of the 16th conference of the european chapter of the association for computational linguistics: main volume , pages=
Leveraging passage retrieval with generative models for open domain question answering , author=. Proceedings of the 16th conference of the european chapter of the association for computational linguistics: main volume , pages=
-
[52]
International conference on machine learning , pages=
Retrieval augmented language model pre-training , author=. International conference on machine learning , pages=. 2020 , organization=
2020
-
[53]
arXiv preprint arXiv:2007.00808 , year=
Approximate nearest neighbor negative contrastive learning for dense text retrieval , author=. arXiv preprint arXiv:2007.00808 , year=
2007 arXiv
-
[54]
Proceedings of the 47th international ACM SIGIR conference on research and development in information retrieval , pages=
C-pack: Packed resources for general chinese embeddings , author=. Proceedings of the 47th international ACM SIGIR conference on research and development in information retrieval , pages=
-
[55]
OpenAI blog , volume=
Language models are unsupervised multitask learners , author=. OpenAI blog , volume=
-
[56]
2024 , eprint=
Qwen2 Technical Report , author=. 2024 , eprint=
2024
-
[57]
2023 , eprint=
Mistral 7B , author=. 2023 , eprint=
2023
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.