benchmark 2026

Retrieval Collapses When AI Pollutes the Web

Hongyeon Yu , Dongchan Kim , Young-Bum Kim

0 citations · 18 references · arXiv (Cornell University)

α

Published on arXiv

2602.16136

Input Manipulation Attack

OWASP ML Top 10 — ML01

Prompt Injection

OWASP LLM Top 10 — LLM01

Key Finding

67% pool contamination by high-quality AI-generated content drives over 80% exposure contamination in RAG pipelines, while adversarial content exposes ~19% harmful results in BM25 rankers.

Retrieval Collapse

Novel technique introduced


The rapid proliferation of AI-generated content on the Web presents a structural risk to information retrieval, as search engines and Retrieval-Augmented Generation (RAG) systems increasingly consume evidence produced by the Large Language Models (LLMs). We characterize this ecosystem-level failure mode as Retrieval Collapse, a two-stage process where (1) AI-generated content dominates search results, eroding source diversity, and (2) low-quality or adversarial content infiltrates the retrieval pipeline. We analyzed this dynamic through controlled experiments involving both high-quality SEO-style content and adversarially crafted content. In the SEO scenario, a 67\% pool contamination led to over 80\% exposure contamination, creating a homogenized yet deceptively healthy state where answer accuracy remains stable despite the reliance on synthetic sources. Conversely, under adversarial contamination, baselines like BM25 exposed $\sim$19\% of harmful content, whereas LLM-based rankers demonstrated stronger suppression capabilities. These findings highlight the risk of retrieval pipelines quietly shifting toward synthetic evidence and the need for retrieval-aware strategies to prevent a self-reinforcing cycle of quality decline in Web-grounded systems.


Key Contributions

  • Formalizes 'Retrieval Collapse' as a two-stage ecosystem failure mode (dominance/homogenization followed by adversarial pollution) distinct from training-time model collapse
  • Empirically quantifies contamination dynamics: 67% pool contamination yields >80% exposure contamination in SEO settings and ~19% harmful content exposure in BM25 under adversarial conditions
  • Shows LLM-based rankers suppress adversarial content more effectively than BM25, while both are vulnerable to SEO-style homogenization

🛡️ Threat Analysis

Input Manipulation Attack

The adversarial contamination scenario involves strategically crafted documents injected into retrieval corpora to manipulate LLM-integrated system outputs — this is adversarial SEO poisoning / document injection for RAG, explicitly listed as an ML01 use case.


Details

Domains
nlp
Model Types
llmtransformer
Threat Tags
black_boxinference_time
Datasets
MS MARCO
Applications
search enginesretrieval-augmented generation