Retrieval Collapses When AI Pollutes the Web
Hongyeon Yu , Dongchan Kim , Young-Bum Kim
Published on arXiv
2602.16136
Input Manipulation Attack
OWASP ML Top 10 — ML01
Prompt Injection
OWASP LLM Top 10 — LLM01
Key Finding
67% pool contamination by high-quality AI-generated content drives over 80% exposure contamination in RAG pipelines, while adversarial content exposes ~19% harmful results in BM25 rankers.
Retrieval Collapse
Novel technique introduced
The rapid proliferation of AI-generated content on the Web presents a structural risk to information retrieval, as search engines and Retrieval-Augmented Generation (RAG) systems increasingly consume evidence produced by the Large Language Models (LLMs). We characterize this ecosystem-level failure mode as Retrieval Collapse, a two-stage process where (1) AI-generated content dominates search results, eroding source diversity, and (2) low-quality or adversarial content infiltrates the retrieval pipeline. We analyzed this dynamic through controlled experiments involving both high-quality SEO-style content and adversarially crafted content. In the SEO scenario, a 67\% pool contamination led to over 80\% exposure contamination, creating a homogenized yet deceptively healthy state where answer accuracy remains stable despite the reliance on synthetic sources. Conversely, under adversarial contamination, baselines like BM25 exposed $\sim$19\% of harmful content, whereas LLM-based rankers demonstrated stronger suppression capabilities. These findings highlight the risk of retrieval pipelines quietly shifting toward synthetic evidence and the need for retrieval-aware strategies to prevent a self-reinforcing cycle of quality decline in Web-grounded systems.
Key Contributions
- Formalizes 'Retrieval Collapse' as a two-stage ecosystem failure mode (dominance/homogenization followed by adversarial pollution) distinct from training-time model collapse
- Empirically quantifies contamination dynamics: 67% pool contamination yields >80% exposure contamination in SEO settings and ~19% harmful content exposure in BM25 under adversarial conditions
- Shows LLM-based rankers suppress adversarial content more effectively than BM25, while both are vulnerable to SEO-style homogenization
🛡️ Threat Analysis
The adversarial contamination scenario involves strategically crafted documents injected into retrieval corpora to manipulate LLM-integrated system outputs — this is adversarial SEO poisoning / document injection for RAG, explicitly listed as an ML01 use case.