BiasRAG in Retrieval-Augmented Generation

• BiasRAG is an umbrella term that describes both the study of bias dynamics in retrieval-augmented generation and a fairness-targeted backdoor attack framework introduced in 2025.
• It highlights how bias arises from interdependent factors such as corpus composition, retrieval, reranking, and generation, affecting overall system fairness.
• Mitigation strategies range from retrieval-side controls and representation adjustments to hybrid approaches that optimize both fairness and performance.

BiasRAG is an overloaded term in recent arXiv literature. It is used informally to describe research on how retrieval-augmented generation (RAG) injects, propagates, measures, or mitigates social bias, and it is also the explicit name of a fairness-targeted backdoor attack framework introduced in 2025. Across these usages, the unifying idea is that bias in RAG is not confined to a single component: it emerges from the interaction of corpus composition, retrieval, reranking, generation, reasoning, and, in adversarial settings, model and database compromise (Zhang et al., 24 Feb 2025, Bagwe et al., 26 Sep 2025).

1. Terminological scope

The label is not standardized. In one line of work, “BiasRAG” functions as a convenient name for studying how retrieval changes the social-bias profile of a LLM, especially under controlled stereotype-bearing corpora (Zhang et al., 24 Feb 2025). In another, “BiasRAG” is the formal name of a two-phase backdoor attack on plug-and-play RAG systems that targets protected groups and social-bias categories through a compromised query encoder and poisoned documents (Bagwe et al., 26 Sep 2025). Closely related methods adopt distinct names, including “DebiasRAG,” a tuning-free debiasing framework (Chu et al., 15 May 2026); “CatRAG,” which combines structural projection with balanced retrieval (Ranjan et al., 23 Mar 2026); and “Towards FairRAG,” which treats representational harm as an exposure-allocation problem at retrieval time (Tikoo, 11 May 2026).

The terminological ambiguity is explicit in adjacent work. One paper states that “BiasRAG” does not appear as a separate named method in “Bidirectional RAG” (Chinthala, 20 Dec 2025), while another notes that if someone asks about “BiasRAG” in that context they may actually mean “BayesRAG” (Li et al., 12 Jan 2026). This suggests that the term is best treated as a family resemblance across fairness-aware, bias-measurement, bias-mitigation, and bias-attack research on RAG, rather than as a single settled architecture.

2. Where bias enters a RAG pipeline

A standard RAG generator can be written as

$$\hat{r}(q) = g(q, d^{(q)}_1, d^{(q)}_2, \ldots, d^{(q)}_k, I),$$

where $q$ is the query, $d^{(q)}_1,\dots,d^{(q)}_k$ are retrieved documents, and $I$ is the instruction prompt (Zhang et al., 24 Feb 2025). In this formulation, bias can arise from the document collection, the retriever, the reranker, or the generator itself. One study makes this decomposition explicit and shows that corpus bias, retriever bias, and generator bias should be treated as interacting rather than independent factors (Zhang et al., 24 Feb 2025).

Several papers formalize that interaction. “Mitigating Bias in RAG: Controlling the Embedder” models end-to-end RAG bias as

$R_b = s\cdot E_b + L_b + \epsilon,$

where $E_b$ is embedder bias, $L_b$ is LLM bias, and $s$ is the sensitivity of bias conflict (Kim et al., 24 Feb 2025). The key claim is that a fair RAG system can be better achieved by carefully controlling the bias of the embedder rather than increasing its fairness (Kim et al., 24 Feb 2025). In top-$k$ retrieval, “Fairness-Aware Retrieval Optimization for Retrieval-Augmented Generation” treats bias as position-aware and models output bias as

$R_b = \sum_{p=1}^{k} w_p E_b^p + b,$

so that retrieval fairness is defined with respect to generated outputs, not merely retrieved lists (Zhao et al., 15 May 2026). “Towards FairRAG” frames the same issue as representational harm: retrieval rankings allocate demographic exposure, and generation demographic parity closely mirrors exposure parity across ranking methods (Tikoo, 11 May 2026).

This body of work collectively shifts the unit of analysis from “biased model” to “biased RAG system.” A plausible implication is that fairness interventions cannot be located solely in pretraining or solely in prompting; they must address evidence selection, evidence ordering, and the model’s response to retrieved context.

3. Empirical findings on how retrieval changes social bias

The empirical picture is mixed rather than uniform. “Evaluating the Effect of Retrieval Augmentation on Social Biases” reports that the biases in document collections are often amplified in generated responses, even when the generating LLM exhibits a low level of bias (Zhang et al., 24 Feb 2025). Using BBQ, CBBQ, and JBBQ across English, Chinese, and Japanese, and four bias dimensions—gender, race, age, and religion—the paper finds that stereotypically biased corpora increase Diff-Bias, while anti-stereotypical corpora often reverse it (Zhang et al., 24 Feb 2025). For example, on English gender with GPT-3.5, the no-RAG condition is $q$0, while stereo-set retrieval yields $q$1; for Qwen-14B-Instruct, gender shifts from $q$2 without retrieval to $q$3 with stereo-set retrieval (Zhang et al., 24 Feb 2025).

A second study reaches a different headline result under a different setup. “Evaluating Social Bias in RAG Systems: When External Context Helps and Reasoning Hurts” reports, across more than 13 different bias types, that standard RAG generally reduces measured social bias, while Chain-of-Thought increases overall bias across datasets even as it improves accuracy (Parihar et al., 10 Feb 2026). Taken together, these results do not contradict each other so much as isolate different operating regimes. The first paper makes corpus stereotypicality the primary intervention; the second emphasizes that external context can disrupt stereotype-driven priors, but that explicit reasoning can reintroduce or rationalize those priors. This suggests that the effect of retrieval is contingent on corpus composition, task format, and reasoning protocol.

A further empirical theme is that bias often propagates through ranking positions rather than through raw counts alone. In fair-ranking experiments over a gender-balanced Wikipedia biography corpus, the Representative Stochastic ranker achieves mean female exposure share of $q$4 and mean generation demographic parity of $q$5, whereas Standard ranking yields $q$6 female exposure share and $q$7 generation demographic parity (Tikoo, 11 May 2026). That result supports the broader claim that representational bias in RAG is driven by retrieval and propagates to generation (Tikoo, 11 May 2026).

4. Mitigation and control strategies

Mitigation work divides into retrieval-side control, representation-side control, and hybrid systems. “DebiasRAG” is explicitly tuning-free and dynamic. Its pipeline has three stages: query-specific debiasing candidate generation, context candidate pool construction, and gradient updated debiasing-guided context piece reranking (Chu et al., 15 May 2026). On LLaMa3-8b, regular RAG worsens StereoSet-gender SS from $q$8 to $q$9, whereas DebiasRAG lowers it to $d^{(q)}_1,\dots,d^{(q)}_k$0; the corresponding ICAT moves from $d^{(q)}_1,\dots,d^{(q)}_k$1 in the original model to $d^{(q)}_1,\dots,d^{(q)}_k$2 under regular RAG and $d^{(q)}_1,\dots,d^{(q)}_k$3 under DebiasRAG (Chu et al., 15 May 2026). In this formulation, retrieval is used as an inference-time debiasing layer rather than only a factual grounding mechanism.

“CatRAG” takes a hybrid route. It combines functor-guided structural debiasing at the embedding layer with retrieval from a curated balanced corpus (Ranjan et al., 23 Mar 2026). On 4,000 BBQ questions with Llama-3, the base model has Accuracy $d^{(q)}_1,\dots,d^{(q)}_k$4 and Bias Score $d^{(q)}_1,\dots,d^{(q)}_k$5, while CatRAG reaches Accuracy $d^{(q)}_1,\dots,d^{(q)}_k$6 and Bias Score $d^{(q)}_1,\dots,d^{(q)}_k$7 (Ranjan et al., 23 Mar 2026). Its ablation is particularly clear: on BBQ Gender with Llama-3, Functor-only gives $d^{(q)}_1,\dots,d^{(q)}_k$8 accuracy and BS $d^{(q)}_1,\dots,d^{(q)}_k$9, RAG-only gives $I$0 and BS $I$1, and full CatRAG gives $I$2 and BS $I$3 (Ranjan et al., 23 Mar 2026). This indicates that retrieval alone and representation debiasing alone are each weaker than their combination.

Retrieval-side optimization methods instead treat fairness as a ranking objective. FARO introduces a soft objective

$I$4

and decomposes the fairness penalty into per-question assignment problems (Zhao et al., 15 May 2026). “Towards FairRAG” enforces fair exposure directly at retrieval time, while “Mitigating Bias in RAG: Controlling the Embedder” argues that the optimal embedder is often reverse-biased rather than neutral, because it must offset the bias of the LLM and corpus (Kim et al., 24 Feb 2025). These approaches differ operationally, but they share a systems view: fair generation requires controlling the evidence path, not only the decoder.

5. Security, poisoning, and the explicit BiasRAG attack framework

In the narrowest and most literal sense, BiasRAG refers to the backdoor attack described in “Your RAG is Unfair: Exposing Fairness Vulnerabilities in Retrieval-Augmented Generation via Backdoor Attacks” (Bagwe et al., 26 Sep 2025). That paper introduces a two-phase attack. During the pre-training phase, the query encoder is compromised to align a target group with an intended social bias; during the post-deployment phase, adversarial documents are injected into the knowledge base to reinforce the backdoor (Bagwe et al., 26 Sep 2025). The attack targets sensitive attributes such as religion, gender, age, and race, and bias categories such as stereotype, toxicity, and derogatory language (Bagwe et al., 26 Sep 2025). On the generation task, BiasRAG reports T-ASR $I$5, NT-ASR $I$6, and C-ASR $I$7; on QA, it reports T-ASR $I$8, NT-ASR $I$9, and C-ASR $R_b = s\cdot E_b + L_b + \epsilon,$0 (Bagwe et al., 26 Sep 2025). The ablation is decisive: without Phase 1, T-ASR is $R_b = s\cdot E_b + L_b + \epsilon,$1; without Phase 2, it is $R_b = s\cdot E_b + L_b + \epsilon,$2; with both phases, it rises to $R_b = s\cdot E_b + L_b + \epsilon,$3 (Bagwe et al., 26 Sep 2025).

Related attack work broadens the threat model. BRRA, the “Biased Retrieval and Reward Attack,” combines adversarial document generation, embedding-space retrieval manipulation via subspace projection, and a cyclic feedback mechanism (Wang et al., 13 Jun 2025). On StereoSet, LLaMA-3-8B age bias increases from BSR $R_b = s\cdot E_b + L_b + \epsilon,$4 to $R_b = s\cdot E_b + L_b + \epsilon,$5; on BBQ gender positive context, GPT-4o-mini rises from BSR $R_b = s\cdot E_b + L_b + \epsilon,$6 to $R_b = s\cdot E_b + L_b + \epsilon,$7 (Wang et al., 13 Jun 2025). A separate line of work studies truthful but semantically biased passages rather than overtly malicious ones. “Bias Injection Attacks on RAG Databases and Sanitization Defenses” shows that factually correct yet semantically biased passages can crowd out opposing views and shift answer framing, and proposes BiasDef, which reduces adversarial passages retrieved by $R_b = s\cdot E_b + L_b + \epsilon,$8, mitigates perspective shift by $R_b = s\cdot E_b + L_b + \epsilon,$9 in answers, and enables retrieval of $E_b$0 more benign passages (Wu et al., 30 Nov 2025).

These papers establish a common point: fairness in RAG is also a security property. Retrieval poisoning need not make the model obviously false or overtly unsafe; it can selectively steer which truthful context is seen.

6. Open directions: multilingual bias, query rewriting, and policy-conditioned governance

Recent work extends BiasRAG beyond English social-bias benchmarks. In multilingual RAG, reranking can exhibit a language bias that systematically favors English and the query language even when answer-critical evidence lies elsewhere (Wang et al., 22 Apr 2026). LAURA addresses this by aligning multilingual reranking with downstream utility. For BGE reranker, JS divergence from the oracle evidence distribution decreases from $E_b$1 to $E_b$2, KL divergence from $E_b$3 to $E_b$4, and end-to-end QA improves from $E_b$5 to $E_b$6 with Llama and from $E_b$7 to $E_b$8 with Qwen (Wang et al., 22 Apr 2026). Here, the bias is not demographic but linguistic, yet the core problem is the same: evidence selection suppresses answer-critical material.

Query transformation introduces another distinction: masking versus mitigation. “Masking or Mitigating? Deconstructing the Impact of Query Rewriting on Retriever Biases in RAG” finds that simple LLM rewriting achieves $E_b$9 aggregate bias reduction in mean $L_b$0, but fails under adversarial conditions where multiple biases combine (Goyal et al., 7 Apr 2026). The paper argues that simple rewriting often works by increasing score variance, whereas pseudo-document methods achieve reduction through genuine decorrelation from bias-inducing features (Goyal et al., 7 Apr 2026). This suggests that some apparent bias reduction is metric-level masking rather than structural correction.

A final direction is normative control. “Classification is a RAG problem: A case study on hate speech detection” reframes moderation as policy-conditioned retrieval and generation (Willats et al., 8 Aug 2025). Its Contextual Policy Engine uses retrieved policy segments to decide whether content violates policy rather than whether it is hateful in some universal sense (Willats et al., 8 Aug 2025). In experiments with added protected identities—Trump voters, furries, and homeless people—the system reaches F1 $L_b$1 and accuracy $L_b$2 after only editing the policy corpus, with no retraining (Willats et al., 8 Aug 2025). In this setting, BiasRAG is not simply debiasing; it is explicit governance over whose protection the system enforces. That distinction is central. Retrieval does not neutralize bias automatically. It externalizes the policy lever into documents, making the resulting behavior more editable, auditable, and, if misused, more deliberately steerable.