---
title: BiasRAG in Retrieval-Augmented Generation
url: https://www.emergentmind.com/topics/biasrag
type: topic
---

# BiasRAG in Retrieval-Augmented Generation

BiasRAG is an overloaded term in recent arXiv literature. It is used informally to describe research on how retrieval-augmented generation (RAG) injects, propagates, measures, or mitigates social bias, and it is also the explicit name of a fairness-targeted backdoor attack framework introduced in 2025. Across these usages, the unifying idea is that bias in RAG is not confined to a single component: it emerges from the interaction of corpus composition, retrieval, reranking, generation, reasoning, and, in adversarial settings, model and database compromise [2502.17611] [2509.22486].

## 1. Terminological scope

The label is not standardized. In one line of work, “BiasRAG” functions as a convenient name for studying how retrieval changes the social-bias profile of a language model, especially under controlled stereotype-bearing corpora [2502.17611]. In another, “BiasRAG” is the formal name of a two-phase backdoor attack on plug-and-play RAG systems that targets protected groups and social-bias categories through a compromised query encoder and poisoned documents [2509.22486]. Closely related methods adopt distinct names, including “DebiasRAG,” a tuning-free debiasing framework [2605.16113]; “CatRAG,” which combines structural projection with balanced retrieval [2603.21524]; and “Towards FairRAG,” which treats representational harm as an exposure-allocation problem at retrieval time [2605.18806].

The terminological ambiguity is explicit in adjacent work. One paper states that “BiasRAG” does not appear as a separate named method in “Bidirectional RAG” [2512.22199], while another notes that if someone asks about “BiasRAG” in that context they may actually mean “BayesRAG” [2601.07329]. This suggests that the term is best treated as a family resemblance across fairness-aware, bias-measurement, bias-mitigation, and bias-attack research on RAG, rather than as a single settled architecture.

## 2. Where bias enters a RAG pipeline

A standard RAG generator can be written as
\[
\hat{r}(q) = g(q, d^{(q)}_1, d^{(q)}_2, \ldots, d^{(q)}_k, I),
\]
where \(q\) is the query, \(d^{(q)}_1,\dots,d^{(q)}_k\) are retrieved documents, and \(I\) is the instruction prompt [2502.17611]. In this formulation, bias can arise from the document collection, the retriever, the reranker, or the generator itself. One study makes this decomposition explicit and shows that corpus bias, retriever bias, and generator bias should be treated as interacting rather than independent factors [2502.17611].

Several papers formalize that interaction. “Mitigating Bias in RAG: Controlling the Embedder” models end-to-end RAG bias as
\[
R_b = s\cdot E_b + L_b + \epsilon,
\]
where \(E_b\) is embedder bias, \(L_b\) is LLM bias, and \(s\) is the sensitivity of bias conflict [2502.17390]. The key claim is that a fair RAG system can be better achieved by carefully controlling the bias of the embedder rather than increasing its fairness [2502.17390]. In top-\(k\) retrieval, “Fairness-Aware Retrieval Optimization for Retrieval-Augmented Generation” treats bias as position-aware and models output bias as
\[
R_b = \sum_{p=1}^{k} w_p E_b^p + b,
\]
so that retrieval fairness is defined with respect to generated outputs, not merely retrieved lists [2605.15790]. “Towards FairRAG” frames the same issue as representational harm: retrieval rankings allocate demographic exposure, and generation demographic parity closely mirrors exposure parity across ranking methods [2605.18806].

This body of work collectively shifts the unit of analysis from “biased model” to “biased RAG system.” A plausible implication is that fairness interventions cannot be located solely in pretraining or solely in prompting; they must address evidence selection, evidence ordering, and the model’s response to retrieved context.

## 3. Empirical findings on how retrieval changes social bias

The empirical picture is mixed rather than uniform. “Evaluating the Effect of Retrieval Augmentation on Social Biases” reports that the biases in document collections are often amplified in generated responses, even when the generating LLM exhibits a low level of bias [2502.17611]. Using BBQ, CBBQ, and JBBQ across English, Chinese, and Japanese, and four bias dimensions—gender, race, age, and religion—the paper finds that stereotypically biased corpora increase Diff-Bias, while anti-stereotypical corpora often reverse it [2502.17611]. For example, on English gender with GPT-3.5, the no-RAG condition is \(5.16 / -9.33\), while stereo-set retrieval yields \(14.53 / 7.14\); for Qwen-14B-Instruct, gender shifts from \(-2.38 / -2.38\) without retrieval to \(4.61 / 2.68\) with stereo-set retrieval [2502.17611].

A second study reaches a different headline result under a different setup. “Evaluating Social Bias in RAG Systems: When External Context Helps and Reasoning Hurts” reports, across more than 13 different bias types, that standard RAG generally reduces measured social bias, while Chain-of-Thought increases overall bias across datasets even as it improves accuracy [2602.09442]. Taken together, these results do not contradict each other so much as isolate different operating regimes. The first paper makes corpus stereotypicality the primary intervention; the second emphasizes that external context can disrupt stereotype-driven priors, but that explicit reasoning can reintroduce or rationalize those priors. This suggests that the effect of retrieval is contingent on corpus composition, task format, and reasoning protocol.

A further empirical theme is that bias often propagates through ranking positions rather than through raw counts alone. In fair-ranking experiments over a gender-balanced Wikipedia biography corpus, the Representative Stochastic ranker achieves mean female exposure share of \(52.29\%\) and mean generation demographic parity of \(63.02\%\), whereas Standard ranking yields \(12.50\%\) female exposure share and \(13.44\%\) generation demographic parity [2605.18806]. That result supports the broader claim that representational bias in RAG is driven by retrieval and propagates to generation [2605.18806].

## 4. Mitigation and control strategies

Mitigation work divides into retrieval-side control, representation-side control, and hybrid systems. “DebiasRAG” is explicitly tuning-free and dynamic. Its pipeline has three stages: query-specific debiasing candidate generation, context candidate pool construction, and gradient updated debiasing-guided context piece reranking [2605.16113]. On LLaMa3-8b, regular RAG worsens StereoSet-gender SS from \(57.70\) to \(58.93\), whereas DebiasRAG lowers it to \(53.85\); the corresponding ICAT moves from \(84.30\) in the original model to \(76.03\) under regular RAG and \(85.05\) under DebiasRAG [2605.16113]. In this formulation, retrieval is used as an inference-time debiasing layer rather than only a factual grounding mechanism.

“CatRAG” takes a hybrid route. It combines functor-guided structural debiasing at the embedding layer with retrieval from a curated balanced corpus [2603.21524]. On 4,000 BBQ questions with Llama-3, the base model has Accuracy \(48.9\%\) and Bias Score \(0.63\), while CatRAG reaches Accuracy \(80.7\%\) and Bias Score \(0.01\) [2603.21524]. Its ablation is particularly clear: on BBQ Gender with Llama-3, Functor-only gives \(70.5\) accuracy and BS \(0.15\), RAG-only gives \(65.3\) and BS \(0.24\), and full CatRAG gives \(81.2\) and BS \(0.01\) [2603.21524]. This indicates that retrieval alone and representation debiasing alone are each weaker than their combination.

Retrieval-side optimization methods instead treat fairness as a ranking objective. FARO introduces a soft objective
\[
\max_x \sum_{q,i,p} Rel_{q,i}x_{q,i,p} - \lambda R_b^2,
\]
and decomposes the fairness penalty into per-question assignment problems [2605.15790]. “Towards FairRAG” enforces fair exposure directly at retrieval time, while “Mitigating Bias in RAG: Controlling the Embedder” argues that the optimal embedder is often reverse-biased rather than neutral, because it must offset the bias of the LLM and corpus [2502.17390]. These approaches differ operationally, but they share a systems view: fair generation requires controlling the evidence path, not only the decoder.

## 5. Security, poisoning, and the explicit BiasRAG attack framework

In the narrowest and most literal sense, BiasRAG refers to the backdoor attack described in “Your RAG is Unfair: Exposing Fairness Vulnerabilities in Retrieval-Augmented Generation via Backdoor Attacks” [2509.22486]. That paper introduces a two-phase attack. During the pre-training phase, the query encoder is compromised to align a target group with an intended social bias; during the post-deployment phase, adversarial documents are injected into the knowledge base to reinforce the backdoor [2509.22486]. The attack targets sensitive attributes such as religion, gender, age, and race, and bias categories such as stereotype, toxicity, and derogatory language [2509.22486]. On the generation task, BiasRAG reports T-ASR \(90.05\%\), NT-ASR \(6.92\%\), and C-ASR \(22.02\%\); on QA, it reports T-ASR \(75.09\%\), NT-ASR \(12.67\%\), and C-ASR \(15.19\%\) [2509.22486]. The ablation is decisive: without Phase 1, T-ASR is \(59.20\%\); without Phase 2, it is \(61.29\%\); with both phases, it rises to \(90.05\%\) [2509.22486].

Related attack work broadens the threat model. BRRA, the “Biased Retrieval and Reward Attack,” combines adversarial document generation, embedding-space retrieval manipulation via subspace projection, and a cyclic feedback mechanism [2506.11415]. On StereoSet, LLaMA-3-8B age bias increases from BSR \(0.20\) to \(0.90\); on BBQ gender positive context, GPT-4o-mini rises from BSR \(0.3333\) to \(0.8\) [2506.11415]. A separate line of work studies truthful but semantically biased passages rather than overtly malicious ones. “Bias Injection Attacks on RAG Databases and Sanitization Defenses” shows that factually correct yet semantically biased passages can crowd out opposing views and shift answer framing, and proposes BiasDef, which reduces adversarial passages retrieved by \(15\%\), mitigates perspective shift by \(6.2\times\) in answers, and enables retrieval of \(62\%\) more benign passages [2512.00804].

These papers establish a common point: fairness in RAG is also a security property. Retrieval poisoning need not make the model obviously false or overtly unsafe; it can selectively steer which truthful context is seen.

## 6. Open directions: multilingual bias, query rewriting, and policy-conditioned governance

Recent work extends BiasRAG beyond English social-bias benchmarks. In multilingual RAG, reranking can exhibit a language bias that systematically favors English and the query language even when answer-critical evidence lies elsewhere [2604.20199]. LAURA addresses this by aligning multilingual reranking with downstream utility. For BGE reranker, JS divergence from the oracle evidence distribution decreases from \(0.203\) to \(0.090\), KL divergence from \(0.186\) to \(0.041\), and end-to-end QA improves from \(48.9\) to \(49.9\) with Llama and from \(46.7\) to \(47.7\) with Qwen [2604.20199]. Here, the bias is not demographic but linguistic, yet the core problem is the same: evidence selection suppresses answer-critical material.

Query transformation introduces another distinction: masking versus mitigation. “Masking or Mitigating? Deconstructing the Impact of Query Rewriting on Retriever Biases in RAG” finds that simple LLM rewriting achieves \(53.9\%\) aggregate bias reduction in mean \(|t|\), but fails under adversarial conditions where multiple biases combine [2604.06097]. The paper argues that simple rewriting often works by increasing score variance, whereas pseudo-document methods achieve reduction through genuine decorrelation from bias-inducing features [2604.06097]. This suggests that some apparent bias reduction is metric-level masking rather than structural correction.

A final direction is normative control. “Classification is a RAG problem: A case study on hate speech detection” reframes moderation as policy-conditioned retrieval and generation [2508.06204]. Its Contextual Policy Engine uses retrieved policy segments to decide whether content violates policy rather than whether it is hateful in some universal sense [2508.06204]. In experiments with added protected identities—Trump voters, furries, and homeless people—the system reaches F1 \(=0.972\) and accuracy \(=0.957\) after only editing the policy corpus, with no retraining [2508.06204]. In this setting, BiasRAG is not simply debiasing; it is explicit governance over whose protection the system enforces. That distinction is central. Retrieval does not neutralize bias automatically. It externalizes the policy lever into documents, making the resulting behavior more editable, auditable, and, if misused, more deliberately steerable.

Source: https://www.emergentmind.com/topics/biasrag