Passage Injection: Robust RAG Method

• Passage Injection is a method that incorporates retrieved passages into the reasoning phase, enabling models to inspect and validate evidence rather than relying solely on prefixed context.
• It boosts robustness against irrelevant and counterfactual noise by leveraging explicit <think> blocks for step-by-step reasoning and self-correction.
• Evaluated on BM25 retrieval and multiple factual QA benchmarks, Passage Injection consistently outperforms vanilla RAG while reducing output verbosity.

Passage Injection is a prompting method for retrieval-augmented generation (RAG) in which retrieved passages are incorporated into the explicit reasoning phase of a reasoning-enhanced LLM, rather than being supplied only as prefixed context. In the formulation introduced in “Injecting External Knowledge into the Reasoning Process Enhances Retrieval-Augmented Generation” (Tang et al., 25 Jul 2025), the method is designed for factual question answering with reasoning-capable models that generate intermediate reasoning inside > ... </think> tags and can use self-reflection to detect inconsistencies. The central objective is robustness: when retrieval returns irrelevant, low-quality, or counterfactual passages, the model is encouraged to reason with and about those passages, rather than following them naively. The method is purely inference-time prompting, requires no parameter updates, and is evaluated with BM25 retrieval on multiple factual QA benchmarks (Tang et al., 25 Jul 2025).

1. Definition and conceptual scope

In the formulation of (Tang et al., 25 Jul 2025), Passage Injection modifies the standard RAG pipeline by moving retrieved passages from the Input Phase into the Reasoning Phase. Standard “vanilla RAG” retrieves passages $D=\{d_1,\dots,d_k\}$, concatenates them with a query $q$, and asks the model to answer on that basis. Passage Injection instead gives the question in the Input Phase, then places both the retrieved passages and instructions for how to use them inside the model’s explicit reasoning block. The passages are therefore framed not merely as background context, but as objects the model should inspect, compare, evaluate, and, when necessary, reject.

The paper distinguishes three prompting regimes. Direct QA uses internal knowledge only and can be summarized as $a=M(q)$. Vanilla RAG concatenates passages with the query and can be summarized as $a=M([q;D])$. Passage Injection uses a staged decomposition in which reasoning is conditioned on both $q$ and $D$, and the answer is produced after that reasoning, conceptually $r=M_{\text{think}}(q,D)$, $a=M_{\text{answer}}(q,r)$. An ablation called Instruction Injection keeps passages in the Input Phase but moves only the instructions into <think> ... </think>, allowing the paper to isolate the contribution of putting the passages themselves into the reasoning trajectory.

The method is explicitly tied to reasoning-enhanced LLMs, including the Qwen3 series and DeepSeek-R1-Distill-Qwen-32B, which in this setup produce intermediate reasoning and self-reflection. This suggests that Passage Injection is not merely a context-formatting trick, but a prompt-level intervention on the model’s reasoning path.

2. Motivation: noisy retrieval and self-reflective reasoning

The motivating problem is the brittleness of RAG under imperfect retrieval (Tang et al., 25 Jul 2025). The paper characterizes noisy passages in two explicit settings. In Random Noise, each question is paired with three passages randomly sampled from the corpus; these passages are overwhelmingly irrelevant to the query. In Counterfactual Noise, the paper uses ConFiQA, where a gold supporting passage is altered by replacing key answer entities with random same-type distractors, yielding fluent and topically relevant but factually false context. The latter is treated as the hardest form of noise because it resembles precisely the kind of evidence that RAG systems are expected to trust.

The empirical and qualitative claim is that vanilla RAG often follows retrieved text too naively, overriding internal knowledge. The illustrative example concerns a question about the country of which Northern Ireland is part. A misleading retrieved passage asserts “United States,” and vanilla RAG follows it; under Passage Injection, the model identifies the retrieved statement as misinformation during <think> and answers “United Kingdom.” The significance of the example is not the specific fact, but the failure mode: retrieved text can dominate generation even when it is false.

Reasoning-enhanced LLMs motivate the proposed intervention because they already expose an explicit reasoning phase and can self-correct. Passage Injection exploits that capability by encouraging the model to read each passage, compare it with internal knowledge, identify contradictions or suspicious claims, and decide whether to trust, ignore, or correct the passage before committing to a final answer.

3. Prompting architecture and formal framing

The operational change in Passage Injection is simple but structurally specific (Tang et al., 25 Jul 2025). The model still receives the question $q$ as input. During the <think> ... phase, however, it is explicitly shown the retrieved passages and corresponding instructions about how to use them. The paper states that the full literal prompt template is not printed, but the structure is clear: the question precedes a reasoning block that enumerates passages, frames them as evidence to be evaluated, and then allows step-by-step reasoning and self-reflection to proceed before a final short answer is emitted.

This differs from vanilla RAG along two dimensions. The first is location: the passages are in the reasoning trajectory rather than only in the initial prompt prefix. The second is framing: the passages are introduced as material to reason with, not as text to copy from. The ablation result that Instruction Injection helps but Passage Injection helps more indicates that instructions alone do not explain the gains; the passages themselves need to appear inside the reasoning block.

The paper also gives a conceptual probabilistic framing:

$$p(a \mid q, D) = \sum_r p(a \mid r, q, D)\, p(r \mid q, D).$$

Under this view, vanilla RAG allows retrieved passages to influence the distribution over reasoning traces in an uncontrolled way, whereas Passage Injection is a prompt-level intervention intended to bias $q$0 toward self-verifying reasoning. This suggests a specific interpretation of the method: it does not improve retrieval quality directly, but changes how retrieval evidence is metabolized during generation.

4. Experimental setting and evaluation protocol

The paper evaluates Passage Injection under general RAG settings with BM25 as the retriever and top-$q$1 retrieval for $q$2 (Tang et al., 25 Jul 2025). The model set comprises Qwen3-8B, Qwen3-14B, Qwen3-32B, and DeepSeek-R1-Distill-Qwen-32B. The evaluation tasks are knowledge-intensive factual QA datasets: 2WikiMultiHopQA, HotpotQA, ComplexWebQuestions, and PopQA. Counterfactual-noise robustness is additionally evaluated with ConFiQA. The study is inference-only: the LLMs are not fine-tuned, and the main evaluation regime is zero-shot with the recommended generation parameters temperature $q$3 and top-$q$4 $q$5.

Performance is measured by answer-string F1, with the standard token-level precision, recall, and harmonic-mean computation. Reported numbers are F1 percentages. The paper emphasizes micro-averaged F1 across the four QA datasets in the general BM25 top-5 setting.

The main comparison is among Direct QA, Vanilla RAG, Instruction Injection, and Passage Injection. For BM25 top-5 micro-average F1, the reported results are as follows. For Qwen3-8B, scores are 27.39, 32.45, 38.60, and 40.30. For Qwen3-14B, they are 30.85, 36.29, 40.19, and 41.31. For Qwen3-32B, they are 31.45, 40.56, 39.77, and 43.41. For DeepSeek-R1-Distill-Qwen-32B, they are 30.17, 42.63, 43.55, and 43.84. The consistent pattern is that Passage Injection almost always gives the best micro-averaged F1.

5. Empirical behavior: performance, robustness, and ablations

In the general RAG setting, Passage Injection improves over Vanilla RAG in almost all settings, with larger gains on multi-hop datasets such as 2WikiMultiHopQA, HotpotQA, and ComplexWebQuestions than on the single-hop PopQA benchmark (Tang et al., 25 Jul 2025). Instruction Injection also improves over Vanilla RAG, but usually does not reach Passage Injection, which supports the claim that placing retrieved passages inside <think> is a critical factor rather than a cosmetic formatting change.

The robustness experiments sharpen that conclusion. Under Random Noise, where all three supplied passages are irrelevant, Direct QA often outperforms Vanilla RAG because retrieval becomes a distraction. Passage Injection yields the highest F1 across the tested models, indicating better suppression of irrelevant evidence. Under Counterfactual Noise with ConFiQA, Vanilla RAG is strongly harmed by fluent but false context, whereas Passage Injection consistently outperforms both Vanilla RAG and Instruction Injection across model sizes. The paper interprets this as improved ability to detect that something in the passage is wrong and to rely more heavily on internal knowledge when retrieved evidence is contradictory.

Controlled experiments further show that Passage Injection can effectively leverage helpful passages as well. The method is therefore not only a defense against noise; it also preserves the ability to benefit from useful retrieval. This dual behavior is important because a robustness technique that merely ignored retrieval would not be a viable RAG strategy.

Ablation analysis indicates that RL-based reasoning models in the Qwen3 series benefit more than the distillation-based DeepSeek-R1-Distill-Qwen-32B. The authors’ interpretation is that RL-based models exhibit stronger emergent self-correction and are more sensitive to interventions in the reasoning path, whereas distilled reasoning models inherit a more imitation-based reasoning style and show smaller marginal gains.

The paper also reports an efficiency-related observation. Passage Injection adds no extra model calls, because it remains a single inference per question, yet it often reduces output length. On ComplexWebQuestions with Qwen3-32B, average output length drops from 2,267 characters under Vanilla RAG to 1,199 under Passage Injection; on PopQA, it drops from 1,760 to 787. Similar reductions are reported for DeepSeek-R1-Distill-Qwen-32B. The paper interprets this as mitigation of overthinking: integrating passages into the reasoning phase can make the model find relevant information more directly.

6. Ambiguity of the term, limitations, and related directions

A recurrent source of confusion is terminological. In (Tang et al., 25 Jul 2025), Passage Injection is a defensive prompting scheme for robust RAG. In several security papers, however, the same phrase or a very close variant refers to adversarial corpus poisoning or document-side prompt injection. “PIDP-Attack” describes passage injection as inserting a small number of poisoned passages into the retrieval database and combining them with query-side prompt injection to force an attacker-chosen answer (Wang et al., 26 Mar 2026). “Through the Stealth Lens” studies retrieval corruption attacks in which an attacker injects adversarial passages into the knowledge base so that some of them enter the retrieved set and dominate the generated answer (Choudhary et al., 4 Jun 2025). “Poisoning Retrieval Corpora by Injecting Adversarial Passages” formalizes corpus poisoning for dense retrievers via a small injected set of adversarial passages (Zhong et al., 2023). “Illusions of Relevance” studies content injection attacks in which adversaries insert misleading text into passages so that retrievers, rerankers, and LLM judges still regard them as relevant (Tamber et al., 30 Jan 2025). The phrase therefore spans both robustness-enhancing prompting and adversarial retrieval manipulation, depending on the paper.

Within the defensive prompting formulation itself, the paper identifies several limitations (Tang et al., 25 Jul 2025). The method depends on reasoning-enhanced models that can meaningfully use a <think> block; it may not transfer directly to standard non-reasoning LLMs. Gains are smaller for the distillation-based DeepSeek-R1-Distill-Qwen-32B than for the Qwen3 models. Long prompts with multiple passages can interact with context-window limits, and the effectiveness may depend on the exact wording of instructions. The paper also does not claim immunity in adversarial settings with multiple contradictory passages or adversarial instruction content.

The forward-looking directions are correspondingly hybrid. The authors explicitly position Passage Injection as complementary to retrieval-side improvements such as better retrievers, reranking, and filtering, rather than a replacement for them. They also suggest more sophisticated reasoning-time interventions, such as interleaving passages step by step with reasoning, dynamic passage selection during reasoning, extension to tasks beyond QA, and possible training-time integration of Passage Injection-style prompts. A plausible implication is that future robust RAG systems may combine cleaner retrieval, provenance or sanitization mechanisms, and reasoning-side evidence evaluation rather than relying on any single intervention.