MIRAGE: Defending Long-Form RAG Against Misinformation Pollution

Classified as probably not a substantial claim.

The authors evaluate factuality with VeriScore F1@k (median over prompts), which decomposes each generated answer into claims and uses a verifier to label each claim as supported, unsupported, or insufficient given evidence snippets.

“We evaluate factuality with VeriScore (Song et al., 2024) F1@k (median over prompts), which decomposes each generated answer into claims and uses a verifier to label each claim as supported, unsupported, or insufficient given evidence snippets (Wei et al., 2024); see Appendix E.”

• cites Song et al., 2024 sourcePartly supported

  Sections 2.2–2.4 describe extracting claims, checking them against retrieved evidence, and calculating F1@K. But §2.4 defines VeriScore as the average F1@K across prompt responses; the median sets K from the number of extracted claims, not the score over prompts. Section 2.3 says the final verifier combines contradicted and inconclusive cases into one unsupported category, rather than using the three labels stated in the claim. Page numbers were not available in our copy. (LLM, conf=0.91)

  Experimental — accuracy not yet measured
• cites Wei et al., 2024 sourcePartly supported

  The SAFE section describes breaking responses into individual facts and using search results to judge whether each is supported. But its labels are supported, not supported, and irrelevant—not supported, unsupported, and insufficient. The paper’s benchmarking table also says its metrics are averaged over prompts, not reported as a median. (LLM, conf=0.88)

  Experimental — accuracy not yet measured

May combine two claims.

Prior active and self-reflective RAG methods largely assume a reasonably trustworthy corpus and mainly filter irrelevant context, leaving them vulnerable to semantically relevant but incorrect passages.

“However, these approaches largely assume a reasonably trustworthy corpus and mainly filter irrelevant context, leaving them vulnerable to semantically relevant but incorrect passages (i.e., polluted evidence).”

• cites Jiang et al., 2023b sourcePartly supported

  Sections 3.2.2 and 6.2 describe improving retrieval relevance and avoiding unnecessary retrieval noise, which supports the claim's relevance-focused characterization of FLARE. But the paper does not say that active or self-reflective RAG methods generally assume a trustworthy corpus, mainly filter irrelevant passages, or are vulnerable to semantically relevant but incorrect evidence. The cited passages have no page numbers in our copy. (LLM, conf=0.78)

  Experimental — accuracy not yet measured
• cites Asai et al., 2024Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Su et al., 2024Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Compared with prior robust-RAG methods that require multiple generation calls or iterative retrieval, MIRAGE keeps generation to a single LLM call per query and shifts robustness computation to bounded local NLI verification.

“Compared with prior robust-RAG methods that require multiple generation calls or iterative retrieval (Wang et al., 2025a;Jiang et al., 2023b;Su et al., 2024), MIRAGE keeps generation to a single LLM call per query and shifts robustness computation to bounded local NLI verification.”

• cites Wang et al., 2025aNot matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites Jiang et al., 2023b sourceSupported
• cites Su et al., 2024Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Simple concatenation schemes partially mitigate the worst failures by allowing the verifier to choose between multiple answers, but they still trail MIRAGE by a wide margin on both datasets.

“Simple concatenation schemes partially mitigate the worst failures by allowing the verifier to choose between multiple answers, but they still trail MIRAGE by a wide margin on both datasets.”

May combine two claims.

MIRAGE generation requires only one LLM call per query, but introduces additional local NLI computation for graph construction and counter-evidence checks.

“Finally, while generation still requires only one LLM call per query, MIRAGE introduces additional local NLI computation for graph construction and counter-evidence checks; Appendix G reports the resulting overhead.”

May combine two claims.

Across all datasets, MIRAGE ranks first for both backbones and both regimes.

“Across all datasets, MIRAGE ranks first for both backbones and both regimes”

May combine two claims.

Under full pollution, MIRAGE detects unreliable retrieval and falls back to parametric generation, avoiding harmful context.

“Under full pollution, MIRAGE detects unreliable retrieval and falls back to parametric generation, avoiding harmful context.”

May combine two claims.

In practice, the gate passes most clean queries, degrades under mixed retrieval, and blocks nearly all fully polluted queries.

“In practice, the gate satisfies basic sanity checks: it passes most clean queries, degrades under mixed retrieval, and blocks nearly all fully polluted queries, see Table 3.”

May combine two claims.

Under MixP, gains are large across backbones (e.g., GPT-4o-mini improves from 53.88% to 83.43% on average; for LLaMA-3.1-8B, it improves from 41.71% to 71.91%).

“Under MixP, gains are large across backbones (e.g., GPT-4o-mini improves from 53.88% to 83.43% on average; for LLaMA-3.1-8B, it improves from 41.71% to 71.91%).”

May combine two claims.

Polluted claims induce dense contradictions, while clean evidence forms multi-source support clusters, and MIRAGE uses these patterns to detect unreliable retrieval.

“Polluted claims induce dense contradictions, while clean evidence forms multi-source support clusters.MIRAGE uses these patterns to detect unreliable retrieval.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the illustrative mixed-retrieval example, MIRAGE keeps the top N = 3 claims, yielding the defended set S* = {C1, C2, C3}.

“Let MIRAGE keep the top N =3 claims, yielding the defended set S ⋆ = {C1, C2, C3}.”

• AssumptionThe authors state this as an assumption: In the illustrative mixed-retrieval example, the claim extractor produces one atomic claim per passage.

May combine two claims.

Under FullP, vanilla RAG collapses (e.g., GPT-4o-mini: 39.87% vs. No-RAG 75.88%), while MIRAGE substantially recovers performance (GPT-4o-mini reaches 78.00% on average; LLaMA-3.1-8B reaches 70.34%).

“Under FullP, vanilla RAG collapses (e.g., GPT-4o-mini: 39.87% vs. No-RAG 75.88%), while MIRAGE substantially recovers performance (GPT-4o-mini reaches 78.00% on average; LLaMA-3.1-8Breaches 70.34%).”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the illustrative mixed-retrieval example, under the global gate configuration (r max = 0.98 and d min = 2), all active gate conditions are satisfied and the gate passes, conditioning the generator only on S*.

“Under the global gate configuration used in our experiments (r max = 0.98 and d min = 2), all active gate conditions are satisfied: 0.0 ≤ 0.98 and 3 ≥ 2. The gate therefore passes and the generator is conditioned only on S ⋆ .”

• AssumptionThe authors state this as an assumption: In the illustrative mixed-retrieval example, the claim extractor produces one atomic claim per passage.

The quote only partly states this claim.

MIRAGE restores factuality toward clean-RAG levels under mixed and full pollution.

“whereas MIRAGE restores factuality toward clean-RAG levels”

• Also stated in: § 7 Conclusion and Future Work · plain

  “MIRAGE restores factuality under mixed and fully polluted evidence”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Within the illustrative defended set S*, overlap-based pairing produces one support edge between C1 and C2 and no contradictions, so contradiction_ratio = 0.0.

“Within S ⋆ , the overlap-based pairing produces one edge between C 1 and C 2 (support), and no contradictions: edges = 1, support_edges = 1, and contradiction_edges = 0. Thus, contradiction_ratio = 0/1 = 0.0.”

• AssumptionThe authors state this as an assumption: In the illustrative mixed-retrieval example, the claim extractor produces one atomic claim per passage.

May combine two claims.

The claim-support graph baseline improves naive concatenation but underperforms MIRAGE.

“This improves naive concatenation but underperforms MIRAGE”

May combine two claims.

The gate passes 87.2% of clean queries on average, drops to 48.6% under mixed retrieval, and blocks nearly all fully polluted queries (0% pass).

“Table 3 shows that the gate passes 87.2% of clean queries on average, drops to 48.6% under mixed retrieval, and blocks nearly all fully polluted queries (0% pass).”

May combine two claims.

Lexical filtering reduces the average number of pairs sent to NLI from 971.22 to 38.28 in MixP and from 1214.76 to 31.15 in FullP, avoiding 96.1% and 97.4% of pairwise NLI calls, respectively.

“As shown in Table 18, lexical filtering reduces the average number of pairs sent to NLI from 971.22 to 38.28 in MixP and from 1214.76 to 31.15 in FullP, avoiding 96.1% and 97.4% of pairwise NLI calls, respectively.”

May combine two claims.

MIRAGE reduces the number of NLI pairs by 96.1% under mixed pollution and 97.4% under full pollution.

“MixP | 120 | 971.22 | 38.28 932.93 | 96.1%”

• Also stated in: § K.1 Unambiguous (Single-Fact Edits) · plain

  “FullP | 120 1214.76 | 31.15 1183.61 | 97.4%”

May combine two claims.

The optimal value of k depends mildly on the corruption level, with larger k benefiting heavily polluted settings.

“The optimal value depends mildly on the corruption level, with larger k benefiting heavily polluted settings.”

May combine two claims.

The claim-support graph baseline is the strongest answer-level baseline in several settings, but still trails MIRAGE; on FAVA with GPT-4o-mini it achieves 68.24% versus 82.54% for MIRAGE, and on LongFact 74.66% versus 88.93%.

“The claim-support graph baseline is the strongest answer-level baseline in several settings, but still trails MIRAGE; for example, on FAVA with GPT-4o-mini it achieves 68.24% versus 82.54% for MI-RAGE, and on LongFact 74.66% versus 88.93%.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the illustrative mixed-retrieval example, the claims span three distinct domains, so source_diversity = 3.

“Since the claims span three distinct domains, source_diversity = 3.”

• AssumptionThe authors state this as an assumption: In the illustrative mixed-retrieval example, the claim extractor produces one atomic claim per passage.

May combine two claims.

On LongFact, MIRAGE improves over the strongest baseline for GPT-4o-mini (88.93% vs. 74.87%) and for Qwen3-8B (85.11% vs. 66.41%).

“on Long-Fact, MIRAGE improves over the strongest baseline for GPT-4o-mini (88.93% vs. 74.87%)and for Qwen3-8B (85.11% vs. 66.41%).”

May combine two claims.

Because polluted claims receive no cross-source support and come from low-trust domains, they rank below the coherent clean cluster and are pruned away.

“Because polluted claims receive no cross-source support (and come from low-trust domains), they rank below the coherent clean cluster and are pruned away.”

Classified as probably not a substantial claim. May combine two claims.

Using log(1+n(c)) gives a large gain for the first independent supporter and diminishing returns for additional supporters.

“We use log(1+n(c)) so that the first independent supporter yields a large gain (from 0 to log 2 ≈ 0.69) while additional supporters have diminishing returns.”

Classified as probably not a substantial claim.

Lexical filtering can miss paraphrastic agreement or contradiction, especially under omission, framing, or heavy rewording rather than shared entities, dates, or numbers.

“Lexical filtering can miss paraphrastic agreement or contradiction, especially under omission, framing, or heavy rewording rather than shared entities, dates, or numbers.”

May combine two claims.

MIRAGE blocks unreliable evidence and falls back to parametric answering.

“while MIRAGE blocks unreliable evidence and falls back to parametric answering”

May combine two claims.

In MIRAGE, domain trust is strictly secondary: it can break ties among otherwise similar claims, but it is never sufficient on its own and cannot override multi-source agreement.

“In MIRAGE, domain trust is strictly secondary: it can break ties among otherwise similar claims, but it is never sufficient on its own and cannot override multi-source agreement.”

May combine two claims.

In polluted RAG, a retriever returns a mix of clean and polluted passages, and even a single high-scoring polluted document can steer the LLM toward a confident but incorrect answer.

“A retriever returns a mix of clean and polluted passages.Even a single highscoring polluted document can steer the LLM toward a confident but incorrect answer.”

Classified as probably not a substantial claim.

The authors enforce strict edit constraints, including high token overlap and neutral tone, to ensure realistic rather than overtly adversarial pollution.

“We enforce strict edit constraints, including high token overlap and neutral tone, to ensure realistic rather than overtly adversarial pollution.”

May combine two claims.

MIRAGE inherits the coverage and diversity of retrieved evidence: low recall or limited source diversity can produce sparse graphs and more conservative blocking, yielding safer but less informative answers.

“MIRAGE inherits the coverage and diversity of retrieved evidence: low recall or limited source diversity can produce sparse graphs and more conservative blocking, yielding safer but less informative answers.”

Classified as probably not a substantial claim. The quote only partly states this claim.

The authors instantiate four corruption families under minimal-edit constraints: Unambiguous, Conflicting, Misleading, and Fabricated.

“Inspired by prior evidence taxonomies for misleading/conflicting retrieval (e.g., (Zeng et al., 2025)), we instantiate four corruption families under minimal-edit constraints:”

• cites Zeng et al., 2025Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable).

Robust RAG should verify retrieved evidence before generation, rather than treating topical relevance as sufficient evidence quality.

“More broadly, the findings suggest that robust RAG should verify retrieved evidence before generation, rather than treating topical relevance as sufficient evidence quality.”

May combine two claims.

The authors manually verify 150 VeriScore-labeled claims with retrieved evidence; two annotators achieve 87.33% agreement.

“We manually verify 150 VeriScore-labeled claims with retrieved evidence; two annotators achieve 87.33% agreement.”

Classified as probably not a substantial claim. May combine two claims.

The choice of α=0.5, β=0.3 encodes a priority ordering: cross-source agreement dominates, domain quality provides a modest prior, and retrieval rank only breaks ties.

“This choice encodes a simple priority ordering that we keep consistent throughout: (i) cross-source agreement should dominate, (ii) domain quality should provide a modest prior, and (iii) retrieval rank should only break ties.”

• AssumptionRests on an assumption: The domain-trust weights in Table 10 are valid proxies for source reliability.

May combine two claims.

MIRAGE employs lightweight sentence segmentation and does not use an LLM for claim decomposition in any main experiment.

“MIRAGE employs lightweight sentence segmentation and does not use an LLM for claim decomposition in any main experiment, ensuring that the method remains training-free, reproducible, and low-overhead.”

Classified as probably not a substantial claim.

Counter-evidence edges penalize claims that appear plausible in the original retrieval set but are contradicted by targeted counter-evidence, complementing cross-source support and contradiction edges in the main claim graph.

“These edges penalize claims that appear plausible in the original retrieval set but are contradicted by targeted counter-evidence, complementing the cross-source support and contradiction edges in the main claim graph.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

MIRAGE is plugged on top of an embedding-based retriever without modifying the retrieval model.

“In all experiments we plug MIRAGE on top of an embedding-based retriever and do not modify the retrieval model; see Appendix D for details.”

May combine two claims.

MIRAGE restores factuality by filtering contradiction-heavy evidence and falling back to parametric answering when needed.

“by filtering contradiction-heavy evidence and falling back to parametric answering when needed.”

May combine two claims.

These gains primarily reflect avoiding harmful retrieval rather than exploiting polluted evidence.

“These gains primarily reflect avoiding harmful retrieval rather than exploiting polluted evidence.”

Classified as probably not a substantial claim. May combine two claims.

The pollution type and rationale are never shown to MIRAGE; they are used only for auditing and reporting.

“The rationale and type are never shown to MIRAGE; they are used only for auditing and reporting.”

Classified as probably not a substantial claim.

The retrieval pollution protocol produces matched clean, mixed, and polluted evidence sets for each benchmark.

“This protocol produces matched clean, mixed, and polluted evidence sets for each benchmark.”

Classified as probably not a substantial claim. May combine two claims.

A strict verifier prompt is used that decides only from shown snippets, requires high-trust evidence for SUPPORTED, and treats microperturbations as UNSUPPORTED.

“We use a strict verifier prompt that (i) decides only from the shown snippets, (ii) requires high-trust evidence to mark a claim as SUPPORTED, and (iii) treats microperturbations (dates, numbers, entities, directions, and temporal scopes) as UNSUPPORTED.”

Classified as probably not a substantial claim. May combine two claims.

The domain trust mapping is query-independent and used only as a lightweight source prior.

“This mapping is query-independent and used only as a lightweight source prior.”

May combine two claims.

MIRAGE improves resilience to polluted retrieval while keeping API-side cost close to a standard single-call RAG pipeline.

“Together with the robustness results in Table 2, this shows that MIRAGE improves resilience to polluted retrieval while keeping API-side cost close to a standard single-call RAG pipeline.”

Classified as probably not a substantial claim. May combine two claims.

Thresholds are determined once offline from graph statistics on the combined held-out 20% splits of all datasets, without invoking the generator; these splits are excluded from downstream evaluation to avoid data leakage, and the resulting single global configuration is used across all datasets and models.

“Thresholds are determined once offline from graph statistics on the combined held-out 20% splits of all datasets, without invoking the generator; these splits are excluded from downstream evaluation to avoid data leakage, and the resulting single global configuration is used across all datasets and models.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Core gate criteria configuration is selected offline via grid search on cached retrieval and NLI outputs without invoking the generator.

“Core gate criteria configuration is selected offline via grid search on cached retrieval and NLI outputs without invoking the generator.”

Classified as probably not a substantial claim. May combine two claims.

MIRAGE operates without access to ground-truth passage labels; its decisions are based solely on the retrieved text and the structural properties of the defended-claims graph.

“MIRAGE operates without access to ground-truth passage labels; its decisions are based solely on the retrieved text and the structural properties of the defended-claims graph.”

May combine two claims.

Under FullP, improvements mainly come from blocking polluted context, while under MixP, MIRAGE also benefits from retained clean, mutually supported claims.

“Under FullP, improvements mainly come from blocking polluted context, while under MixP, MIRAGE also benefits from retained clean, mutually supported claims.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The coefficients (α, β) in equation (3) are fixed across all experiments (α = 0.5 and β = 0.3) and not tuned per dataset.

“The coefficients (α, β) in equation ( 3) are not tuned per dataset and are fixed across all experiments (α = 0.5 and β = 0.3).”

• AssumptionRests on an assumption: The domain-trust weights in Table 10 are valid proxies for source reliability.

May combine two claims.

The No-RAG baseline is a parametric-only generation baseline without retrieved evidence, while MIRAGE's BLOCKED path uses a stronger no-evidence fallback prompt that explicitly asks the model to be uncertain, avoid speculation, and state what would be needed for verification.

“The No-RAG baseline is a parametric-only generation baseline without retrieved evidence, while MIRAGE's BLOCKED path uses a stronger noevidence fallback prompt that explicitly asks the model to be uncertain, avoid speculation, and state what would be needed for verification.”

Classified as probably not a substantial claim. May combine two claims.

The design of presenting only defended claims through a structured verified-claims prompt turns retrieval into an evidence-only input, constraining the model to generate answers grounded in verified claims and reducing hallucination.

“This design turns retrieval into an evidence-only input, constraining the model to generate answers grounded in verified claims and reducing hallucination.”

May combine two claims.

MIRAGE is intentionally training-free and modular, improving robustness, interpretability, and auditability across settings, though this may limit adaptation to some domains or languages.

“MIRAGE is intentionally training-free and modular, improving robustness, interpretability, and auditability across settings, though this may limit adaptation to some domains or languages.”

Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

All MIRAGE gate criteria and claim-scoring weights are fixed globally across datasets and LLM backbones.

“All values are fixed globally across datasets and LLM backbones.”

Probably not a substantial claim: may not pass S3 (load-bearing).

MIRAGE's domain-level features complement content-based consistency signals.

“Similarly, our domain-level features complement content-based consistency signals.”

Classified as probably not a substantial claim.

To systematically stress-test long-form RAG under misinformation, the authors introduce minimally edited corrupted variants of retrieved passages, yielding three controlled retrieval regimes per query (CLEAN, MIXED, POLLUTED) while keeping the evidence size fixed and preserving topical relevance.

“To systematically stress-test long-form RAG under misinformation, we introduce minimally edited corrupted variants of retrieved passages, yielding three controlled retrieval regimes per query: CLEAN, MIXED, and POLLUTED, while keeping the evidence size fixed and preserving topical relevance.”

• AssumptionRests on an assumption: Retrieval pollution (on-topic misinformation) is a significant problem for long-form RAG.

Classified as probably not a substantial claim. May combine two claims.

For each question, the authors start from cached clean retrieval passages and use GPT-4o-mini to generate corrupted variants that remain fluent and on-topic while introducing at least one verifiable factual error.

“For each question q, we start from cached clean retrieval passages D CLEAN (q) = {p 1 , . . ., p k } and use GPT-4o-mini to generate corrupted variants pi that remain fluent and on-topic while introducing at least one verifiable factual error.”

May combine two claims.

MIRAGE retains up to N = 120 candidate claims, yielding 120 2 = 7140 possible pairs, but performs at most P max = 400 sampled pairwise NLI checks per query.

“Although MIRAGE retains up to N = 120 candidate claims (yielding 120 2 = 7140 possible pairs), it performs at most P max = 400 sampled pairwise NLI checks per query.”

May combine two claims.

MIRAGE uses NLI-based consistency and lexical-overlap filtering as efficient, interpretable approximations for scalable cross-claim verification, though these can miss paraphrastic or omission-based misinformation.

“It uses NLI-based consistency and lexical-overlap filtering as efficient, interpretable approximations for scalable cross-claim verification, though these can miss paraphrastic or omission-based misinformation.”

• AssumptionRests on an assumption: NLI-based consistency and lexical-overlap filtering are sufficient for scalable cross-claim verification.

May combine two claims.

All NLI verification uses a local model and therefore contributes wall-clock compute but not LLM API cost.

“All NLI verification uses a local model and therefore contributes wall-clock compute but not LLM API cost.”

May combine two claims.

MIRAGE surpasses No-RAG through trust-aware gating and fallback no-evidence generation.

“through trust-aware gating and fallback no-evidence generation.”

May combine two claims.

Scaling the domain prior by 0.5 ensures that moving from lowest to highest trust changes s(c) by at most 0.35, which is smaller than the gain from one additional independent supporter (log 2 ≈ 0.69), preventing priors from overpowering consensus.

“We scale the domain prior by 0.5 so that moving from the lowest-to highest-trust sources (0.20 → 0.90) changes s(c) by at most 0.35, which is still smaller than the gain from one additional independent supporter (log 2 ≈ 0.69), preventing priors from overpowering consensus.”

• AssumptionRests on an assumption: The domain-trust weights in Table 10 are valid proxies for source reliability.

May combine two claims.

MIRAGE applies a Defended-Claims Gate to either condition generation on a consistent, multi-source supported subset or to block retrieval and answer parametrically.

“applies a Defended-Claims Gate to either condition generation on a consistent, multi-source supported subset or to block retrieval and answer parametrically.”

May combine two claims.

Domain trust being secondary prevents high-reputation but polluted passages from dominating the graph, while still allowing source quality to stabilize scoring.

“This prevents high-reputation but polluted passages from dominating the graph, while still allowing source quality to stabilize scoring.”

May combine two claims.

In regimes where MIRAGE blocks retrieval, differences from No-RAG should not be interpreted as evidence-use gains; they reflect removal of polluted context exposure plus the effect of the safer fallback instruction template.

“Therefore, in regimes where MIRAGE blocks retrieval, differences from No-RAG should not be interpreted as evidence-use gains.They reflect removal of polluted context exposure plus the effect of the safer fallback instruction template.”

Classified as probably not a substantial claim.

To enable controlled and reproducible retrieval/pollution evaluation, the authors construct a dataset-specific cached clean evidence pool from web search and derive Clean/Mixed/Fully-Polluted retrieval regimes from that fixed pool.

“To enable controlled and reproducible retrieval/pollution evaluation, we construct a dataset-specific cached clean evidence pool from web search and derive Clean/Mixed/Fully-Polluted retrieval regimes from that fixed pool.”

Probably not a substantial claim: may not pass S3 (load-bearing).

In the illustrative mixed-retrieval example, MIRAGE does not observe the pollution labels.

“For exposition only, we annotate which retrieved passages are polluted; MIRAGE does not observe these labels.”

May combine two claims.

MIRAGE is a training-free, model-agnostic defense for long-form RAG.

“We introduce MI-RAGE, a training-free, model-agnostic defense for long-form RAG.”

• Also stated in: § 1 Introduction · plain

  “We introduce MIRAGE, a training-free and model-agnostic defense for long-form RAG that constructs cross-document NLI-based claim graphs to identify, prune, and gate misinformation-polluted evidence before generation (see Section 3).”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Retrieval uses cached/local evidence, and the reported monetary cost reflects only LiteLLM-recorded gpt-4o-mini generation cost.

“Retrieval uses cached/local evidence, and the reported monetary cost reflects only LiteLLMrecorded gpt-4o-mini generation cost.”

Probably not a substantial claim: may not pass S3 (load-bearing).

The token-overlap filter is used only for efficient candidate generation before NLI adjudication.

“The token-overlap filter in equation ( 1) is used only for efficient candidate generation before NLI adjudication.”

May combine two claims.

MIRAGE remains training-free, reproducible, and low-overhead.

“MIRAGE employs lightweight sentence segmentation and does not use an LLM for claim decomposition in any main experiment, ensuring that the method remains training-free, reproducible, and low-overhead.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

Retrieved passages and similarity scores are cached per (dataset, model) run for reproducibility and to seed the pollution protocol.

“Retrieved passages and similarity scores are cached per (dataset, model) run for reproducibility and to seed the pollution protocol.”

Probably not a substantial claim: may not pass S3 (load-bearing).

MIRAGE issues counter-evidence probes for up to M = 8 claims with at most k ctr = 3 passages each, yielding a bounded local verification budget of roughly 400 + 8 × 3 = 424 NLI checks per query.

“MIRAGE also issues counter-evidence probes for up to M = 8 claims with at most k ctr = 3 passages each, yielding a bounded local verification budget of roughly 400 + 8 × 3 = 424 NLI checks per query.”

Classified as probably not a substantial claim.

All retrieval regimes (Clean/Mixed/Fully Polluted) are derived from the same cached candidate pool.

“All retrieval regimes (Clean/Mixed/Fully Polluted) are derived from the same cached candidate pool.”

• AssumptionRests on an assumption: The retrieved evidence pool is representative of the web evidence that RAG systems encounter.

Probably not a substantial claim: may not pass S3 (load-bearing).

Query-independent authority signals such as TrustRank-style propagation are auxiliary features rather than primary evidence in web-ranking practice.

“This follows web-ranking practice, where queryindependent authority signals such as TrustRankstyle propagation (Soricut and Echihabi, 2010) are auxiliary features rather than primary evidence.”

• cites Soricut and Echihabi, 2010Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

Coordinated misinformation repeated across sources may appear trustworthy to MIRAGE.

“Coordinated misinformation repeated across sources may also appear trustworthy.”

May combine two claims.

MIRAGE avoids conditioning on polluted retrieval, whereas vanilla RAG remains exposed to it.

“The substantive comparison is that MIRAGE avoids conditioning on polluted retrieval, whereas vanilla RAG remains exposed to it.”

Classified as probably not a substantial claim. May combine two claims.

The added counter-evidence query terms are generic and dataset-independent, intended to surface refutations, corrections, or disagreement-oriented evidence without using ground-truth labels.

“The added terms are generic and dataset-independent: they are intended to surface refutations, corrections, or disagreementoriented evidence without using any ground-truth labels.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Unless otherwise stated, all experiments use a single fixed global configuration for both the core gate criteria and computational settings.

“Unless otherwise stated, all experiments use a single fixed global configuration for both the core gate criteria (Table 8) and computational settings (Table 9).”

Probably not a substantial claim: may not pass S3 (load-bearing).

Retrieval is made deterministic and efficient by pre-constructing and caching per-question retrievers.

“To make retrieval deterministic and efficient, we pre-construct and cache per-question retrievers.”

May combine two claims.

MIRAGE makes a single LLM generation call per query: either verified-claims generation when the gate passes, or parametric no-retrieval generation when the gate blocks.

“MIRAGE makes a single LLM generation call per query: either verified-claims generation when the gate passes, or parametric no-retrieval generation when the gate blocks.”

Classified as probably not a substantial claim. May combine two claims.

The pollution protocol enforces topic preservation, minimal editing, non-absurd plausibility, and anti-shortcut rules to avoid trivial artifacts.

“To avoid trivial artifacts, we enforce: (1) topic preservation (the rewrite remains about the same entities and subject as the question/passage), (2) minimal editing (preserve 50-80% of tokens and cap token-change at ≤ 0.75), (3) non-absurd plausibility (neutral encyclopedic tone; no satire), and (4) anti-shortcut rules (reject vague comparatives and meta-commentary; no citations/URLs).”

• AssumptionRests on an assumption: The pollution protocol's constraints (topic preservation, minimal editing, non-absurd plausibility, anti-shortcut rules) ensure that polluted passages are realistic and non-trivial.

May combine two claims.

MIRAGE operates on the underlying retrieval graph and can block RAG entirely, falling back to safer parametric generation.

“whereas MIRAGE operates on the underlying retrieval graph and can block RAG entirely, falling back to safer parametric generation.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The manual check complements the NLI-label audit: the NLI audit validates the claim-graph edges used by MIRAGE, while the VeriScore audit validates the factuality labels used to evaluate generated answers.

“This check complements the NLI-label audit above: while the NLI audit validates the claimgraph edges used by MIRAGE, the VeriScore audit validates the factuality labels used to evaluate generated answers.”

Classified as probably not a substantial claim.

Polluted passages are generated using an approximately uniform mix over the four corruption families to reduce confounding from any single corruption style.

“To reduce confounding from any single corruption style, we generate polluted passages using an approximately uniform mix over the four families.”

• AssumptionRests on an assumption: The four corruption families (Conflicting, Misleading, Fabricated, Unambiguous) cover the space of misinformation that long-form RAG must defend against.

Classified as probably not a substantial claim.

The paper releases a minimal-edit pollution protocol spanning four perturbation families (Unambiguous, Conflicting, Misleading, Fabricated) to construct matched clean, mixed, and fully polluted evaluation regimes.

“We also release a minimal-edit pollution protocol spanning four perturbation families (Unambiguous, Conflicting, Misleading, Fabricated) to construct matched clean, mixed, and fully polluted evaluation regimes.”

Classified as probably not a substantial claim.

The token-overlap filter works well in practice because supporting evidence typically preserves key lexical anchors.

“This containment-style overlap works well in practice because supporting evidence typically preserves key lexical anchors (e.g., named entities and dates).”

May combine two claims.

The claim-support graph baseline lacks an explicit defense mechanism and cannot stop generation when retrieval is broadly polluted but internally consistent.

“Second, it lacks an explicit defense mechanism and cannot stop generation when retrieval is broadly polluted but internally consistent.”