No Free Lunch: Retrieval-Augmented Generation Undermines Fairness in LLM s, E ven for Vigilant Users (2025)

Abstract: Retrieval-Augmented Generation (RAG) is widely adopted for its effectiveness and cost-efficiency in mitigating hallucinations and enhancing the domain-specific generation capabilities of large language models (LLMs). However, is this effectiveness and cost-efficiency truly a free lunch? In this study, we comprehensively investigate the fairness costs associated with RAG by proposing a practical three-level threat model from the perspective of user awareness of fairness. Specifically, varying levels of user fairness awareness result in different degrees of fairness censorship on external datasets. We examine the fairness implications of RAG using uncensored, partially censored, and fully censored datasets. Our experiments demonstrate that fairness alignment can be easily undermined through RAG without the need for fine-tuning or retraining. Even with fully censored and supposedly unbiased external datasets, RAG would still lead to biased outputs. Our findings underscore the limitations of current alignment methods in the context of RAG-based LLMs and highlight the urgent need for new strategies to ensure fairness. We propose potential mitigations and call for further research to develop robust fairness safeguards in RAG-based LLMs.

## introduction retrieval-augmented generation (rag) is increasingly popular for mitigating hallucinations and enhancing the domain-specific generation capabilities of large language models (llms) @xcite . by retrieving relevant knowledge from external datasets, rag allows llms to enhance their generative capabilities without the need for fine-tuning or retraining. this makes rag both an effective and efficient solution for improving llm performance. notably, both openai (openai, 2024) * equal contribution. to investigate this pressing issue, we propose a practical three-level threat model that considers varying levels of user awareness regarding the fairness of external datasets. different levels of user awareness of fairness result in different degrees of fairness censorship in external datasets. consequently, we examine the fairness implications of rag using uncensored datasets, partially censored datasets, and fully censored datasets on llms. alarmingly, our experiments demonstrate that even when using datasets that are fully cen-sored for fairness-which seemingly represents a straightforward solution for mitigating unfairness-we still observe notable degradation in fairness. level 1: fairness risk of uncensored datasets ( § 4.2). many users leverage rag to enhance specific tasks, often inadvertently overlooking the fairness implications of the external dataset they utilize. consequently, they may inadvertently rely on uncensored datasets that contain significant biased information. our findings demonstrate that even a small fraction of unfair samples (20%) is sufficient to elicit biased responses. furthermore, we observe that the greater the extent of uncensorship, the more pronounced the decrease in fairness. we suspect this is because rag retrieves highly relevant yet unfair content for the query, increasing the likelihood that the llm generates unfair responses due to the high similarity. level 2: fairness risk of partially mitigated datasets ( § 4.3). while users often focus on mitigating commonly acknowledged biases (e.g., race and gender) in external datasets, our experimental findings indicate that merely removing these prominent biases does not guarantee fair generation within those categories (fig. 5 ). specifically, biased samples from less recognized categories (e.g., nationality) can still adversely affect the fairness of popular bias categories, even when biases from these popular categories have been eliminated. further exploration and explanation of this phenomenon can be found in section 4.3. this underscores the need for future research to consider a wider range of bias categories to create a more robust fairness framework. level 3: fairness risk of carefully censored datasets ( § 4.4). even when users are highly aware of fairness and implement meticulous mitigation strategies to eliminate bias in the external dataset as much as possible, rag can still significantly compromise the fairness of llms (fig. 6 ). this vulnerability arises because the information retrieved via rag can boost the llm's confidence when choosing definitive answers to potentially biased questions (fig. 7 ). as a result, more ambiguous responses like "i do not know" decrease, while biased answers become more likely. this risk highlights that rag can undermine fairness, even with vigilant users, emphasizing the need for further research into this critical issue. this study is the first to uncover significant fairness risks associated with rag from a practical user perspective on llms. additionally, we discuss mitigation strategies ( § 5) with limited effectiveness and urge further research to develop robust fairness safeguards for rag-based llms. ## mitigation methods in this section, we explore additional component, safe prompts, and data moderation, as three potential strategies for mitigating the fairness risk in rag-based systems. additional components. additional components, such as re-rankers and summarizers, are widely used to enhance the quality of generated content, by reducing irrelevant information in retrieved documents. can these components also serve as effective strategies to reduce unfair information in rag-based systems? to explore this, we evaluate performance before and after applying these strategies to datasets with an initial unfairness rate of 1.0. fig. 8 shows that the sparse retriever, reranker, and rewriter have little impact on fairness, while the summarizer shows potential in mitigating unfairness. this likely stems from the summarization step, where llms (chatgpt-4) generate the summary of retrieved information that filter out harmful content as a result of its fairness alignment. specifically, our experiments show that summarization reduced the toxicity score of retrieved information from 0.714 to 0.202, further validating the hypothesis. more details on these strategies, as well as additional results for datasets with an unfairness rate of 0.0, can be found in appendix l. ## conclusion this work examines the fairness risks of rag from three levels of user awareness regarding fairness and outlines potential mitigation methods. results in our experiments show that fairness can be easily compromised by rag, even when using clean datasets. this finding highlights the stealthy and low-cost nature of adversarial attacks aimed at inducing fairness degradation, which poses significant threats to the alignment of llms. hence, we strongly encourage further research focused on strengthening fairness protocols in rag processes.