When Retrieval Systems Encode Wrong Entity-Context Bindings

Retrieval-augmented foundation models can surface false associations when their indexes are built from polluted multilingual corpora. We study this failure mode as index-level adversarial memorization: incorrect entity-context bindings need not be learned during pretraining, yet are preserved and amplified by the retrieval index.

We present a multilingual case study of three game developers whose names became bound to military and political contexts across gaming communities and news media. From 1,535 Chinese-, Russian-, and English-language news articles we verify 24 pollution cases (83% from Chinese-language sources). Injecting these cases substantially compromises Chinese-language retrieval: BM25 reaches Pollution@10 = 1.00 [95% CI 0.94-1.00], while multilingual dense retrievers also surface polluted results (mE5-large 0.90, BGE-M3 0.52). We further observe a directionally suggestive cross-lingual leak under BGE-M3 (English PS = 0.25 vs. BM25's 0.00), indicating that dense multilingual retrieval can propagate entity-context pollution beyond the source language.

We evaluate four detection filters and find that they identify only 8.3%-20.8% of polluted articles, whereas an evidence-grounded rewriting prototype removes 83.3% (p < 1e-5 vs. best filter); after re-indexing, Chinese system-level Pollution@10 drops from 1.00 to 0.00 under BM25 and from 0.52 to 0.05 under BGE-M3. A manual audit (kappa = 0.14) further shows that keyword-trigger classifiers can overestimate cross-domain pollution by up to 17x, underscoring the need for evidence-grounded evaluation. These results establish a case-study benchmark for multilingual index-level pollution and show that retrieval systems can amplify false entity-context bindings even without pretraining-time memorization.