Beihang University Professor Sha Lei: When Agentic RAG Meets Reality | Agent Insights

At WWDC 24, Apple unveiled its new operating systems, and as the grand finale, Apple Intelligence finally took center stage — showing us how AI could weave itself into our daily lives. Oasis Capital invited Professor Lei Sha, an expert with dual backgrounds in NLP academia and industry, to share his insights. He previously worked on the Siri team at Apple in the Bay Area. In this episode, Professor Sha introduces his latest research project, ATM (Adversarial Tuning Multi-agent System), discusses his views on Apple's AI future, and explains how ATM uses adversarial agents similar to GANs to enhance RAG retrieval and generation capabilities. Enjoy.

ATM: Adversarial Tuning Multi-agent System Makes a Robust Retrieval-Augmented Generator

ATM Attacker Agent - Generator Agent Architecture

Paper Link: https://arxiv.org/abs/2405.18111

Problem Addressed: RAG uses semantically relevant documents as input context for generators, re-injecting external knowledge. But today's internet is flooded with erroneous, irrelevant, and useless content — even fabricated knowledge from LLMs — which introduces extra noise into RAG generators. The team designed a multi-agent adversarial defense system (ATM) that guides the generator to better understand whether specific documents help answer questions, enhancing generator robustness so it can ultimately distinguish useful documents even among LLM-fabricated ones.

Model Framework: ATM comprises a Generator Agent and an Attacker Agent. The Attacker strives to fabricate false knowledge and increase noise in the document list, while the Generator resists noise and maintains robustness. Through multi-agent iterative optimization, the Attacker Agent develops stronger attack patterns, and the Generator Agent iteratively improves.

Performance: ATM improved scores on Natural Questions by 31%. Under the ATM architecture, the Generator progressively surpassed previous state-of-the-art methods including RALM, RetRobust, and Self-RAG, leading by 5% across various datasets.

Applications: RAG systems across all domains; additionally, it can enhance model safety, accuracy, and other metrics.

ATM Test Performance

Oasis Capital: Could you briefly walk us through your research background?

Professor Sha: I did my PhD at Peking University, focusing on natural language processing — specifically large-scale information extraction and text generation. Later I worked at Apple in the Bay Area, on the Siri team, where I was exposed to a lot of dialogue system work. At the time, I believed that building good dialogue systems required models to truly understand natural language, so I decided to pursue interpretable language models. I then did a postdoc at Oxford University working on explainable AI. I returned to China in early 2022, gave a talk at Beihang University somewhat by chance, and ended up joining them to continue research in NLP and interpretability — plus current directions like large model safety and hallucination elimination, as well as AI for Science.

I think industry is naturally well-suited for agent architectures. From my experience developing Apple's dialogue systems, academia likes publishing end-to-end papers, but implementing end-to-end systems in industry is extremely difficult. In the pre-LLM era, it was hard to directly accomplish search, API calls, and generation through conversation — setting alarms, making calls, sending texts, finding materials. Different users had too many varied and messy requirements; one model couldn't handle everything. So industry tended toward multi-agent collaboration to complete various tasks.

The same applies in the LLM era. First, to do dialogue well, models need deep and thorough language understanding. Building dialogue systems superficially easily produces artificial stupidity. With large models, there's a qualitative leap in language understanding capability. The large model serves as an intelligent hub and also the main agent in a multi-agent system — it understands language well and can call functions of other agents.

Oasis Capital: What are your expectations for the AI features and performance updates announced at WWDC 24?

Professor Sha: I think the features demonstrated at WWDC will largely work as shown when actually released — things like composing emails in different tones, pulling email information, setting schedules. Apple definitely wants Siri integrated with most system apps. I was working on similar things when I was at Apple; certain teams handled interoperability between specific apps and Siri. With large models, this becomes even more achievable.

Oasis Capital: Could you explain the original motivation behind designing ATM?

Professor Sha: Initially we wanted to work on retrieval augmentation. Large models don't learn domain-specific information very well and frequently hallucinate. RAG (Retrieval-Augmented Generation) helps large models consult relevant materials, enabling more accurate answers to specific questions. RAG itself has three components: retrieval, augmentation, and generation. The retrieval part isn't really related to large models — it mainly depends on retriever performance. Augmentation has room for improvement. For example, when several documents are retrieved at once, their ordering (forward or reverse, patterned or randomly shuffled) produces different results from the large model. If a human reads ten references, regardless of order, their final conclusion should be similar. But different permutations of retrieved information fed to large models can produce completely different generated outputs.

So the team wondered: could we design a dedicated agent that constantly challenges the large model with difficult problems, improving its robustness? That's how we developed ATM, using a GAN-like approach with an Attacker and Generator in adversarial iteration to improve generation quality, continuously optimizing RAG's capacity. Later we also collaborated with Baidu to more substantially implement the adversarial generation concept.

Oasis Capital: Could you explain how the Attacker Agent and Generator Agent engage in adversarial game-playing?

Professor Sha: The Attacker takes retrieved content and perturbs it — including position, order, and detailed content — then feeds it to the Generator. The Attacker continuously interferes, trying to drive down the model's generation quality score, while the Generator must ignore the misleading inputs and produce correct answers. This process is the game itself. It's broadly similar to GANs, but with differences. GANs use continuous optimization through loss functions to find optimal solutions, whereas our ATM adversarial approach uses DPO for more subjective, discrete optimization — arguably part of alignment — using reinforcement learning to comparatively arrive at relatively better generated answers.

Oasis Capital: Where do you see ATM having the best application potential going forward?

Professor Sha: ATM can be applied in many areas. For example, improving large model safety — there are already potential bad actors using large models to plan offensive attacks, and ATM can help filter unsafe generated responses. Other issues like discrimination and political sensitivity are also problems ATM could address. Whenever we identify unsafe content, we tag it for the Attacker Agent to fine-tune on. Previously, adjusting models was rather limited and didn't comprehensively block unsafe information. But large model agents can be adjusted anytime, with new cases added in real-time to attack, letting the Generator Agent understand and improve its defense capabilities — ultimately achieving good results in whatever information domains humans want to protect.

Oasis Capital: What's next for your research?

Professor Sha: First, ATM is still a fairly compute-intensive solution, and reducing its resource consumption is something we're thinking about. Second, RAG itself has many aspects that can be enhanced. For example, retrieval has considerable engineering optimization space — failing to retrieve highly useful content, or retrieving information with insufficient granularity, incomplete content, or inadequate length — these are all areas we hope to improve.

Additionally, large models' underlying capabilities remain a constant focus. Currently large models are at an elementary school level; it's hard to have them consult materials to answer college-level questions. We're testing with 7B models, which differ significantly from 175B-scale models in capability. How to better optimize on domain-specific small models is also a direction we're considering.

Oasis Capital: What other AI areas does your team follow?

Professor Sha: Large model safety is my main focus. Data augmentation and retrieval enhancement are also areas I follow. In AI for Science, I'm more interested in serious domains like medicine, biology, and chemistry. We can view large models as vessels that consume vast knowledge and synthesize it for use. In fields like medicine with massive data, large models have inherent advantages in understanding and mining knowledge — you can have them do feature extraction, basic understanding and analysis.

We're also continuously following new architectures. At Oxford we collaborated on new neural network architecture research; at small scale the results were actually very good, though scaling up was difficult. But the research directions from that time are worth learning from. I think Transformer has reached perhaps 95% of AGI, but expecting it to fully achieve AGI is difficult. Perhaps we need to consider other architectures — more biologically inspired, or brain-mimicking approaches — that would be more achievable.