Signed but Still Manipulable: Measuring and Bridging the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Quick read
Based on the paper's full text (AI-generated); refer to the original
Signed knowledge packs for offline RAG have a text-vector integrity gap: signatures only prove the publisher's identity and do not guarantee that the vectors in the pack encode its text, and an attacker who can control vectors can make text that passes content moderation hijack retrieval. The paper proposes a margin law: the proportion of queries that can be hijacked equals the proportion of queries whose angular margin falls below the tolerance. On five corpora and two embedding models, a floating-point noise-level tolerance exposes at most 5.5% of queries (no more than 1.2% after removing exact duplicate documents), while a threshold calibrated to INT8 quantization deviation exposes 98-100%; on a FAISS product quantization index of 57,638 FiQA documents, all tampered vectors passed the audit, making the attacker's document rank first in 25% of target queries. In an end-to-end experiment running Qwen2.5-3B on a Raspberry Pi 5, the attack under the INT8 reference threshold reduced correct answers from 0.75 to 0.39.
- An offline RAG knowledge package carries both text and precomputed vectors, and a signature can only prove the publisher's identity, not guarantee that the vectors actually encode the corresponding text. Whoever controls the vectors can manipulate retrieval results while the text passes review; this text–vector integrity gap is widespread in edge devices and vector databases.
- The authors propose a margin law: under a cosine tolerance τ, the optimal attacker's hijack rate equals the proportion of queries whose retrieval angular margin is below arccos τ, allowing the exposure surface to be measured without actually attacking. For defense, they advocate verifying the quantized code rather than the vector: the verifier recomputes and quantizes on its own, accepts adjacent codes only where the verifier's judgment is ambiguous, and then uses the verifier's own code for canonicalisation.
- Across five corpora and two embedding models, the margin is generally very small, and the margin law matches the attack simulation exactly; the FP32 noise-level tolerance still exposes at most 5.5% (at most 1.2% after excluding fully duplicate documents), while the threshold calibrated for CPU INT8 exposes 98–100%. On the FAISS PQ index, all tampered vectors pass the audit, and 25% of targets are pushed to first place; on a Raspberry Pi 5, the end-to-end attack lowers correct answers from 0.75 to 0.39. Code-level verification accepts all honest vectors across three platforms and four backends, and after canonicalisation the publisher has no room for choice.
- The experiments cover only two embedding models, English corpora, a flat FAISS index, a single edge board, and a single local LLM; the guard width is empirically calibrated rather than guaranteed, and the INT8 threshold depends on the specific batch configuration. IVF, graph indexes, large-scale multilingual corpora, attacks that modify both text and vectors, deriving the guard width from a floating-point error model, and determinism and overhead on edge accelerators are all left for future work.
The margin law in the paper lets deployers calculate, without launching an attack, the proportion of queries that tolerance checks would expose to attackers, which teams operating offline RAG or vector stores can use to self-check.