{"data":{"id":"a47a3512-3612-4613-84cd-8bc3689ab576","title":"Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation","summary":"Offline RAG knowledge packs on edge devices are signed, but a signature only proves the publisher, not that the precomputed embedding vectors match the text. Researchers measured how often an attacker controlling the vectors can hijack retrieval, finding up to 5.5% of queries exposed under a near-exact cosine tolerance and 98-100% under a threshold calibrated from CPU INT8-FP32 comparison, with correct answers on a Raspberry Pi 5 dropping from 0.75 to 0.39. Verifying quantisation codes instead of vectors accepted every honest vector in their samples on three platforms.","solution":"Verifying quantisation codes rather than recomputing vectors within a cosine tolerance, with ambiguity decided by the verifier, a calibrated guard band and canonicalisation, accepted every honest vector in the authors' samples on three platforms and left the publisher no choice. The authors release code and data.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.06498v1","publishedAt":"2026-11-04T13:32:04.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["rag_poisoning","model_poisoning"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["FAISS","Raspberry Pi 5"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-04T13:32:04.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","confidentiality"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.93,"researchCategory":"preprint","atlasIds":["AML.T0070"]}}