Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation

Summary

Offline RAG knowledge packs on edge devices are signed, but a signature only proves the publisher, not that the precomputed embedding vectors match the text. Researchers measured how often an attacker controlling the vectors can hijack retrieval, finding up to 5.5% of queries exposed under a near-exact cosine tolerance and 98-100% under a threshold calibrated from CPU INT8-FP32 comparison, with correct answers on a Raspberry Pi 5 dropping from 0.75 to 0.39. Verifying quantisation codes instead of vectors accepted every honest vector in their samples on three platforms.

Mitigation

Verifying quantisation codes rather than recomputing vectors within a cosine tolerance, with ambiguity decided by the verifier, a calibrated guard band and canonicalisation, accepted every honest vector in the authors' samples on three platforms and left the publisher no choice. The authors release code and data.

Topics

• Retrieval-augmented generation

Related items

• InfoIAMRAGBENCH: Benchmarking Authorization Expansions in LLM-Generated AWS IAM Policies under RAG PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSecuring next-generation edge intelligence: A survey from federated learning to autonomous agents in cyber-physical systemsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoPop Goes the Verifier: Phoneme-Targeted Data Poisoning of Voice Liveness DetectionSimilar attack · Arxiv (cs.RO + cs.CV security)
• InfoAccept Changes, Reject Attacks: Robust Memory Management for LLM AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoCharacterizing Recoverable Expert-Utilization Signatures in Fine-Tuned Mixture-of-Experts LLMsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)