Bounded Provisional Visibility: Controlling Poisoning Exposure in Continuously Ingested RAG Vector Stores
A fail-closed protocol limits how long unvetted RAG documents remain retrievable during continuous ingestion.
Continuous RAG ingestion can expose new documents to retrieval before vetting finishes. The authors propose a fail-closed provisional-visibility protocol that admits content under a deadline, hides late verifications, and supports lineage-scoped containment. On five workloads using an exact backend and Milvus, the deadline reduced median poisoned retrievals from 34 to 7 versus asynchronous admission. Verify-before-visible avoided provisional exposure but delayed clean visibility to 6.3 seconds, while provisional admission showed content within 3 ms; detector errors still determined whether poison remained visible.
- Deadline cut median poisoned retrievals from 34 to 7
- Bound equals visibility budget plus query-path enforcement delay
- Verify-before-visible delayed clean first visibility to 6.3 seconds
- Provisional admission made content visible within 3 ms
- False detector promotions left poison retrievable
From the original article
1 min read at arxiv.orgContinuous ingestion can expose new retrieval-augmented generation (RAG) content to retrieval before vetting completes, creating a temporal attack surface that conventional admission decisions do not capture. We present a fail-closed provisional-visibility protocol that admits new content under a deadline, hides items whose verification has not committed in time, and supports lineage-scoped containment.
By Chuhong Xu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.