arXiv measures text-vector integrity gap in offline RAG
Original title: Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Verifier recomputes vectors within cosine tolerance to close the integrity gap, exposing up to 5.5% of queries to attackers who control vectors.
Offline RAG packs include text and embedding vectors protected by signatures that prove the publisher but not that vectors encode the text. The text-vector integrity gap allows an attacker controlling vectors to hijack a predictable share of queries. A verifier recomputing vectors and accepting them within cosine tolerance concedes queries based on angular retrieval margins. This leads to up to 5.5% of queries exposed with floating-point tolerance, and calibrated thresholds leave 98-100% exposed. On a Raspberry Pi 5 running a local language model, such an attack lowers correct answers from 0.75 to 0.39. Integrity audits on a FAISS product-quantisation index also fail, with tampered vectors passing the audit and putting the attacker's document first for 25% of targets.
- Margin law determines hijack rate from angular retrieval margins.
- Up to 5.5% of queries exposed with floating-point tolerance.
- 98-100% exposed with calibrated INT8-FP32 threshold.
- Attack lowers correct answers from 0.75 to 0.39 on Raspberry Pi 5.
- Verifying quantisation codes accepted every honest vector in samples.
From the original article
1 min read at arxiv.orgOffline retrieval-augmented generation (RAG) on edge devices is updated through signed knowledge packs that carry text and precomputed embedding vectors. A signature proves who published a pack, not that its vectors encode its text. We study this text-vector integrity gap.
By Georgios Feretzakis · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.