Researchers identify text-vector integrity gap in offline RAG
Original title: Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Offline RAG knowledge packs can be hijacked with up to 5.5% of queries exposed due to text-vector mismatch.
The paper studies the text-vector integrity gap in offline retrieval-augmented generation where signed knowledge packs contain text and precomputed embedding vectors. A verifier recomputing vectors accepts them within cosine tolerance but concedes predictable share of queries to an attacker controlling the vectors. In five corpora and two embedding models, up to 5.5% of queries exposed with idealised tolerance; on Raspberry Pi 5 an attack lowers correct answers from 0.75 to 0.39. Verifying quantisation codes with calibrated guard band prevents tampering.
- Hijack rate follows angular retrieval margins
- Up to 5.5% queries exposed in corpora
- On Raspberry Pi accuracy drops from 0.75 to 0.39
- Verifying quantisation codes accepted every honest vector
- Inference pipelines not bit-reproducible
- Organizations
- Hugging Face
From the original article
1 min read at huggingface.co
Offline retrieval-augmented generation (RAG) on edge devices is updated through signed knowledge packs that carry text and precomputed embedding vectors. A signature proves who published a pack, not that its vectors encode its text. We study this text-vector integrity gap.
By Georgios Feretzakis, Alexandros Papaspyridis · huggingface.co
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.