When Global Gating Is Enough: Admission-Time Hubness Control in Anisotropic Vector Retrieval Systems

• URL: http://arxiv.org/abs/2606.19692v1
• Date: Thu, 18 Jun 2026 01:40:36 GMT
• Title: When Global Gating Is Enough: Admission-Time Hubness Control in Anisotropic Vector Retrieval Systems
• Abstract summary: We study admission-time control, scoring each candidate against sentinel queries and quarantining hub-like documents before insertion.<n>Across two 100,000-document corpora, five encoders, and disjoint attacker and defender query sets, a global gate achieves recall 1.0 at the decisive embedding-space point.<n>On HNSW, admission adds about 3.1% to ingestion latency, scoring remains flat to 106 vectors, and 1.2% of decisions flip under approximate indexing.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Vector hubness, where a few points become nearest neighbors of many queries, creates a poisoning risk in retrieval-augmented generation (RAG): one injected document can influence unrelated requests. Existing defenses use periodic reverse-kNN scans, leaving an exposure window and repeated corpus-wide work. We study admission-time control, scoring each candidate against sentinel queries and quarantining hub-like documents before insertion. Across two 100,000-document corpora, five encoders, and disjoint attacker and defender query sets, a global gate achieves recall 1.0 at the decisive embedding-space point (>=0.92 across the effective range) and 0.91 +/- 0.07 on HotFlip attacks, with 1% false positives on general documents. A per-topic gate provides no reliable benefit, consistent with anisotropy coupling local and global visibility. Thresholds are maintained incrementally, with corpus-size-independent insertion cost and amortized deletion cost. On HNSW, admission adds about 3.1% to ingestion latency, scoring remains flat to 10^6 vectors, and 1.2% of decisions flip under approximate indexing, none involving attacks. Provenance complements the gate for natural or tight-domain hubs.

Related papers

• Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval [0.0]
  Retrieval-augmented generation answers a question by retrieving passages from a vector store and trusting them as context.<n>A recent, appealing defense filters poisoning at ingestion, rejecting any document that behaves like a hub.<n>We show it is defeated by a coordinated adversary that injects a handful of individually unremarkable documents.
  arXiv  Detail & Related papers  (2026-08-17T03:18:51Z)
• Coverage Is Not Redundancy: Maintenance Cost and Exposure of Query-Aware Admission Indexes in Vector Databases Under Workload Drift [0.0]
  In a vector database serving production-scale retrieval, a single inserted document can be retrieved for an anomalously large share of the query workload.<n>An emerging defense guards against this at ingest with an admission check.<n>We study the cost that maintenance imposes on the ingest path.
  arXiv  Detail & Related papers  (2026-08-17T03:11:52Z)
• PerceptionRubrics: Calibrating Multimodal Evaluation to Human Perception [75.70273182182397]
  PerceptionRubrics is a rubric-based evaluation framework.<n>It addresses the gap between saturated benchmark scores and real-world brittleness.<n>It pairs 1,038 information-dense images with over 10,000 instance-specific rubrics.
  arXiv  Detail & Related papers  (2026-06-26T17:59:15Z)
• GAMBIT: A Three-Mode Benchmark for Adversarial Robustness in Multi-Agent LLM Collectives [48.545980031973556]
  GAMBIT is a benchmark with three evaluation modes and two independent scores for evaluating imposter detectors.<n>The benchmark comes with a dataset of 27,804 labeled instances spanning 240 co-evolved imposter strategies.
  arXiv  Detail & Related papers  (2026-05-09T16:07:23Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• HubScan: Detecting Hubness Poisoning in Retrieval-Augmented Generation Systems [0.031068858355080494]
  hubness can be exploited to introduce harmful content, alter search rankings, bypass content filtering, and decrease system performance.<n>We introduce hubscan, an open-source security scanner that evaluates vector indices and embeddings to identify hubs in RAG systems.<n> hubscan achieves 90% recall at a 0.2% alert budget and 100% recall at 0.4%, with adversarial hubs ranking above the 99.8th percentile.
  arXiv  Detail & Related papers  (2026-02-25T21:37:53Z)
• Retrieval Pivot Attacks in Hybrid RAG: Measuring and Mitigating Amplified Leakage from Vector Seeds to Graph Expansion [0.0]
  Hybrid Retrieval-Augmented Generation (RAG) pipelines combine vector similarity search with knowledge graph expansion for multi-hop reasoning.<n>We show that a vector-retrieved "seed" chunk can pivot via entity links into sensitive graph neighborhoods, causing cross-tenant data leakage.<n>We present seven Retrieval Pivot Attacks that exploit the vector-to-graph boundary and show that adversarial injection is not required.
  arXiv  Detail & Related papers  (2026-02-09T13:55:04Z)
• TARG: Training-Free Adaptive Retrieval Gating for Efficient RAG [46.122203287541005]
  Training-free Adaptive Retrieval Gating (TARG) is a single-shot policy that decides when to retrieve using only a short, no-latency draft from the base model.<n>On NQ-Open, TriviaQA, and PopQA, TARG consistently shifts the accuracy-efficiency frontier.
  arXiv  Detail & Related papers  (2025-11-12T23:09:52Z)
• Group Evidence Matters: Tiling-based Semantic Gating for Dense Object Detection [0.0]
  This paper presents a detector-agnostic post-processing framework that converts overlap-induced redundancy into group evidence.<n>The framework requires no retraining and integrates with modern detectors.
  arXiv  Detail & Related papers  (2025-09-13T01:55:08Z)
• T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models [70.03122709795122]
  We propose a comprehensive defense method named T2IShield to detect, localize, and mitigate backdoor attacks. We find the "Assimilation Phenomenon" on the cross-attention maps caused by the backdoor trigger. For backdoor sample detection, T2IShield achieves a detection F1 score of 88.9$%$ with low computational cost.
  arXiv  Detail & Related papers  (2024-07-05T01:53:21Z)
• Graph Agent Network: Empowering Nodes with Inference Capabilities for Adversarial Resilience [50.460555688927826]
  We propose the Graph Agent Network (GAgN) to address the vulnerabilities of graph neural networks (GNNs)<n>GAgN is a graph-structured agent network in which each node is designed as an 1-hop-view agent.<n>Agents' limited view prevents malicious messages from propagating globally in GAgN, thereby resisting global-optimization-based secondary attacks.
  arXiv  Detail & Related papers  (2023-06-12T07:27:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.