Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval

• URL: http://arxiv.org/abs/2608.16044v1
• Date: Mon, 17 Aug 2026 03:18:51 GMT
• Title: Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval
• Abstract summary: Retrieval-augmented generation answers a question by retrieving passages from a vector store and trusting them as context.<n>A recent, appealing defense filters poisoning at ingestion, rejecting any document that behaves like a hub.<n>We show it is defeated by a coordinated adversary that injects a handful of individually unremarkable documents.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Retrieval-augmented generation (RAG) answers a question by retrieving passages from a vector store and trusting them as context, so anyone who can add documents can try to steer the answer. A recent, appealing defense filters poisoning at ingestion, rejecting any document that behaves like a hub. We show it -- and every ingestion-time filter -- is defeated by a coordinated adversary that injects a handful of individually unremarkable documents which together surround one target query and seize its top-k (on BGE-large / BEIR, m=10 documents take 10/10; 9.9/10 on a live HNSW index). The attack is not theoretical. Realized as ordinary fluent text and run end-to-end through a BGE-large + HNSW + Qwen2.5-7B pipeline, it makes the generator emit the attacker's planted claim in 88% of targets, versus 0% without the injection. And no admission-time defense stops it: at ingestion an attack cone is geometrically identical to a legitimate niche upload, so -- measuring this directly -- the strongest trained classifier, given every feature and thousands of examples, separates the two no better than chance, catching 4.2% of attacks at a 1% false-positive rate. We prove this limit for the entire class of ingestion-time statistics (any decision from documents and reference queries alone), and it reproduces -- and worsens -- across two corpora and five encoders. The one signal that separates an attack from legitimate niche ingestion -- a query's demand -- is invisible before retrieval, which is also the escape: a retrieval-time detector that observes demand catches 100% of the attacks at the same 1% false-positive rate. Coverage of the query space by an admission gate is not containment of coordinated poisoning; robust defense must move past the front door, to demand.

Related papers

• Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services [56.0553456562323]
  Most large language model services use stateless defenses, which judge only the current request to refuse harmful tasks.<n>Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers.<n>We show that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped.
  arXiv  Detail & Related papers  (2026-08-18T07:26:30Z)
• DenialRAG: Single-Document RAG Poisoning via Embedded Parametric Denial [7.434105792757549]
  We propose emphDenialRAG, a single-document poisoning attack that explicitly names the correct answer, denies it, and presents an attacker-controlled explanation.<n>DenialRAG embeds the conflict directly into the context seen by the generator.<n>We evaluate DenialRAG against four published single-document poisoning attacks across three open-domain question-answering datasets.
  arXiv  Detail & Related papers  (2026-08-02T20:33:05Z)
• RAGuard: A Layered Defense Framework for Retrieval-Augmented Generation Systems Against Data Poisoning [0.0815557531820863]
  We introduce RAGuard, a layered defense against emphfactual corpus-poisoning attacks on pipelines.<n>The first layer fine-tunes a dense retriever on synthetic poisoned documents (fabricated facts, contradictions, and reasoning traps)<n>The second layer, the ZeroKnowledge Patch ZKIP, is a label-free, black-box filter.
  arXiv  Detail & Related papers  (2026-07-28T23:21:04Z)
• TriShieldRAG: A Three-Ring Defense-in-Depth Framework Against Knowledge Corruption in Retrieval-Augmented Generation [1.5474833458331865]
  Retrieval-Augmented Generation lets a large language model answer questions using documents retrieved from an external knowledge base at query time.<n>If the knowledge base accepts writes from more than one party, an attacker needs only a handful of adversarial documents to steer the model toward a chosen wrong answer.<n>PoisonedRAG demonstrated this: as few as five crafted documents flip an undefended system's answer roughly 90% of the time.
  arXiv  Detail & Related papers  (2026-07-26T20:52:23Z)
• When Global Gating Is Enough: Admission-Time Hubness Control in Anisotropic Vector Retrieval Systems [0.0]
  We study admission-time control, scoring each candidate against sentinel queries and quarantining hub-like documents before insertion.<n>Across two 100,000-document corpora, five encoders, and disjoint attacker and defender query sets, a global gate achieves recall 1.0 at the decisive embedding-space point.<n>On HNSW, admission adds about 3.1% to ingestion latency, scoring remains flat to 106 vectors, and 1.2% of decisions flip under approximate indexing.
  arXiv  Detail & Related papers  (2026-06-18T01:40:36Z)
• Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation [54.38271718421492]
  Adversarial smuggling attacks exploit the Human-AI capability gap.<n>It encodes harmful content into human-readable visual formats that remain AI-unreadable.<n>We conduct a preliminary exploration of mitigation strategies.
  arXiv  Detail & Related papers  (2026-04-08T11:13:16Z)
• RAGShield: Detecting Numerical Claim Manipulation in Government RAG Systems [0.0]
  RAG systems are deployed across federal agencies for citizen-facing tax guidance, benefits eligibility, and legal information.<n>This paper proves that all embedding-based RAG defenses share a fundamental blind spot: changing a tax deduction by $50,000 produces cosine similarity 0.9998, invisible to every known detection threshold.<n>The blind spot is confirmed on real IRS documents.
  arXiv  Detail & Related papers  (2026-04-01T02:16:42Z)
• Bias Injection Attacks on RAG Databases and Sanitization Defenses [9.638140849760108]
  This paper explores attacks and defenses on vector databases in retrieval-augmented generation (RAG) systems.<n>We reveal a new and subtle threat: bias injection attacks, which insert factually correct yet semantically biased passages into the knowledge base.
  arXiv  Detail & Related papers  (2025-11-30T09:27:18Z)
• AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuning [93.77763753231338]
  Adversarial Contrastive Prompt Tuning (ACPT) is proposed to fine-tune the CLIP image encoder to extract similar embeddings for any two intermediate adversarial queries. We show that ACPT can detect 7 state-of-the-art query-based attacks with $>99%$ detection rate within 5 shots. We also show that ACPT is robust to 3 types of adaptive attacks.
  arXiv  Detail & Related papers  (2024-08-04T09:53:50Z)
• Distributed Backdoor Attacks on Federated Graph Learning and Certified Defenses [50.53476890313741]
  We propose an effective, stealthy, and persistent backdoor attack on FedGL. We develop a certified defense for any backdoored FedGL model against the trigger with any shape at any location. Our attack results show our attack can obtain > 90% backdoor accuracy in almost all datasets.
  arXiv  Detail & Related papers  (2024-07-12T02:43:44Z)
• Zero-Query Transfer Attacks on Context-Aware Object Detectors [95.18656036716972]
  Adversarial attacks perturb images such that a deep neural network produces incorrect classification results. A promising approach to defend against adversarial attacks on natural multi-object scenes is to impose a context-consistency check. We present the first approach for generating context-consistent adversarial attacks that can evade the context-consistency check.
  arXiv  Detail & Related papers  (2022-03-29T04:33:06Z)
• Improving the Adversarial Robustness for Speaker Verification by Self-Supervised Learning [95.60856995067083]
  This work is among the first to perform adversarial defense for ASV without knowing the specific attack algorithms. We propose to perform adversarial defense from two perspectives: 1) adversarial perturbation purification and 2) adversarial perturbation detection. Experimental results show that our detection module effectively shields the ASV by detecting adversarial samples with an accuracy of around 80%.
  arXiv  Detail & Related papers  (2021-06-01T07:10:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.