Signed offline RAG packs can be hijacked via tampered vectors, paper finds

Offline retrieval-augmented generation (RAG) on edge devices is updated through signed knowledge packs that carry both text and precomputed embedding vectors. The paper's starting point is that a signature proves who published a pack, not that its vectors actually encode its text. The authors call this the text-vector integrity gap, and they measure what an attacker who controls the vectors can do with it.

The first target is the obvious defence: a verifier that recomputes the vectors and accepts them if they land within a cosine tolerance. The authors say this concedes a predictable share of queries to the attacker. The hijack rate equals the distribution of angular retrieval margins at the tolerance, which they name the margin law. Margins turn out to be small in the five corpora and two embedding models they studied. So an idealised tolerance set at the level of floating-point noise still leaves up to 5.5% of queries exposed, and at most 1.2% in any corpus once exact duplicate documents are excluded. A more realistic threshold is far worse. When it is calibrated from the authors' CPU INT8-FP32 comparison of a small embedding model, at the empirical 0.1% quantile of honest cosines, 98-100% of queries are exposed. On a Raspberry Pi 5 running a local language model, such an attack lowers correct answers from 0.75 to 0.39 (the abstract does not give the unit of those figures).

Integrity audits of compressed vector stores fare no better. On a FAISS product-quantisation index over 57,638 documents, tampered vectors that all passed the audit put the attacker's document first for 25% of targets.

The proposed fix is to verify quantisation codes instead of recomputing floating-point vectors. The scheme has the verifier decide ambiguous cases, adds a calibrated guard band and canonicalisation, and leaves the publisher no choice in how the vectors are encoded. In the authors' samples it accepted every honest vector on three platforms.

Two further results are reported. Common floating-point and dynamic-INT8 inference pipelines are not bit-reproducible across batch sizes or architectures, which is why exact recomputation is not a dependable check. And the authors report pre-registered negative results on abstention, context pruning and semantic screening. They release code and data.

Key facts

A signature on an offline RAG knowledge pack proves who published it, not that its precomputed vectors encode its text; the authors call this the text-vector integrity gap.
Recompute-within-tolerance verification leaves up to 5.5% of queries exposed even with an idealised floating-point-noise tolerance (at most 1.2% per corpus without exact duplicates); a threshold calibrated at the 0.1% quantile of honest cosines leaves 98-100% exposed.
On a Raspberry Pi 5 with a local language model, the attack lowers correct answers from 0.75 to 0.39.
On a FAISS product-quantisation index of 57,638 documents, tampered vectors that all passed the integrity audit put the attacker's document first for 25% of targets.
Verifying quantisation codes instead accepted every honest vector in the authors' samples on three platforms; code and data are released.

Why it matters

Signed knowledge packs look like a solved update channel for offline RAG: the signature says who published the pack. The paper argues that this leaves a gap, because the precomputed vectors that drive retrieval are not covered by any proof that they match the text. An attacker who controls the vectors can steer which documents a query retrieves, and the paper puts numbers on how much steering common checks allow. The authors also show that the natural fix, recomputing vectors and comparing them within a tolerance, is weaker than it appears.

Who it affects

The setting is offline RAG on edge devices that receive updates as signed knowledge packs carrying text and precomputed embeddings. That covers anyone who builds or ships such packs and anyone who verifies them on the device. The authors also discuss compressed vector stores, with a FAISS product-quantisation index as the example, so teams that audit such indexes are in scope too.

How to use it

The practical suggestion is to verify quantisation codes rather than recompute floating-point vectors and accept them within a cosine tolerance. The authors describe the ingredients as ambiguity decided by the verifier, a calibrated guard band and canonicalisation, which they say leaves the publisher no choice in how vectors are encoded. They state that they release code and data.

How solid is it

This is a preprint, and the account here rests on its abstract alone. The measurements span five corpora and two embedding models, and the fix was tested on three platforms, where it accepted every honest vector in the authors' samples. The abstract does not name the embedding models, corpora, FAISS configuration or the local language model on the Raspberry Pi 5, and it does not state the unit of the 0.75 and 0.39 figures. It also does not say whether the 98-100% exposure holds across all corpora or for one model. The authors report pre-registered negative results on abstention, context pruning and semantic screening.

Risks and caveats

No real-world attack or incident is reported; the attacks are measured experimentally by the authors. The idealised tolerance figures (up to 5.5%, at most 1.2% per corpus without exact duplicates) are much lower than the 98-100% exposure from the calibrated threshold, so the result depends heavily on how the tolerance is set. The authors' finding that common floating-point and dynamic-INT8 pipelines are not bit-reproducible across batch sizes or architectures is the reason a tight tolerance is hard to hold in practice. The fix is validated on samples across three platforms, not shown to be universal.

“A signature proves who published a pack, not that its vectors encode its text.”

— From the paper's abstract