HNSW hub-and-satellite poisoned documents redirect RAG answer evidence

An approximate nearest-neighbor index is not simply a faster exact-similarity filter. With HNSW, retrieval follows graph neighborhoods whose traversal budget can determine which documents ever reach the answer generator. The paper studies an attacker who can add apparently ordinary documents to that index, arranging satellite documents across query neighborhoods and hub documents that make the poisoned set easier to encounter. The attacker did not need direct permission to rewrite graph edges.

Against a two-million-document Wikipedia-derived corpus, the study reports up to 31.29% attack success in a selected evaluation with up to 60 inserted documents. A controlled comparison found approximately 8.56 additional percentage points of HNSW-specific success over the corresponding semantic-only effect under a tight search budget. This incremental topology advantage declined at higher search budgets. Those are benchmark outcomes with defined corpus, prompts, indexing and budgets, not observed compromise rates of deployed retrieval products.

This is evidence-source manipulation rather than an automatic instruction to run a shell command. An answer can cite attacker-inserted material and become false without the model visibly violating a prompt hierarchy. A serious reproduction must control document insertion rights, index rebuild and search parameters, compare against exact retrieval, and assess whether the answer treated one retrieved source as independent corroboration. Deleting an instruction string alone would not test the topology-dependent mechanism.