Signed RAG packages retained altered embeddings that changed retrieval outcomes

A signed RAG knowledge package can contain intact source text but attacker-manipulated embeddings. Numerical-tolerance checks between quantized vectors and full precision permitted materially different retrieval order.

The study reports altered top-ranked search results in a controlled FAISS corpus and answer degradation in a local small-model test. A valid package signature did not prove the vectors matched the trusted embedding process.

The signed package's source documents remained intact while its embedding vectors were altered. The verification procedure accepted approximate numerical agreement under quantization tolerance, allowing an attacker-controlled package builder to move retrieval ranking without changing reader-visible prose. The reported experiment promoted a selected record to rank one for a quarter of target queries in a controlled FAISS corpus, and a small local model's answer accuracy fell from 0.75 to 0.39 in the reported setup. Those effects belong to a chosen benchmark and threat model; no signature forgery or real customer incident was shown. A sound integrity check must bind the exact embedding pipeline, codebook and index representation, or treat numerical tolerance as an explicit attack budget.

The package signature proves which vector bytes were distributed, not that those bytes are faithful encodings of the accompanying documents. Accepting approximate vector equivalence under quantization gives a malicious pack builder room to alter nearest-neighbor rankings without modifying source prose. The reported rank-one and answer-accuracy changes are controlled results, not evidence of a forged signer or an exploited production repository. A meaningful verifier binds the exact embedding model, tokenizer and quantized representation to an independently authorized source corpus.