Evidence · DiggingBeagle record
Signed RAG embedding mismatch under tolerant verification
A signed RAG knowledge package can contain intact source text but attacker-manipulated embeddings. Numerical-tolerance checks between quantized vectors and full precision permitted materially different retrieval order. The study reports altered top-ranked search results in a controlled FAISS corpus and answer degradation in a local small-model test. A valid package signature did not prove the vectors matched the trusted embedding process. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
- Source role
- primary disclosure
Evidence record
A signed RAG knowledge package can contain intact source text but attacker-manipulated embeddings. Numerical-tolerance checks between quantized vectors and full precision permitted materially different retrieval order. The study reports altered top-ranked search results in a controlled FAISS corpus and answer degradation in a local small-model test. A valid package signature did not prove the vectors matched the trusted embedding process. Research/disclosure claims are specific to the documented settings; do not infer unreported victims or additional compromise.
Claim-level citations (3)
- supportsSigned RAG packages retained altered embeddings that changed retrieval outcomes: The study reports altered top-ranked search results in a controlled FAISS corpus and answer degradation in a local small-model test. A valid package signature did not prove the vectors matched the trusted embedding process.
Threat model; signed vector package manipulation; FAISS and local model tests
- supportsSigned RAG packages retained altered embeddings that changed retrieval outcomes: A signed RAG knowledge package can contain intact source text but attacker-manipulated embeddings. Numerical-tolerance checks between quantized vectors and full precision permitted materially different retrieval order.
Threat model; signed vector package manipulation; FAISS and local model tests
- supportsSigned RAG packages retained altered embeddings that changed retrieval outcomes: In the controlled signed-RAG evaluation, vector manipulation promoted an attacker-selected document to rank one for about one quarter of targeted retrieval queries and reduced local answer correctness from 0.75 to 0.39. The experiment did not demonstrate a forged cryptographic signature.
Signed embeddings experiment: FAISS retrieval ranking and local Qwen accuracy