Consistency analysis reveals vulnerabilities in document retrieval systems
Consistency Is the Attack Surface: Detecting Coordinated Retrieval Poisoning with Embedding Geometry
Cryptography and Security
Summary
Sometimes computer systems that find and show information can be tricked by small, coordinated sneaky changes to their source documents. The authors found that even a tiny amount of fake data can heavily influence what information the system retrieves. They developed a new way to detect and block these sneaky coordinated attacks by examining patterns in how information is linked in the system, without needing to know which data is fake beforehand. This method lowers the success of these attacks while keeping the system mostly accurate for normal use.
What this means in practice
- •For software security teams: Detect coordinated data poisoning attacks in information retrieval components of large AI systems to improve model robustness.
- •For enterprise ai developers: Enhance retrieval models in enterprise question-answering systems by auditing embedding structures to reduce effect of malicious data injections.
Authors
Zeyan Li, Qirong Guo, Jianfeng Xu
Abstract
Consistency-based defenses for retrieval-augmented generation (RAG) rest on an assumption that a sparse adversary breaks: a poisoning campaign may modify a negligible fraction of the corpus, yet retrieval concentrates its passages into the reader's context. Across four Natural Questions retrieval seeds, at least one injection reaches the top-5 in 94.1% of targeted query--seed rows, and all three form a retrieved majority in 52.9%. Under our short-answer protocol, RobustRAG and ReliabilityRAG reach exposure-conditional attack success 0.512, against 0.576 for undefended RAG, while lowering clean accuracy from 0.328 to 0.216. Coordination, however, leaves a fingerprint: a dense, query-anchored component in the evidence embedding geometry. CoordGuard audits this structure from robustly normalized query-weighted affinities, without poison labels, correct answers, or reader gradients. Its always-filter mode suppresses the selected component whenever one forms; a benign-calibrated gate suppresses it only at unusually high scores and traces a robustness--utility frontier. Pooling four retrieval seeds, e5 always-filtering reduces $\mathrm{ASR}_{\mathrm{exp}}$ to 0.167 overall and 0.138 on parametrically unknown queries, at a 13.6-point clean cost, while a Contriever gate retains clean accuracy 0.315 at $\mathrm{ASR}_{\mathrm{exp}}=0.331$. The reduction transfers across two readers, three tasks, and multiple retriever--auditor pairs, and count-matched controls attribute it to component-targeted removal rather than deletion volume. These findings recast poison detection from judging truth to auditing the structure of retrieved evidence.