Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation

Signed but Steerable. Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation. By Georgios Feretzakis and one other, from Securagen AI. Published on the fourth of November.

Offline retrieval-augmented generation on edge devices gets updated through signed knowledge packs, which carry both text and precomputed embedding vectors. A signature proves who published a pack. It does not prove that the vectors actually encode the text. That difference is what the authors call the text-vector integrity gap. Their central claim concerns a natural defence: a verifier that recomputes the vectors and accepts them if they fall within a cosine tolerance. Such a verifier, they show, concedes a predictable share of queries to an attacker who controls the vectors. The hijack rate equals the distribution of angular retrieval margins at that tolerance. They call this the margin law.

Margins turn out to be small, across five corpora and two embedding models. Even an idealised tolerance set at the level of floating-point noise leaves up to five point five percent of queries exposed. Once exact duplicate documents are excluded, the figure is at most one point two percent in any corpus.

A realistic tolerance is far worse. The authors calibrated a threshold from their own comparison of a small embedding model run in INT8 and in FP32 on a CPU, set at the empirical zero point one percent quantile of honest cosines. That threshold leaves between ninety-eight and one hundred percent of queries exposed. On a Raspberry Pi five running a local language model, the attack cuts the rate of correct answers from zero point seven five to zero point three nine.

Compressed vector stores fare no better under integrity audits. On a FAISS product-quantisation index over fifty-seven thousand six hundred and thirty-eight documents, tampered vectors that all pass the audit still put the attacker's document first for twenty-five percent of targets.

The paper also proposes a fix. It verifies the quantisation codes instead of the float vectors, with ambiguity resolved by the verifier, a calibrated guard band, and canonicalisation. In the authors' samples, on three platforms, this accepted every honest vector and left the publisher no choice.

Several boundaries come with these results. The exposure figures are measured on five corpora, two embedding models, and one small model's numeric comparison, and the honest-vector acceptance of the fix is reported for the samples tested on three platforms. A further finding explains why a tolerance is needed at all: common floating-point and dynamic-INT8 inference pipelines are not bit-reproducible across batch sizes or across architectures. Finally, the authors report pre-registered negative results for three other defences: abstention, context pruning, and semantic screening. Code and data are released.

Signing a pack settles who sent it, never what its vectors mean. Once honest recomputation itself wobbles, any tolerance wide enough to accept it is wide enough for an attacker, and the margin law says how much ground that gives away. Moving the check from floats to quantisation codes is the paper's way of taking that slack out of the publisher's hands.