A study demonstrates that admission-time filters cannot prevent coordinated poisoning attacks on vector retrieval systems, as geometrically identical patterns exist for both legitimate niche uploads and malicious injections. The researchers show that a small number of unremarkable documents can surround a target query to seize top-k results in BGE-large / BEIR benchmarks.
- A coordinated adversary injects m=10 documents that collectively manipulate the index, achieving 10/10 success on BGE-large / BEIR and 9.9/10 on a live HNSW index.
- The attack is realized as ordinary fluent text within a BGE-large + HNSW + Qwen2.5-7B pipeline, causing the generator to emit planted claims in 88% of targets versus 0% without injection.
- No ingestion-time defense stops this; the strongest trained classifier separates attacks from legitimate uploads no better than chance, catching only 4.2% of attacks at a 1% false-positive rate.
- The fundamental limit arises because the signal separating attack from legitimate ingestion—query demand—is invisible before retrieval.
The authors conclude that robust defense must move past admission gates to observe demand at retrieval time, where detectors catch 100% of these attacks at the same 1% false-positive rate.