有界临时可见性：控制持续摄入的RAG向量存储中的投毒暴露
Bounded Provisional Visibility: Controlling Poisoning Exposure in Continuously Ingested RAG Vector Stores
浏览论文内容
中文总结 AI 辅助
针对持续摄入RAG向量存储的投毒暴露问题，提出有界临时可见性协议，通过截止日期和可见性预算限制未审核内容暴露，实验表明可显著降低中毒检索并量化新鲜度与可用性权衡。
中文摘要 AI 辅助
持续摄入可能在审核完成之前将新的检索增强生成（RAG）内容暴露给检索，从而造成传统准入决策无法捕获的时间性攻击面。我们提出了一种故障关闭的临时可见性协议，该协议在截止日期内接纳新内容，隐藏其验证未及时提交的条目，并支持基于谱系的范围隔离。该协议通过配置的可见性预算加上查询路径执行延迟来限制未经审查的暴露；投毒暴露仍以验证器正确性为条件。我们使用精确后端和Milvus在五个编码自然语言文档的工作负载上评估了该设计。在验证器积压情况下，相对于无截止日期的异步准入，截止日期将中毒检索中位数从34（29-34）降至7（6-7），同时被替换的干净结果也减少了相同数量。先验证后可见避免了临时暴露，但将干净内容的首次可见性延迟至6.3秒，而临时准入使内容在3毫秒内可见；然而过期的干净条目可能经历暂时的可用性缺口。从特定配方检测器重放决策说明了协议边界：误报提升使投毒内容保持可见，而误拒则排除了干净内容被检索。独立Milvus测试表征了一个节点上的执行延迟和并发HNSW检索。这些结果阐明了哪些保证来自协议，哪些结果取决于检测器质量，同时量化了新鲜度和可用性之间的权衡。
英文摘要
Continuous ingestion can expose new retrieval-augmented generation (RAG) content to retrieval before vetting completes, creating a temporal attack surface that conventional admission decisions do not capture. We present a fail-closed provisional-visibility protocol that admits new content under a deadline, hides items whose verification has not committed in time, and supports lineage-scoped containment. The protocol bounds unvetted exposure by the configured visibility budget plus query-path enforcement delay; poisoning exposure remains conditional on verifier correctness. We evaluate the design on five workloads of encoded natural-language documents using an exact backend and Milvus. Under verifier backlog, the deadline reduced median poisoned retrievals from 34 (29--34) to 7 (6--7) relative to asynchronous admission without a deadline, with the same reduction in displaced clean results. Verify-before-visible avoided provisional exposure but delayed clean first visibility to 6.3 s, whereas provisional admission made content visible within 3 ms; expired clean items could nevertheless experience temporary availability gaps. Replaying decisions from a recipe-specific detector illustrated the protocol boundary: false promotions left poison visible, while false refusals excluded clean content from retrieval. Standalone Milvus tests characterized enforcement delay and concurrent HNSW retrieval on one node. These results clarify which guarantees come from the protocol and which outcomes depend on detector quality, while quantifying the freshness and availability trade-offs.
发表机构
- Sony Corporate of America（索尼美国公司）
- Google LLC（谷歌有限责任公司）
- Fortinet, Inc.（飞塔股份有限公司）
机构由 AI 辅助整理，请以论文原文为准。
