When Global Gating Is Enough: Admission-Time Hubness Control in Anisotropic Vector Retrieval Systems
This work addresses the poisoning risk in retrieval-augmented generation (RAG) systems by preventing hub documents from influencing unrelated queries, offering a practical defense with minimal overhead.
The paper introduces an admission-time hubness control method for vector retrieval systems that quarantines hub-like documents before insertion, achieving recall 1.0 at the decisive embedding-space point (≥0.92 across the effective range) and 0.91±0.07 on HotFlip attacks with 1% false positives, while adding only 3.1% to ingestion latency on HNSW.
Vector hubness, where a few points become nearest neighbors of many queries, creates a poisoning risk in retrieval-augmented generation (RAG): one injected document can influence unrelated requests. Existing defenses use periodic reverse-kNN scans, leaving an exposure window and repeated corpus-wide work. We study admission-time control, scoring each candidate against sentinel queries and quarantining hub-like documents before insertion. Across two 100,000-document corpora, five encoders, and disjoint attacker and defender query sets, a global gate achieves recall 1.0 at the decisive embedding-space point (>=0.92 across the effective range) and 0.91 +/- 0.07 on HotFlip attacks, with 1% false positives on general documents. A per-topic gate provides no reliable benefit, consistent with anisotropy coupling local and global visibility. Thresholds are maintained incrementally, with corpus-size-independent insertion cost and amortized deletion cost. On HNSW, admission adds about 3.1% to ingestion latency, scoring remains flat to 10^6 vectors, and 1.2% of decisions flip under approximate indexing, none involving attacks. Provenance complements the gate for natural or tight-domain hubs.