Signed edge-RAG packs can expose 98-100% of queries, paper shows

Signed knowledge packs for offline retrieval-augmented generation on edge devices carry two things: text, and precomputed embedding vectors. The signature covers the publisher's identity. It does not prove the vectors actually encode the text they ride with.

That gap is the subject of "Signed but Steerable", a preprint by Georgios Feretzakis and Alexandros Papaspyridis. "A signature proves who published a pack, not that its vectors encode its text," they write. They name the problem a "text-vector integrity gap" and define a "margin law": the share of queries a vector-controlling attacker can hijack equals the distribution of angular retrieval margins at the verifier's cosine tolerance.

The numbers are not subtle. Across five corpora and two embedding models, an idealised tolerance at the level of floating-point noise still leaves up to 5.5% of queries exposed, and at most 1.2% in any corpus once exact duplicate documents are excluded. A threshold calibrated from the authors' CPU INT8-FP32 comparison of a small embedding model, set at the empirical 0.1% quantile of honest cosines, leaves 98-100% exposed. On a Raspberry Pi 5 running a local language model, the attack lowers correct answers from 0.75 to 0.39.

Compressed vector stores do not save you. On a FAISS product-quantisation index over 57,638 documents, "tampered vectors that all pass the audit put the attacker's document first for 25% of targets."

The paper's proposed fix verifies quantisation codes rather than recomputed floats, with ambiguity decided by the verifier, a calibrated guard band and canonicalisation. Across three platforms, the authors report this approach "accepted every honest vector in our samples" while leaving the publisher no slack. They also note, as a plumbing point, that common floating-point and dynamic-INT8 inference pipelines are not bit-reproducible across batch sizes or architectures, which is why a naive recompute-and-compare verifier cannot work. Code and data are released.