Query Filters Catch the Attack That Advertises Itself
TL;DR for operators A retrieval-security team can reasonably start by looking for poisoned documents that repeat a user’s question or arrive as an unusually tight cluster of near-duplicate vectors. CamoDocs shows why neither signal should be treated as a durable property of poisoning. In matched-budget experiments, a simple query detector keeps three earlier attacks between 5.4% and 7.6% attack success, while CamoDocs reaches 75.2%. Put the target query back into CamoDocs, and success falls to 7.8%. The paper’s ablations then isolate the harder problem: deliberately spreading poisoned-document embeddings raises attack success against the clustering-based TrustRAG defense from 11.5% to 28.7%. ...