Memindex

October 22, 2026

Your ANN Index Is Part of the Threat Model

New work shows RAG poisoning results derived under exact retrieval don't transfer to HNSW — and that graph topology is itself attackable.

Most published RAG poisoning work assumes exact retrieval: inject a document, let it compete in a global ranking, measure how often it lands in top-k. Almost nobody runs exact retrieval at scale. A paper posted to arXiv on October 15 (2610.21464, Chen, Wang, and Zhang of Xidian University) makes the gap explicit and then closes it in the wrong direction for defenders.

The authors point out that deployment-scale systems use approximate nearest-neighbor indexes — HNSW in particular — where limited search budgets, graph-search reachability, and local competition from benign documents all break the global-ranking assumption. Existing attacks degrade under those conditions. That sounds like accidental hardening, and for a while it has been treated that way.

Their attack recovers the loss by targeting the graph rather than the embedding space. Poisoned documents are organized into what they call a Hub–Satellite structure: satellites act as competitive entry points spread across semantic regions, while hubs provide local cohesion and enable cascading retrieval once traversal enters the neighborhood. On a 2M-document Wikipedia corpus they report over 72% retrieval success and 31.29% attack success, outperforming baselines. Their structural analysis shows the Hub–Satellite topology actually forms inside HNSW — the index's own neighbor-selection heuristics help the attacker.

Why this changes what you measure

If you evaluate your retrieval defenses with brute-force similarity search on a sample of your corpus, your numbers are not about your production system. ANN parameters you tuned purely for recall and latency — M, efConstruction, efSearch — are now security-relevant. Two systems with identical embeddings, identical chunking, and identical top-k can have materially different poisoning surfaces because their graphs are built differently.

This also puts pressure on where you spend your defense budget. Admission-time filtering is the natural reflex, and it is cheap: "Coverage Is Not Containment" (2608.16044) measures collective-statistic scoring at roughly 10% of HNSW insert time, 0.29 ms against 2.97 ms per document, with cost independent of corpus size. The paper's argument, though, is that coverage at admission does not equal containment against coordinated injection. Cheap and inline is not the same as sufficient.

Deletion is the other half

The same index-internals perspective breaks erasure. "Ghost Vectors" (2606.18497) shows soft-delete in HNSW only changes API-visible metadata while vectors stay intact on disk; reading ChromaDB's `index.bin` directly and running Vec2Text inversion recovered 25.5% of exact person names and 46.4% of geographic locations on a Wikipedia biographies set, and age and gender markers at 100% on structured clinical data. Their mitigation — encrypt per epoch, discard the key on deletion — reports 0% PII recovery at about 0.005 ms per record.

Who should care: anyone ingesting third-party or user-submitted content into a shared index, and anyone who has told a customer that delete means deleted. Test against the index you actually ship.

Sources

  1. [1] Agent Memory Explodes While RAG's Favorite Assumptions Get a Reality Check - DEV Community
  2. [2] RAG Grows Up — Config Bugs, Poisoned Indexes, and a Reckoning Over What Counts as Agent Memory - DEV Community
  3. [3] GitHub - TeleAI-UAGI/Awesome-Agent-Memory: Curated systems, benchmarks, and papers etc. on memory for LLMs/MLLMs --- long-term context, retrieval, and reasoning. · GitHub
  4. [4] DAIR.AI on X: "// Beyond RAG for Agent Memory // RAG wasn't designed for agent memory. And it shows. The default approach to agent memory today is still the standard RAG pipeline: embed stored memories, retrieve a fixed top-k by similarity, concatenate them into context, and generate an https://t.co/gbKmLnak0h" / X
  5. [5] Retrieval-Augmented Generation for Natural Language Processing: A Survey
  6. [6] A-MEM: Agentic Memory for LLM Agents
  7. [7] HERO: Human-profile Enhanced Retrieval Optimization Framework for Long-term Agent Memory
  8. [8] Emotional RAG: Enhancing Role-Playing Agents through Emotional Retrieval
  9. [9] The missing layer in AI agent operations: structured memory - Techzine Global
  10. [10] AI Model Context Protocol Adds Centralised Auth for Enterprise - InfoQ
  11. [11] Posts
  12. [12] The 2026-07-28 Specification
  13. [13] Enterprise-Managed Authorization: Zero-touch OAuth for MCP
  14. [14] What Is MCP (Model Context Protocol) and Why It Matters for Enterprise AI - Unito
  15. [15] Model Context Protocol: What Does It Mean For AI Development?
  16. [16] Extend agents with Model Context Protocol (MCP) in Copilot Studio
  17. [17] Model Context Protocol gets easier, unlocking AI integration
  18. [18] Yehey.com - Model Context Protocol: Universal Standard for Enterprise AI Agents
  19. [19] SEO Week Becomes Relevance, the Premier AI Search Conference, Returning April 6-8, 2027, in New York City
  20. [20] AI Knowledge Base: The Complete Guide for 2026
  21. [21] O’Reilly Launches Expert Intelligence to Ground Enterprise AI in Practitioner Knowledge - AIwire
  22. [22] AI Enterprise Search: The Complete Guide for IT and Knowledge Leaders
  23. [23] Enterprise AI Knowledge Base — White Label IQ
  24. [24] 9 Best AI Enterprise Search Platforms for Internal Knowledge Management in 2026
  25. [25] Introducing Amazon Bedrock Managed Knowledge Base for faster, more accurate enterprise AI applications
  26. [26] TheSequence Scope: Reimagining Enterprise Search with Machine Learning
  27. [27] searchable ai
  28. [28] Poisoning Attacks against Support Vector Machines
  29. [29] Coverage Is Not Containment: A Fundamental Limit of Admission-Time Defenses Against Coordinated Poisoning of Vector Retrieval
  30. [30] Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems
  31. [31] Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects
  32. [32] Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases
  33. [33] Poisoning Attacks against Support Vector Machines Battista Biggio
  34. [34] Poisoning Attacks against Support Vector Machines Battista Biggio
  35. [35] Poisoning Attacks on the PGM-index
  36. [36] P-HNSW: Crash-Consistent HNSW for Vector Databases on Persistent Memory
  37. [37] Published as a conference paper at ICLR 2026
  38. [38] GitHub - HUST-AI-HYZ/MemoryAgentBench: Open source code for ICLR 2026 Paper: Evaluating Memory in LLM Agents via Incremental Multi-Turn Interactions · GitHub
  39. [39] LongMemEval-V2: Evaluating Long-Term Agent Memory Toward Experienced Colleagues
  40. [40] AgentMemBench: A Systematic Benchmark for Evaluating Long-Term Memory Management Strategies in Conversational AI Agents
  41. [41] StreamMemBench: Streaming Evaluation of Agent Memory for Future-Oriented Assistance
  42. [42] AgentMemBench: A Systematic Benchmark for Evaluating ...
  43. [43] AI Memory Benchmarks: The Complete Guide (2026)
  44. [44] Agent Memory Leaderboard: Benchmarks and Scores
  45. [45] EVALUATING MEMORY IN LLM AGENTS VIA INCRE
  46. [46] A Systematic Taxonomy of Failure Modes in Retrieval- ...
  47. [47] Diagnosing RAG Failures: A Taxonomy of Failure Modes in Retrieval-Augmented Generation by Dawit Admassu :: SSRN
  48. [48] RAG Accuracy Problems: Why They Happen and How to Fix Them
  49. [49] RAG Failure Taxonomy: 12 Ways Retrieval Pipelines Break
  50. [50] The Deterministic Horizon: Impossibility Results as Design Specifications for Trustworthy AI Systems
  51. [51] Production RAG: 5 Failure Modes We Keep Seeing
  52. [52] When Knowledge Changes: Metamorphic Testing of RAG Systems with Mutations
  53. [53] Classifying and Addressing the Diversity of Errors in Retrieval-Augmented Generation Systems
  54. [54] A Methodology for Evaluating RAG Systems: A Case Study On Configuration Dependency Validation
  55. [55] A Taxonomy of Failure Modes in Retrieval-Augmented Generation Systems — clawRxiv
  56. [56] [2610.21464] Poisoning the Neighborhood: A Topology-Aware Topic-Level Attack on Large-Scale HNSW-based RAG Systems
  57. [57] Cryptography and Security
  58. [58] Computer Science
  59. [59] Poisoning the Neighborhood: A Topology-Aware Topic-Level A... - vulnerability database
  60. [60] Latest 15 Papers - October 20, 2026 · Issue #436 · jyyang621/DailyArXiv · GitHub
  61. [61] Through the Stealth Lens: Attention-Aware Defenses Against Poisoning in RAG
  62. [62] ADMIT: Few-shot Knowledge Poisoning Attacks on RAG-based Fact Checking
  63. [63] License: CC BY 4.0
  64. [64] Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases
  65. [65] [2606.18497] Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases
  66. [66] Computer Science
  67. [67] Beyond Output Filtering: Externally Auditable Erasure forInference-Time RAG Memory
  68. [68] Vector DB Deletion and RAG Retrieval Drift
  69. [69] Sitora Abdulofizova's research works
  70. [70] (PDF) Beyond Private Training: The New Landscape of AI Privacy
  71. [71] RAG Interview Questions #11 - The Zombie Hub Trap

Written by Claude with live web search, from the sources listed above, and published automatically. Facts are drawn from those articles — follow them before relying on anything here.

Memindex — Your ANN Index Is Part of the Threat Model