通过插入时全局门控，高效防御向量检索中的热点问题
When Global Gating Is Enough: Admission-Time Hubness Control in Anisotropic Vector Retrieval Systems
- 插入时用哨兵查询评估文档，提前隔离热点候选
- 在两个百万级语料库上实现召回率1.0，攻击下仍达0.91
- 成本低且可扩展，适合需要高安全性的RAG系统
向量热点现象使少数文档成为大量查询的近邻，对检索增强生成（RAG）构成污染风险：一个注入文档可能影响无关请求。现有防御依赖周期性反kNN扫描，存在暴露窗口且重复遍历整个语料库。本文研究插入时控制策略，对候选文档在哨兵查询上评分，将类热点文档隔离于插入前。在两个10万文档语料库、五个编码器及分离的攻防查询集上，全局门控在决定性嵌入空间点实现召回率1.0（有效范围内≥0.92），在HotFlip攻击下为0.91±0.07，普通文档误报率仅1%。按主题设置门控无可靠提升，符合各向异性导致局部与全局可见性耦合。阈值增量维护，插入成本与语料大小无关，删除成本可分摊。在HNSW上，插入增加约3.1%吞吐延迟，评分性能稳定至10⁶向量，近似索引下仅有1.2%决策变动，且未涉及攻击。溯源机制可补充门控，应对自然或特定领域热点。
原文摘要 · Abstract (English)
Vector hubness, where a few points become nearest neighbors of many queries, creates a poisoning risk in retrieval-augmented generation (RAG): one injected document can influence unrelated requests. Existing defenses use periodic reverse-kNN scans, leaving an exposure window and repeated corpus-wide work. We study admission-time control, scoring each candidate against sentinel queries and quarantining hub-like documents before insertion. Across two 100,000-document corpora, five encoders, and disjoint attacker and defender query sets, a global gate achieves recall 1.0 at the decisive embedding-space point (>=0.92 across the effective range) and 0.91 +/- 0.07 on HotFlip attacks, with 1% false positives on general documents. A per-topic gate provides no reliable benefit, consistent with anisotropy coupling local and global visibility. Thresholds are maintained incrementally, with corpus-size-independent insertion cost and amortized deletion cost. On HNSW, admission adds about 3.1% to ingestion latency, scoring remains flat to 10^6 vectors, and 1.2% of decisions flip under approximate indexing, none involving attacks. Provenance complements the gate for natural or tight-domain hubs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。