A permitting RAG system starts retrieving wrong zoning snippets for certain street addresses after an embedding refresh. What lifecycle attack class should investigators prioritize?
Select an answer to reveal the explanation.
Short Explanation
When the wrong zoning snippet shows up for one address, the embedding index may have been poisoned—trust the retrieval trail.
Full Explanation
When a permitting RAG system begins retrieving wrong zoning snippets for certain street addresses after an embedding refresh, investigators should prioritize poisoned embeddings that corrupt civic RAG retrieval for selected locations. Embeddings and the vector index mediate which policy text is fetched for a query; poisoning or tampering at that layer can make attacker-chosen keys (addresses) surface incorrect zoning language while other queries look fine. That is a lifecycle attack against retrieval integrity, not merely a typo in a zoning PDF. Priority actions include verifying embedding pipeline inputs, index rebuild provenance, checksums on embedding artifacts, and comparing retrieved chunks against authoritative zoning sources for the affected addresses.
Mislabeled zoning chunk boundaries might skew context for nearby parcels, but they would not explain selective failures tied to specific addresses right after an embedding refresh. Backdoored retriever weights could bias ranking toward favored developers, but the symptom here is wrong zoning snippets for selected addresses after a refresh, not systematic favoritism in ranking. Overfitted reranking thresholds might filter results for dense districts, yet they would not produce incorrect zoning snippets for particular street addresses following an embedding change. Each distractor describes a plausible retrieval or indexing flaw, but none accounts as directly for address-specific bad snippets appearing only after an embedding refresh as poisoned embeddings do.
Exam caveat: wrong retrieval after an embedding refresh can also stem from buggy migrations, dimension mismatches, or accidental corpus swaps—not only adversarial poison. Investigate integrity and change control first; escalate to intentional poisoning when anomalies are selective, reproducible for attacker-useful keys, and tied to untrusted inputs. Distinguish embedding poison from prompt injection at query time; here the stem points to the refresh/index lifecycle.
Operational check: for failing addresses, dump top-k retrieved chunk IDs and scores, diff them against a pre-refresh snapshot, and verify whether embedding vectors for those keys shifted abnormally. Confirm who approved the refresh, what corpus was embedded, and whether signing/checksum gates existed. Pin the prior good index for permitting decisions until the new embedding set is proven clean against known municipal zoning truth cases.