Vectox
Diana Chang, Ian Duhamel Hayes · Team OnçAI
Submitted to Global South AI Safety Hackathon. Sprint projects are early-stage work by participants, not Apart Research publications.
vectox — Sleeper-Agent RAG Memory Poisoning (Latin America · Technical Safety)
RAG systems trust their vector store as memory, which makes that store a write-accessible attack surface. We built vectox, a reproducible sandbox showing that a handful of dormant, benign-looking documents seeded into a vector store act as an inference-time sleeper agent: invisible until a specific trigger query retrieves them, at which point the model treats the retrieved text as an instruction and its output is hijacked — no model weights touched. We pair a new NVIDIA garak rag_poisoning probe and detector with a live PostgreSQL pgvector(384)+HNSW victim, seeded with Latin-American-context poison derived structurally from the SESGO Spanish stereotype benchmark plus a Spanish-English code-switching variant. Across six bias dimensions and two languages, 24 poison documents among 224 achieve 100% attack success; adding an insertion-time BEFORE INSERT quarantine gate drops it to 0% with no change to the attack — demonstrating that auditing memory writes before they reach the retrieval hot path neutralizes the threat for Spanish/Portuguese systems.
Reviews
Really liked this paper because it has a very clear and practical security takeaway: RAG memory is not just storage, it is part of the trusted system. The sleeper-agent framing is effective, and the 100% to 0% result makes the risk and mitigation easy to understand.
The strongest insight is that memory should be checked before it enters the retrieval path, not only after the model responds. I would like to see this tested on a larger, more realistic corpus with adaptive attackers, but overall this is a useful and well-scoped applied security contribution.
The project has has chosen a great topic to be worked on, i.e; preventing poisoned documents in RAG from bypassing LLM or creating disruptions in the agent workflow. It proposes a solution to set all newly inserted documents to be in pending state. However, the paper doesn't discuss how the newly inserted documents would go to the approval state, and if manual intervention is necessary, then the whole implementation becomes redundant.
I think the problem of poisoned retrieval sets is relevant. However, I think that the proposed solution lacks novelty. I would have liked more clarity on what attacks and documents look like, but the eval set seems to suspiciously favor the intervention, as performance goes from 0% to 100%.
Cite this project
@misc{chang2026vectox,
title = {{Vectox}},
author = {Diana Chang and Ian Duhamel Hayes},
year = {2026},
month = jun,
note = {Submitted to Global South AI Safety Hackathon, an Apart Research Sprint},
howpublished = {\url{https://apartresearch.com/sprints/projects/vectox-0h8z}},
url = {https://apartresearch.com/sprints/projects/vectox-0h8z}
}More from Global South AI Safety Hackathon
- View project: Pragmatic Sophistry in Vietnamese Multi-Agent Oversight
Pragmatic Sophistry in Vietnamese Multi-Agent Oversight
AI Safety Enthusiasts
AI safety monitors are usually evaluated on the assumption that risky behavior is lexically visible in the text being watched. We test this assumption in a multilingual, multi-agent setting: Vietnamese-language workflow …
- View project: JusticIA: A Counterfactual Benchmark for Auditing Contextual Biases in Language Models for Transitional Justice
JusticIA: A Counterfactual Benchmark for Auditing Contextual Biases in Language Models for Transitional Justice
JusticeMiners
JusticIA is a counterfactual benchmark for auditing contextual bias in LLMs applied to Colombian transitional justice. It tests whether six LLMs change their sanction recommendations when only one contextual attribute …
- View project: Coldron
Coldron
ColDron
En Colombia, los grupos armados ilegales ya atacan con drones comerciales modificados y ya han herido y matado a civiles. Una pregunta decide cómo gobernar esta amenaza: ¿quién elige el blanco y aprieta el gatillo? Hoy, …