Offline devices that answer questions from a local knowledge base use 'embeddings', numerical summaries of text for searching. These often come precomputed with the text in update packages. A signature doesn't guarantee the embeddings match the text, letting attackers hijack searches.
The researchers derived a 'margin law' that predicts the share of queries an attacker can steal given a checking tolerance. They tested it on several text collections and embedding models, finding that practical tolerances leave nearly all queries exposed. They also designed an exact method that compares the compressed 'codes' instead of using a tolerance, closing the gap across different hardware.
Even the tightest tolerance (floating-point noise) left up to 5.5% of queries vulnerable. An attack on a small board nearly halved correct answers (from 0.75 to 0.39). Their exact code verification accepted all honest vectors and blocked all attacks, making offline retrieval-augmented generation safe for field, industrial, and defense use.