{"id":35182446,"url":"https://github.com/scthornton/semantic-chameleon","last_synced_at":"2026-03-17T18:36:32.037Z","repository":{"id":325344042,"uuid":"1097932352","full_name":"scthornton/semantic-chameleon","owner":"scthornton","description":"Dual-Stage Temporal Poisoning Attack on RAG Systems","archived":false,"fork":false,"pushed_at":"2026-03-09T14:49:43.000Z","size":8414,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-09T19:30:17.355Z","etag":null,"topics":["artificial-intelligence","machine-learning","poisoning-attack","rag","rag-security"],"latest_commit_sha":null,"homepage":"https://zenodo.org/records/18080200","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/scthornton.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-11-17T03:24:13.000Z","updated_at":"2026-03-09T14:50:29.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/scthornton/semantic-chameleon","commit_stats":null,"previous_names":["scthornton/semantic-chameleon"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/scthornton/semantic-chameleon","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scthornton%2Fsemantic-chameleon","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scthornton%2Fsemantic-chameleon/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scthornton%2Fsemantic-chameleon/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scthornton%2Fsemantic-chameleon/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/scthornton","download_url":"https://codeload.github.com/scthornton/semantic-chameleon/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scthornton%2Fsemantic-chameleon/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30628418,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-17T17:32:55.572Z","status":"ssl_error","status_checked_at":"2026-03-17T17:32:38.732Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["artificial-intelligence","machine-learning","poisoning-attack","rag","rag-security"],"created_at":"2025-12-29T03:02:39.537Z","updated_at":"2026-03-17T18:36:32.029Z","avatar_url":"https://github.com/scthornton.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Corpus-Dependent RAG Poisoning\r\n\r\n[![Paper DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.18080200.svg)](https://doi.org/10.5281/zenodo.18080200)\r\n[![Code DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.18079735.svg)](https://doi.org/10.5281/zenodo.18079735)\r\n\r\n**Research Repository for \"Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems\"**\r\n\r\n**DEFENSIVE RESEARCH ONLY**: This repository contains sanitized educational materials for understanding and defending against RAG poisoning attacks. No weaponized attack materials are included.\r\n\r\n---\r\n\r\n## Paper\r\n\r\n**Paper (PDF)**: [https://doi.org/10.5281/zenodo.18080200](https://doi.org/10.5281/zenodo.18080200)\r\n\r\n**Code (This Repo)**: [https://doi.org/10.5281/zenodo.18079735](https://doi.org/10.5281/zenodo.18079735)\r\n\r\n**Anonymous Review Copy**: [https://anonymous.4open.science/r/semantic-chameleon-B610/](https://anonymous.4open.science/r/semantic-chameleon-B610/)\r\n\r\n**Author**: Scott Thornton (perfecXion.ai)\r\n\r\n**Abstract**: This work characterizes how corpus composition and retrieval architecture jointly affect RAG security. We find that technical corpora are 13-62× harder to defend than general knowledge bases, and that simple hybrid BM25+vector retrieval neutralizes gradient-optimized attacks in our experiments.\r\n\r\n**Key Findings**:\r\n- 38.0% co-retrieval success on pure vector retrieval (n=50, 95% CI: 25.9%-51.8%)\r\n- Hybrid retrieval (α≤0.5) reduces co-retrieval to 0% across all 50 gradient-optimized attacks\r\n- Joint sparse+dense optimization partially circumvents hybrid (20-44% success) but significantly raises the bar\r\n- **Multi-model E2E** (5 LLMs): attack success 46.7% (GPT-5.3) to 93.3% (Llama 4); safety violations 6.7% (Claude) to 93.3% (Llama 4)\r\n- **FEVER n=25**: 0% overall success across all retrieval configs, confirming corpus-dependent effects at scale\r\n- Technical corpora show 13-62× worse detection performance than general knowledge bases\r\n- Query Pattern Differential emerges as most reliable detection method across corpora\r\n\r\n---\r\n\r\n## March 2026 Updates (AISec '26 Submission)\r\n\r\n### Multi-Model End-to-End Evaluation (5 LLMs)\r\n\r\nAttack effectiveness varies dramatically across model families:\r\n\r\n| Model | Attack Success | Safety Violations | Payload Leakage | Divergence |\r\n|-------|---------------|-------------------|-----------------|------------|\r\n| GPT-5.3 | **46.7%** (7/15) | 33.3% | 9.6% | 0.284 |\r\n| GPT-4o | 53.3% (8/15) | 86.7% | 12.0% | 0.483 |\r\n| GPT-4o-mini | 53.3% (8/15) | 86.7% | 14.9% | 0.418 |\r\n| Claude Sonnet 4.6 | 60.0% (9/15) | **6.7%** | 5.7% | 0.196 |\r\n| Llama 4 Instruct | **93.3%** (14/15) | **93.3%** | **56.8%** | 0.268 |\r\n\r\n**Key Insight**: Safety training maturity varies dramatically. Claude shows the strongest safety boundary (6.7% violations despite 60% attack success). Llama 4 is dramatically vulnerable (93% attack success, only 27% clean refusal rate). GPT-5.3 shows measurable improvement over GPT-4o.\r\n\r\n### Joint Sparse+Dense Optimization\r\n\r\nA knowledgeable attacker who jointly optimizes for both BM25 and vector retrieval can partially circumvent hybrid defense:\r\n\r\n| Attack Type | α=0.7 | α=0.5 | α=0.3 |\r\n|-------------|-------|-------|-------|\r\n| Gradient-only (baseline) | 0% | 0% | 0% |\r\n| Joint optimization | **20%** | **36%** | **44%** |\r\n\r\n**Key Insight**: Hybrid retrieval raises the attack bar from 38% (pure vector) to 0% (gradient-only on hybrid), but joint optimization achieves 20-44%. Hybrid retrieval is a significant defense, not an absolute one.\r\n\r\n### FEVER Large-Scale (n=25)\r\n\r\n25 GCG-optimized attacks on FEVER Wikipedia (2,000-doc representative sample):\r\n\r\n| Config | Co-Retrieval | Stealth | Overall Success |\r\n|--------|-------------|---------|-----------------|\r\n| Pure Vector (α=1.0) | 100% | 0% | **0%** |\r\n| Hybrid (α=0.7) | 100% | 0% | **0%** |\r\n| Hybrid (α=0.5) | 100% | 0% | **0%** |\r\n| Hybrid (α=0.3) | 100% | 0% | **0%** |\r\n\r\n**Key Insight**: Confirms n=9 pilot at 2.8× scale. General-vocabulary corpora make attack documents conspicuous regardless of retrieval architecture.\r\n\r\n---\r\n\r\n## December 2025 Updates\r\n\r\n### End-to-End LLM Evaluation (Single Model)\r\n\r\nInitial evaluation against GPT-4o-mini (15 attack scenarios):\r\n\r\n| Metric | Result |\r\n|--------|--------|\r\n| Attack Success Rate | 60% (9/15 scenarios) |\r\n| Safety Bypass Rate | 80% of successful attacks |\r\n| Response Divergence | 46% average |\r\n| Model Tested | GPT-4o-mini |\r\n\r\n### Production RAG Case Study\r\n\r\nValidated corpus-dependency hypothesis against a 156,777-document production corpus:\r\n\r\n| Attack Type | Retrieval Success | Trigger Rank |\r\n|------------|-------------------|--------------|\r\n| Naive (generic) | 0% | N/A |\r\n| Adaptive (corpus-optimized) | 100% | #1 |\r\n\r\n---\r\n\r\n## Repository Structure\r\n\r\n```\r\nsemantic-chameleon/\r\n├── README.md                          # This file\r\n├── LICENSE                            # MIT License\r\n├── SECURITY.md                        # Responsible disclosure policy\r\n│\r\n├── detection/                         # Detection framework (defensive only)\r\n│   ├── semantic_drift.py             # Method 1: Embedding anomaly detection\r\n│   ├── keyword_anomaly.py            # Method 2: IDF-based keyword detection\r\n│   ├── query_pattern.py              # Method 3: Query differential analysis\r\n│   ├── detection_metrics.py          # ROC, F1, AUROC evaluation\r\n│   └── README.md                     # Detection method documentation\r\n│\r\n├── defense/                           # Defense implementations\r\n│   ├── hybrid_retrieval.py           # BM25+vector hybrid scoring\r\n│   ├── bm25_implementation.py        # Okapi BM25 with configurable params\r\n│   └── README.md                     # Defense deployment guide\r\n│\r\n├── evaluation/                        # Evaluation scripts\r\n│   ├── metrics.py                    # Success rate, CI calculation (Wilson score)\r\n│   ├── statistical_tests.py          # Chi-square, effect size (Cohen's h)\r\n│   ├── corpus_analysis.py            # Corpus property analysis\r\n│   ├── e2e_llm_evaluation.py         # NEW: End-to-end LLM evaluation\r\n│   └── README.md                     # Evaluation methodology\r\n│\r\n├── examples/                          # Sanitized educational examples\r\n│   ├── sanitized_scenarios.json      # Attack scenario descriptions (no exploits)\r\n│   ├── benign_document_templates.txt # Example benign document structures\r\n│   ├── detection_examples.py         # How to use detection framework\r\n│   └── README.md                     # Examples documentation\r\n│\r\n├── data/                              # Dataset information (no actual data)\r\n│   ├── security_se_instructions.md   # How to obtain Security Stack Exchange\r\n│   ├── fever_instructions.md         # How to obtain FEVER dataset\r\n│   └── corpus_statistics.json        # Corpus metadata (sizes, domains)\r\n│\r\n├── experiments/                        # Experiment scripts (March 2026)\r\n│   ├── exp1_fever_large_scale.py     # FEVER n=25 evaluation\r\n│   ├── exp2_multimodel_e2e.py        # Multi-model E2E (5 LLMs)\r\n│   ├── exp3_joint_hybrid_attack.py   # Joint sparse+dense optimization\r\n│   ├── setup_data.py                 # Data download and embedding setup\r\n│   └── requirements.txt              # Experiment dependencies\r\n│\r\n├── results/                           # Experimental results\r\n│   ├── e2e_evaluation_results.json   # Dec 2025: E2E LLM evaluation\r\n│   ├── panw_case_study.json          # Dec 2025: Production case study\r\n│   ├── march-2026/                   # March 2026 experiments\r\n│   │   ├── exp1_fever_large_scale_results.json\r\n│   │   ├── exp2_multimodel_e2e_results.json\r\n│   │   └── exp3_joint_hybrid_attack_results.json\r\n│   └── README.md                     # Results documentation\r\n│\r\n├── paper/                             # Paper materials\r\n│   ├── paper.pdf                     # Main paper (arXiv version)\r\n│   ├── supplementary.pdf             # Supplementary materials\r\n│   └── figures/                      # Paper figures (PNG, 300 DPI)\r\n│\r\n├── docs/                              # Documentation\r\n│   ├── REPRODUCIBILITY.md            # Step-by-step reproduction guide\r\n│   ├── ETHICAL_CONSIDERATIONS.md     # Ethics and responsible use\r\n│   ├── DEPLOYMENT_GUIDE.md           # How to deploy defenses\r\n│   └── FAQ.md                        # Frequently asked questions\r\n│\r\n└── requirements.txt                   # Python dependencies\r\n```\r\n\r\n---\r\n\r\n## Defensive Focus\r\n\r\nThis repository provides:\r\n\r\n- **Detection methods** - 5 detection approaches with complete implementations\r\n- **Defense mechanisms** - Hybrid retrieval and monitoring strategies\r\n- **Evaluation tools** - Metrics, statistical tests, ROC analysis\r\n- **Corpus analysis** - Understanding corpus-dependent security properties\r\n- **Deployment guides** - Practical guidance for securing RAG systems\r\n\r\n**NOT included** - Working attack implementations, weaponizable exploits, malicious document generation\r\n\r\n---\r\n\r\n## Quick Start\r\n\r\n### Installation\r\n\r\n```bash\r\ngit clone https://github.com/scthornton/semantic-chameleon\r\ncd semantic-chameleon\r\npip install -r requirements.txt\r\n```\r\n\r\n### Run Detection Framework\r\n\r\n```python\r\nfrom detection.query_pattern import QueryPatternDetector\r\nfrom defense.hybrid_retrieval import HybridRetriever\r\n\r\n# Initialize detector\r\ndetector = QueryPatternDetector(\r\n    benign_queries=100,  # Sample from production logs\r\n    sensitive_queries=20  # Domain-specific attack patterns\r\n)\r\n\r\n# Initialize hybrid defense\r\nretriever = HybridRetriever(alpha=0.5)  # Balanced BM25+vector\r\n\r\n# Analyze corpus\r\nresults = detector.analyze_corpus(corpus, threshold=0.2)\r\nprint(f\"Detected: {results['flagged_documents']} suspicious documents\")\r\n```\r\n\r\n### Deploy Hybrid Defense\r\n\r\n```python\r\nfrom defense.hybrid_retrieval import HybridRetriever\r\n\r\n# Security-critical configuration (recommended)\r\nretriever = HybridRetriever(\r\n    alpha=0.5,           # 50% vector, 50% BM25\r\n    bm25_k1=1.5,         # Standard Okapi BM25\r\n    bm25_b=0.75\r\n)\r\n\r\n# Retrieve with defense\r\nresults = retriever.retrieve(query, k=10)\r\n```\r\n\r\n---\r\n\r\n## Reproducing Paper Results\r\n\r\nSee [`docs/REPRODUCIBILITY.md`](docs/REPRODUCIBILITY.md) for complete step-by-step instructions.\r\n\r\n**High-level overview**:\r\n\r\n1. **Obtain datasets**: Security Stack Exchange dump + FEVER dataset\r\n2. **Run detection evaluation**: `python evaluation/run_detection.py`\r\n3. **Test hybrid defense**: `python evaluation/run_hybrid_defense.py`\r\n4. **Generate figures**: `python evaluation/generate_figures.py`\r\n\r\n**Expected compute**: ~8-16 hours on GCP n1-standard-8 (or equivalent)\r\n\r\n---\r\n\r\n## Research Ethics\r\n\r\nThis research follows responsible disclosure practices:\r\n\r\n- **Defensive focus**: All materials prioritize understanding defenses\r\n- **No weaponization**: Attack implementations are conceptual only\r\n- **Sanitized examples**: All examples use non-exploitable scenarios\r\n- **Coordinated disclosure**: Vulnerabilities reported to affected vendors\r\n\r\nSee [`docs/ETHICAL_CONSIDERATIONS.md`](docs/ETHICAL_CONSIDERATIONS.md) for full ethics statement.\r\n\r\n---\r\n\r\n## Citation\r\n\r\nIf you use this research or code, please cite:\r\n\r\n```bibtex\r\n@article{thornton2025semantic,\r\n  author    = {Thornton, Scott},\r\n  title     = {Semantic Chameleon: Corpus-Dependent Poisoning Attacks and Defenses in RAG Systems},\r\n  year      = {2025},\r\n  doi       = {10.5281/zenodo.18080200},\r\n  url       = {https://doi.org/10.5281/zenodo.18080200},\r\n  publisher = {Zenodo}\r\n}\r\n```\r\n\r\n**Paper:** [https://doi.org/10.5281/zenodo.18080200](https://doi.org/10.5281/zenodo.18080200)\r\n**Code:** [https://doi.org/10.5281/zenodo.18079735](https://doi.org/10.5281/zenodo.18079735)\r\n\r\n---\r\n\r\n## Contributing\r\n\r\nWe welcome contributions that advance RAG security defenses:\r\n\r\n- Detection method improvements\r\n- New defense mechanisms\r\n- Evaluation tools\r\n- Documentation improvements\r\n\r\n**Not accepted**: Attack implementations, weaponizable code, malicious examples\r\n\r\nSee [`CONTRIBUTING.md`](CONTRIBUTING.md) for guidelines.\r\n\r\n---\r\n\r\n## Contact\r\n\r\n**Scott Thornton**\r\n- Website: https://perfecxion.ai\r\n- Email: scott@perfecxion.ai\r\n- Paper: [https://doi.org/10.5281/zenodo.18080200](https://doi.org/10.5281/zenodo.18080200)\r\n- GitHub: https://github.com/scthornton/semantic-chameleon\r\n\r\n**Security Issues**: Please report via [SECURITY.md](SECURITY.md)\r\n\r\n---\r\n\r\n## License\r\n\r\nMIT License - see [`LICENSE`](LICENSE) for details.\r\n\r\n**Responsible Use Clause**: By using this code, you agree to use it only for defensive security research, system hardening, and educational purposes. Malicious use is prohibited and violates the terms of this license.\r\n\r\n---\r\n\r\n## Acknowledgments\r\n\r\n- Security Stack Exchange community for public dataset\r\n- FEVER dataset maintainers\r\n- Google Cloud Platform for computational resources\r\n- OpenAI for embedding API access\r\n\r\n---\r\n\r\n**Last Updated**: March 2026\r\n**Paper DOI**: [10.5281/zenodo.18080200](https://doi.org/10.5281/zenodo.18080200)\r\n**Code DOI**: [10.5281/zenodo.18079735](https://doi.org/10.5281/zenodo.18079735)\r\n**Status**: Published on Zenodo (defensive research materials)\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscthornton%2Fsemantic-chameleon","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fscthornton%2Fsemantic-chameleon","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscthornton%2Fsemantic-chameleon/lists"}