research: mincut-gated proximity-graph insertion (nightly 2026-08-30) — REJECT

[ruvnet]

Summary

Nightly research cycle (2026-08-30): tests whether a graph-based ANN index can refuse a RAG-corpus-poisoning insertion at insertion time, using only the graph structure the index already builds — a stage no defense in the reviewed 2025-2026 literature (PoisonedRAG, GMTP, RADAR, Semantic Chameleon) operates at.

New crate crates/ruvector-graft-gate (zero external dependencies) implements a from-scratch NSW-style proximity graph plus three insertion gates, benchmarked against a deterministic synthetic poisoning attack model.

Verdict: REJECT (pre-registered hypothesis's central claim was falsified, in the opposite direction — reported as a genuine, mechanistically-explained negative result, not forced into a positive spin). An unplanned side finding (CoherenceRatio, a cheap similarity-shape heuristic) performed well and is flagged as a candidate for a follow-up, separately pre-registered experiment.

Hypothesis

Given a 5,000+1,000-vector NSW proximity graph (20 Gaussian clusters, sigma=0.15, dim=64)
and 200 synthetic poison insertions (normalize(0.7*target_query + 0.3*random_direction)),

when each candidate insertion is evaluated by CoherenceRatioGate (peakedness =
max_kNN_sim / mean_kNN_sim, reject if >1.35) and independently by MinCutGate
(local k=10 threshold subgraph, max-flow/min-cut to neighborhood anchor, reject if <2),

then (a) MinCutGate's poison-catch rate exceeds CoherenceRatioGate's by >=10pp,
AND (b) both keep legit false-reject <=5%, AND (c) MinCutGate cuts conditional
attack success by >=20pp vs NoGate baseline,

subject to gating latency <500us mean and recall@10 drop <=2pp vs NoGate.

Architecture

flowchart LR
    Data[Deterministic data:\n20 clusters, 50 target queries,\n200 poison vectors] --> Boot[Bootstrap: 5,000\nvectors, ungated NSW graph]
    Boot --> Clone1[NoGate]
    Boot --> Clone2[CoherenceRatio]
    Boot --> Clone3[MinCut]
    Mix[Fixed shuffled insertion order\n1,000 legit + 200 poison] --> Clone1
    Mix -->|search + gate.evaluate| Clone2
    Mix -->|search + gate.evaluate| Clone3
    Clone1 --> M[gate latency, poison catch,\nfalse-reject, attack success, recall@10]
    Clone2 --> M
    Clone3 --> M

Loading

Benchmark command + real results

cargo run --release -p ruvector-graft-gate --bin benchmark

Variant	Poison caught (/200)	Legit false-reject (/1,000)	Mean gate latency	Recall@10
NoGate	0 (0.0%)	0	43 ns	0.598
CoherenceRatio	122 (61.0%)	0	55 ns	0.844
MinCut	0 (0.0%)	0	13,621 ns	0.598

Root cause (verified via a temporary, since-reverted instrumentation pass): 97.25% of all 1,200 evaluated candidates saturated the min-cut metric near its structural maximum (flow=9 or 10 of ≤10) because a candidate's k-NN at this cluster tightness are almost always one tight, already-mutually-similar cluster — the adaptive edge threshold never thinned the local subgraph enough to expose a bridge signature. CoherenceRatio succeeded because it measures similarity shape, which survives that saturation.

cargo test --release -p ruvector-graft-gate: 18 passed, 0 failed (includes 3 hand-verified max-flow correctness tests confirming the 0% MinCut result is a calibration finding, not a max-flow bug).

cargo clippy --release -p ruvector-graft-gate --all-targets: clean. cargo fmt --check: clean.

Acceptance verdict

REJECT. Both subject-to validity conditions held (latency and recall), so clauses (a) and (c) are a clean falsification, not an invalid measurement. Clause (b) held. Per the pre-registration rule, thresholds were fixed before the first benchmark run and were not adjusted afterward.

Security review notes

• Zero external dependencies, no unsafe code.
• MinCut's max-flow primitive is unit-tested against hand-computed triangle/bridge/disconnected graphs — confirms correctness independent of the gate's effectiveness finding.
• Orthogonal to ruvector-proof-gate (ADR-227): this crate answers "is this insertion locally coherent," not "is this insertion honestly attributed" — the two are complementary, not substitutes (documented in Governance).
• No claims of a poisoning "solution" are made; CoherenceRatio's 61% catch rate and 39% miss rate are both stated explicitly.

Main limitations

• Single synthetic attack model, no real embedding model or corpus.
• Single-layer NSW graph (not production HNSW) — recall@10 of 0.598 even ungated reflects this crate's minimal index, not RuVector's production ANN quality.
• No deletes, concurrency, or scale beyond ~6,200 vectors.
• MinCut's threshold calibration is shown to saturate at this cluster tightness but was deliberately not adjusted mid-experiment (pre-registration rule) — recalibration is deferred to a new, separately pre-registered follow-up.

Production recommendation

Do not ship MinCut as specified — measurable overhead for zero measured defensive value at this calibration. CoherenceRatio is a plausible candidate for a follow-up experiment, not a production recommendation yet.

Links

• Nightly README: docs/research/nightly/2026-08-30-mincut-gated-insertion/README.md
• Gist (standalone article): docs/research/nightly/2026-08-30-mincut-gated-insertion/gist.md
• ADR: docs/adr/ADR-340-mincut-gated-insertion.md

---

Generated by Claude Code