Hybrid sparse+dense retrieval takes gradient-guided corpus poisoning from 38% to 0% - until the attacker optimises against both, then back to 20-44%

The RAG hardening measure that works in the paper does not work in production, because production attackers optimise against whatever defence is deployed. A defence that reduces poisoning to zero against a naive attack is not a defence.

On the Security Stack Exchange corpus (67,941 documents) with 50 gradient-guided (GCG) attacks using dual-document payloads - a sleeper document plus a trigger document - poisoning reaches a 38.0% co-retrieval rate under pure vector retrieval. Hybrid retrieval combining BM25 with vector similarity, with no model change and no retraining of the retriever, reduces attack success from 38% to 0% across all 50 attacks. But when the attacker jointly optimises payloads for BOTH the sparse and dense retrieval signals, hybrid retrieval is partially circumvented and success returns to 20-44%. Separately, a 432-configuration factorial study finds retriever architecture, dataset and retrieval depth are the strongest factors affecting poisoning exposure, that larger retrieval depth increases the chance of retrieving a poisoned passage, and that replicating poisoned content across multiple databases amplifies adversarial influence.

Do not treat hybrid retrieval as a solved control - report its number against an ADAPTIVE adversary, not a naive one. Reduce retrieval depth rather than increasing it. Keep multiple corpora independent rather than mirroring content across them, since replication amplifies influence. Filter at index time so a poisoned document never becomes retrievable in the first place, and monitor retrieval results as a security surface, not only as a relevance surface.

The 0% figure and the 20-44% figure come from the SAME paper, which is why this is recorded as a conditional defence rather than a fix. The honest summary: hybrid retrieval is a meaningful improvement over pure vector retrieval and is bypassable by an attacker who knows about it. SCHEME RECLASSIFIED (2026-10-04): was 'measurement'.