Index-Level Adversarial Memorization — When Retrieval Encodes Wrong Entity-Context Bindings
A false association does not have to be learned during pretraining. It can be preserved and amplified by the retrieval index itself. A multilingual case study across 1,535 CN/RU/EN articles, where detection filters catch at most 21% and evidence-grounded rewriting removes 83%. Accepted at NLPCC 2026 (main track).
// DESCRIPTION
Accepted at NLPCC 2026 (main track). A workshop precursor — Adversarial Memorization in Retrieval Systems — appeared at MemFM/AI4Law.
The failure mode
Retrieval-augmented models can surface false associations when their indexes are built from polluted multilingual corpora. The usual framing blames pretraining. This work studies the case where the binding was never learned by the model at all: it lives in the index, which preserves and amplifies it. Fixing the model does not fix this.
Measurements
24 verified pollution cases drawn from 1,535 CN/RU/EN news articles about three game developers. Injecting them into the index drives:
- BM25 Pollution@10 = 1.00 [95% CI 0.94–1.00] for Chinese
- mE5-large 0.90; BGE-M3 0.52
- A cross-lingual leak under BGE-M3: English PS = 0.25, against a BM25 baseline of 0.00
Detection barely works; rewriting does
NLI, LLM-judge, LoRA and credibility filters catch only 8.3%–20.8% of polluted articles. An evidence-grounded rewriting prototype removes 83.3% (p < 10⁻⁵ against the best filter); after re-indexing, Chinese BM25 PS@10 falls 1.00 → 0.00 and BGE-M3 0.52 → 0.05.
A methodological caution
A manual audit returned Cohen's κ = 0.14 against the automatic labels, showing that keyword-trigger classifiers can overcount cross-domain pollution by up to 17×. The headline number in this area depends heavily on who is counting.
// HIGHLIGHTS
- NLPCC 2026 main track — accepted
- Index-level adversarial memorization: the binding is in the index, not the weights
- Chinese BM25 Pollution@10 reaches 1.00 on an injected index
- Detection filters catch 8.3–20.8%; evidence-grounded rewriting removes 83.3%
- Manual audit (κ = 0.14) shows keyword classifiers overcount by up to 17×