Why is a planted passage that ranks first usually the least strange-looking text in an index?

## The expectation this corrects Ask a competent senior engineer how they would find poisoned passages in a knowledge base and the usual answer is some version of *we would see obviously adversarial text* — hidden directives, strange character runs, a paragraph that reads nothing like the rest of the corpus. It is a reasonable intuition and it is backwards. On the retrieval path, the passage most likely to end up in the model's context is the one that reads best. ## Why clarity is what ranks A first-stage retriever scores a passage on how near it sits to the query — by vector distance, and where a lexical signal is in the path, by shared terms. Both reward the same properties: - **The question's own words, in the answerer's vocabulary.** A passage that restates the anticipated question using the terms the vendor's documentation uses is close to that query on both axes. This is exactly what a good reference entry does anyway. - **Topical concentration.** One question, one answer, no digressions. A passage about a single thing has an embedding that points squarely at that thing; a passage that wanders is diluted. - **Self-containment.** The retrieved chunk is read alone, without its neighbours, so a passage that answers completely in its own span scores and reads better than one that depends on the page around it. Now look at what the intuitive 'adversarial' markers do to those properties. Repeated keyword runs read as spam to a human and are worth little to a dense scorer, which is not a term-frequency counter. Garbled or invisible character runs change the tokens the encoder sees and generally move the passage *away* from a clean query, not toward it. A directive bolted onto the end of an otherwise on-topic paragraph adds text that does not match the question and dilutes the vector. Every instinctive marker of tampering is, on this path, a handicap. ## The shape of the winning passage So the passage that displaces the incumbent is a clear, direct, on-topic answer to a question somebody was going to ask, written in the vocabulary of the documentation it is competing with. On a public community forum next to a vendor's own docs, that is indistinguishable from a genuinely helpful post — because in form it *is* one. Its author needed: 1. the anticipated question, roughly as a user would phrase it; 2. the vocabulary the vendor's own material uses for that subject; 3. the discipline to write one tight, complete answer rather than a wall of terms. None of those is an exploit. There is no defect anywhere in the chain — this is the retriever working exactly as designed. ## What this does to a sweep for anomalies An inspection that looks for text that *looks wrong* is, by construction, selecting on a property the winning passage does not have. It will surface the low-effort plants — the keyword-stuffed page, the paragraph with a garbled run in it — which are also the plants least likely to be retrieved for anything. The passages sitting at the top of real result sets pass, because there is nothing to flag. That asymmetry is the whole point: **the sweep's hit rate is highest exactly where the ranking payoff is lowest.** This is also why 'nothing has ever been flagged in our corpus' is a claim with almost no content. It reports what a filter did not match, not what is in the index. ## What it costs, and where it stops working The cost has moved from evasion to authorship, and that changes the economics in both directions. **Cheaper:** no obfuscation to maintain, nothing that breaks when a normaliser is added to the pipeline, nothing a byte-level check can key on. The passage survives being read. **More expensive:** you must know the subject well enough to write in its vocabulary, and you must anticipate the question. The win is per-question — a passage written for one query is unremarkable for the next one. And it is competitive rather than absolute: the vendor can publish a better page for that question tomorrow and take the position back without anyone realising a contest happened. ## The payoff, before any claim is made One more thing an interviewer listens for: the passage does not have to contain a falsehood to be worth planting. Winning the query means the grounding set holds the attacker's text and not the official text — control of the context comes first, and what the passage then says is a separate decision. Displacement alone is the achievement, and it is invisible in exactly the place people look for it.