An ingestion pipeline splits wiki pages into overlapping chunks. Why does overlap lower the precision an attacker needs at a split point?
answer
- the cut is invisible and it drifts
- overlap duplicates, it does not reconcile
- two framings, two vectors, two chances
- precision problem becomes a coverage problem
- re-index and the boundary is gone
basics
~20 sOverlap duplicates text across adjacent units instead of reconciling it. A paragraph near a boundary is emitted both with its framing sentence and without it, and both units are embedded and separately retrievable, so a coarse aim suffices.
solid answer
~50 sThe attacker's hard problem is that the cuts are invisible and unstable — they move whenever text above the paragraph is edited and the page is re-indexed. Without overlap, a paragraph is emitted exactly once, either carrying its framing sentence or not, so the split has to be landed. With overlap, adjacent chunks share a region: a paragraph sitting near a boundary appears in more than one emitted unit, typically one that begins before the qualifier and one that begins after it. Both are embedded and both are retrievable, and first-stage similarity search picks by vector distance, not by which framing is fairer. The pipeline has manufactured the isolated reading as one of its own units, so approximate placement is enough. The construction still has a shelf life: churn above the paragraph moves every cut below it.
go deeper
Know that overlapping chunks share text, so the same sentences can appear in more than one stored unit. That is the fact the rest of the reasoning is built on.
Explain that each emitted unit is embedded and retrieved independently, so two overlapping units are two separate candidates rather than two views of one candidate.
Show operational judgment: describe how boundary drift after edits gives this a shelf life, and why the resulting findings reproduce intermittently rather than reliably.
Be prepared to say what an intermittently reproducing finding of this shape can and cannot be asserted about a corpus, and how you would word that in a report somebody signs.
## The attacker's real problem is aim, not authorship Writing a paragraph that reads two ways is the easy half. The hard half is that the isolating cut is set by an ingestion configuration nobody outside the team can see, and it is not stable: adding or deleting a sentence higher up the page shifts every boundary below it at the next re-index. Treat that as an aiming problem with an unknown offset that drifts. ## What overlap does to that problem Overlap means consecutive chunks share a region of text — the tail of one is also the head of the next. Its builder-side rationale is not the subject here; what matters from the other side is the emitted shape. Where a non-overlapping split emits each sentence exactly once, an overlapping split emits text near a boundary more than once, in units that begin at different points. Concretely, a paragraph sitting close to a boundary can be emitted twice: in a unit that starts before its scoping sentence, so the frame travels with it, and in a unit that starts after that sentence, so it does not. Both units are embedded independently and both live in the index as separately retrievable items. Retrieval then does what it always does — it ranks candidates by vector distance to the query and returns the top ones. It has no notion that one candidate is a fairer rendering of the source page than the other. So the effect is not that overlap protects meaning across a boundary. It is that overlap **emits both framings rather than reconciling them**, and the attacker only needed one of them to exist. Precision is replaced by coverage: land the paragraph anywhere near a boundary and the pipeline itself produces the isolated unit. ## Why this is counterintuitive Overlap is usually discussed as a robustness feature — text near a cut is not stranded. Read as a security property that intuition inverts. Redundancy here means *more distinct readings in the index*, not *one better reading*. A control that increases the number of independently retrievable framings of the same source text increases the number of framings an attacker can be selected for. A related trap: people assume the duplicate hits collapse, because deduplication is common at the result stage. Deduplicating on chunk identity does not help, since the two units are genuinely different text spans; and if a pipeline suppresses near-duplicates, it suppresses one of the two framings by a rule that is about similarity, not about which framing is faithful. ## What it still costs **Shelf life.** The construction is pinned to an index state. An unrelated edit above the paragraph plus a re-index reshuffles every boundary below, and the isolated unit may simply stop being produced. Nobody files anything; the finding evaporates. **It is not aimable, only likelier.** Overlap makes an approximate placement pay off more often. It does not tell the attacker where the cut is, and it does not guarantee the isolated unit outranks the framed one for the query that matters — both are in the index, and the framed one may win. **Observation is indirect and noisy.** The only feedback available from outside is the assistant's own answers: which portion of a page it echoes or cites suggests roughly what unit it received. That is a weak, laggy signal, and it is the reason a finding here so often reproduces once in five tries. A single reproduction shows one construction worked once against one index state — not a success rate. ## Where it stops working If the unit the model is handed is expanded back to the containing section, every emitted framing includes the frame and the second reading disappears. If the paragraph must carry its own qualifier to look unremarkable on the page, then every unit that contains the paragraph contains the qualifier too. And a re-embed of the corpus after a boundary change can end it silently. ## In an interview The answer worth giving states the inversion in one line — overlap duplicates rather than reconciles, so it converts a precision problem into a coverage problem — and then refuses to overclaim: it raises the odds, does not aim the shot, and is undone by ordinary page churn. Candidates who present it as a reliable technique have not operated an ingestion pipeline; candidates who say overlap prevents the problem have the direction backwards.
- Does overlap guarantee the isolated framing is the one retrieved?No. Both framings sit in the index as separate candidates, and first-stage search orders them by distance to the query. The framed unit can win, and a later scoring stage may reorder both. Overlap raises the odds that an isolated unit exists at all; it says nothing about which one comes back for a given question.
- A finding here reproduced once in five attempts. Is that a finding?It is a confirmed class with an unstable trigger, and it should be written that way. One reproduction shows the construction worked once against one index state and one query phrasing. Reporting it as a rate implies a stability that a drifting boundary and a sampled model do not have; reporting it as a class with the conditions that produced it is honest and still actionable.
saying these in an interview costs you the question
- Overlap prevents fragments from losing their context
- Duplicate chunks are deduplicated, so only one framing exists
- The attacker can compute where the split falls
- One successful reproduction establishes a success rate
- Re-indexing has no effect on where boundaries land