What does a planted passage that survives a RAG reranking stage cost an attacker to write?

## Why the second stage changes the economics With only first-stage similarity in the path, getting retrieved is a distance problem: place a record whose embedding sits near the expected query embedding and it enters the candidate set. Once a reranking stage rescores those candidates on how well each answers the query, being *near* is only the entry fee. The plant now has to win a comparison against everything else that was retrieved — including the corpus's genuine best passage on the subject. ## The cost ledger | what the attacker must spend | why the second stage forces it | what ends the construction | | --- | --- | --- | | a guess about the question | a passage is only in the contest for queries it was written to answer | the question that actually gets asked is not the one anticipated | | writing that out-answers real content | the stage promotes the candidate that reads as the better answer | strong, well-maintained genuine coverage of that question | | plausibility to a reader | records are occasionally opened by a person, and an obviously odd one draws attention | somebody reads the record | | persistence in the corpus | the plant must still be there when the query arrives | routine pruning, expiry or re-authoring of the store | Notice what is *not* on the ledger: knowledge of a particular embedding model. Nothing about this family depends on which encoder the store uses, so rebuilding the index does not touch it. The thing that ends it is a question it was not written for, or genuine material that answers better. ## Emphasis is not relevance A common mistake is to assume a longer, more insistent, more repetitive passage ranks higher. A relevance judgement rewards directness and fit: a passage that reads as *the answer* to the query beats one that reads as an argument about the topic, and padding dilutes the fit. This is also why the surviving family reads as ordinary, competent documentation rather than anything dramatic — the property that gets it promoted is exactly the property that makes it hard to notice by skimming. ## Where it lands, and why that matters when reporting Because success is a comparison, the construction's yield is uneven across a corpus. Well-trodden questions — the ones with several strong, curated passages — are bad targets. The good targets are the edges: a rarely-asked procedure, a newly-arrived subject, an unusual phrasing of a common question, a question the corpus answers only obliquely. Those are also, awkwardly, the questions on which a reader is least able to notice that the answer is wrong, because they had no prior expectation of the answer. That unevenness has a direct consequence for anyone writing up a result. A plant that reaches the top for one phrasing and eighth for another has not failed — it has a scope. The honest statement is a query class and an observed placement rate, not "the passage ranks first". A claim of general placement collapses at the owner's first retest with a phrasing you did not try, and the argument is lost on the reproduction, not on the substance. ## The judgement being tested An interviewer asking this is checking whether a candidate treats retrieval as a single trick or as a pipeline with different currencies at each step. The first stage buys presence in the candidate set; the second stage buys placement, and it is paid for in writing quality and prediction rather than in vector geometry. Someone who can name what that costs — and can point at the corpus regions where the cost is affordable — has understood the stage better than someone who only knows that fluent text survives it.