Fields the Filter Trusts

## The claim a filter appears to make A retrieval query in a RAG application usually does two things: it narrows a candidate set with a predicate over metadata, then it ranks what survives by vector similarity. The narrowing step reads structured fields sitting beside each chunk in the index payload - a status token, an effective date, a document type, an equipment model. Because those fields look like database columns, they carry an unearned air of authority: a reader assumes something checked them. Nothing checked them. The index payload is populated at ingest, and a very common ingest design parses those fields out of the artefact itself - YAML or key-value front matter at the top of the file, embedded document properties, a header table, sometimes the filename. The value in the index is a copy of a value in the document. ## Two provenances, and only one of them resists an author The useful discipline is to trace every field the predicate reads back to the moment it entered the payload. | Field the predicate reads | Who put the value there | | --- | --- | | status parsed from the file's front matter | whoever submitted the file | | effective date declared inside the document | whoever submitted the file | | equipment model declared inside the document | whoever submitted the file | | receipt timestamp stamped by the ingest stage | the pipeline | | submitting account recorded by the portal | the portal's authentication, not the file | | a scope derived from the caller at query time | the session | Everything in the first group is authored by the same person who authored the passage. A predicate over those fields is not a check on the document; it is a restatement of what the document says about itself. ## The bulletin case Consider an assistant that answers technicians' questions from equipment service bulletins, where suppliers submit bulletins through a portal and the pipeline copies their front matter into the index. The application narrows to bulletins whose status is current, whose effective date falls in a window, and whose equipment model matches the unit the technician named. That predicate exists to keep obsolete guidance out of the answer, and for honest traffic it does exactly that. A planted bulletin fills the same fields in. It declares itself current, dates itself inside the window, and names the model the technician will ask about. It is eligible by construction, because eligibility was defined by fields it wrote. ## The filter does the attacker's sorting The second-order effect is the part candidates miss. Narrowing removes candidates, and the plant is never one of the removed. Real corpora are untidy: legitimate bulletins have blank status fields, dates in a different format, model strings written three ways. Those are the documents the predicate drops. The plant's metadata is complete and exactly conformant, because it was written to satisfy a predicate rather than to describe a document. So the narrowed result set is smaller, cleaner, and contains proportionally more of the planted content than the unnarrowed one did - and a technician reading three results instead of fifty tends to read the shortness as vetting. ## Direction of the claim Be precise about what each artefact proves. A status field records what its author wrote in that field, not that anyone approved anything. A declared effective date records what its author typed, not that the guidance is in force. Passing the predicate proves a passage carried conformant values, not that it is correct, current or from the party it claims. Getting these backwards is the misconception the whole topic exists to correct. ## Where the construction stops working It stops exactly where authorship stops. A value the ingest stage assigns at receipt is out of the submitter's pen, although they still choose when to submit. A value derived from the caller's session at query time is out of reach entirely - the person writing a document cannot influence a field that is computed from whoever is asking. That asymmetry, not the act of narrowing, is what separates a predicate that resists a document author from one that serves them. ## What this is not It is not an argument about how filtering is implemented - whether the predicate is applied before or after the vector search, and what that does to recall, is a retrieval-engineering question with its own answers. It is also not about the model being tricked: no instruction has been obeyed here and no refusal has been bypassed. The retrieval stage has simply been asked to sort on data the adversary supplied.