The InboxSync RAG Pipeline: Architectural Vulnerabilities and the Confidence Gap
Research into the InboxSync RAG pipeline identifies a critical architectural vulnerability known as the "Confidence Gap." The system, built on a Node.js/TypeScript backend using pgvector and OpenAI text-embedding-3-small, fails to validate retrieval accuracy by employing hardcoded confidence constants (e.g., 0.85) instead of computing real-time semantic similarity. This absence of relevance gating allows "semantic collisions," where adversarial or irrelevant data—such as GDPR requests or spam—is erroneously categorized as highly relevant context. Consequently, attackers can exploit the disconnect between mathematical semantic proximity and user intent through document poisoning, achieving a 100% success rate in bypassing relevance filters during adversarial testing.