Veridion

Note: This analysis is based entirely on the self-reported project description provided by the caller. No external verification, revenue data, customer names, or traction evidence are available.

The description states that Veridion is a gate that sits in front of a RAG corpus and evaluates documents before ingestion using three independent signals:

• Signal A (Embedding-space anomaly): Uses an Isolation Forest to detect statistical outliers in document embeddings.
• Signal B (Instruction-injection classification): Detects phrasing or obfuscation patterns directed at the model rather than human readers.
• Signal C (Retrieval-influence measurement): Measures how much a document changes system behavior when retrieved and generated, using a fixed set of probe queries.

Documents are scored as ADMIT, QUARANTINE, or REJECT based on a weighted sum of these signals. The system is designed to run offline and includes integrity checks via SHA-256 and Ed25519 signing.

Inference: The product appears to be a prototype built for demonstration in a hackathon setting, not a production-grade SaaS offering.

The description positions Veridion as a solution to an emerging AI security risk — RAG poisoning — which the authors claim is distinct from prompt injection and more dangerous because it persists in the knowledge base. They argue that existing defenses operate too late in the pipeline (after generation), while Veridion operates before ingestion.

They also emphasize:

• That pattern-based detection fails against influence-only attacks.
• That Signal C is the most robust signal due to its design principle of measuring effect rather than wording.
• That the system is built for offline use, with no API dependencies.

Claim: Veridion addresses a critical gap in RAG security by detecting poisoning at ingestion time using influence measurement.

The description does not name specific customers or personas. However, it implies that the target audience includes:

• Organizations deploying RAG systems.
• Developers or security teams managing knowledge bases for AI assistants.
• Entities concerned with AI safety and integrity in LLM applications.

Inference: The product is likely aimed at enterprises or developers using RAG-based AI assistants who want to mitigate risks from untrusted data sources.

No evidence of pricing, monetization strategy, or business model is provided. The project is described as a hackathon submission with no indication of commercial intent or revenue streams.

Not evidenced

The system is built using:

• Python 3.11
• sentence-transformers (all-MiniLM-L6-v2)
• FAISS for vector storage
• scikit-learn IsolationForest
• Ollama (Phi-3 mini, int4) for local LLM inference
• FastAPI for API layer
• Streamlit for dashboard

It supports both local and OpenAI-compatible endpoints through an abstract interface. The architecture is modular, with no direct dependencies between signal modules and core components.

Inference: The system is designed to be portable and adaptable across different RAG implementations.

There is no evidence of traction, customers, or adoption beyond the hackathon submission. No revenue, ARR, headcount, or user data are mentioned.

Not evidenced

The description does not mention competitors or existing solutions in the RAG security space. It positions itself as addressing a gap where "dedicated pre-ingestion detection remains largely unbuilt."

Inference: The competitive landscape for RAG poisoning detection is unclear, but this may be an emerging niche with limited prior offerings.

• Limited testing scope: Evaluated only on 60 documents (40 clean, 20 poisoned) across four attack families.
• Coverage limitation: Signal C depends on a fixed probe set; real-world effectiveness is unknown without query log-based probes.
• No production-grade performance data: The demo was built for a hackathon and may not scale to enterprise needs.
• Offline-first design implies limited integration capabilities in environments requiring cloud or API access.
• Signal C’s reliance on influence measurement may be computationally expensive, even with optimizations.

Inference: While the approach is conceptually sound, lack of real-world deployment data raises concerns about scalability and robustness.

1. What are the actual performance metrics (precision/recall) on larger, more diverse datasets?
2. How does Signal C scale with corpus size and number of documents?
3. Can the system be integrated into existing RAG pipelines without significant architectural changes?
4. Are there plans to support real-time query log-based probe generation?
5. What is the expected latency for screening large batches of documents?
6. How is the system tested against adversarial inputs beyond those in the evaluation set?