বাংলা হাইব্রিড ইন্টেলিজেন্স · RAG সিকিউরিটি অবজারভেটরি
Bengali Hybrid Intelligence · RAG Security Observatory
বাংলা ও Banglish-কেন্দ্রিক Hybrid Intelligence, RAG এবং persistent memory-এর নিরাপত্তা গবেষণার একটি স্বাধীন, দীর্ঘমেয়াদি ও versioned research asset। বর্তমান প্রধান গবেষণা ফোকাস: Memory Poisoning & Memory Security। সাথে RAG Vulnerability Shield ও Predictive Security (EWLT/PCDR) গবেষণা কাঠামো।
An independent, long-term, versioned research asset focused on the security of Bengali and Banglish-centric Hybrid Intelligence, RAG, and persistent memory. Current primary research focus: Memory Poisoning & Memory Security. Accompanied by the RAG Vulnerability Shield and Predictive Security (EWLT/PCDR) framework.
গবেষণার উদ্দেশ্য
Research Objectives
সমস্যা
Problem
RAG ও memory-enabled AI-তে ভুল / দূষিত তথ্য কীভাবে trusted context বা persistent memory-তে প্রবেশ করে, টিকে থাকে এবং পরবর্তী retrieval / response-কে প্রভাবিত করে?
How does false or poisoned information enter trusted context or persistent memory, persist there, and influence subsequent retrieval and responses in RAG and memory-enabled AI?
বর্তমান P0 — Memory Security
Current P0 — Memory Security
Provenance change · semantic drift · persistence · retrieval shift · disagreement · early-warning signal পরীক্ষা।
Testing provenance change, semantic drift, persistence, retrieval shift, disagreement, and early-warning signals.
P1 — RAG Vulnerability Shield
P1 — RAG Vulnerability Shield
Embedding inversion · query pattern analysis · steganographic exfiltration · KB poisoning · indirect prompt injection · retrieval pivot · cross-tool exfiltration।
Embedding inversion · query pattern analysis · steganographic exfiltration · KB poisoning · indirect prompt injection · retrieval pivot · cross-tool exfiltration.
P2 — Predictive Security (Hypothesis)
P2 — Predictive Security (Hypothesis)
চূড়ান্ত compromise-এর আগেই cross-stage telemetry থেকে measurable pre-compromise signal পাওয়া যায় কি না — EWLT ও PCDR দিয়ে পরিমাপ।
Whether measurable pre-compromise signals can be extracted from cross-stage telemetry before final compromise — quantified via EWLT and PCDR.
সীমানা
Scope Boundary
Prompt injection, retrieval poisoning ও অন্যান্য attack ecosystem-এ থাকবে; তবে একসাথে সব solve করার দাবি নয়। Evidence অনুযায়ী module-by-module expansion।
Prompt injection, retrieval poisoning, and other attacks remain in scope; however, no claim is made to solve everything at once. Expansion is module-by-module, driven by evidence.
গবেষণা নীতি
Research Principle
Prediction একটি hypothesis যতক্ষণ না controlled experiment, ground truth ও reproducible evidence দিয়ে validate করা হয়। Poison ঢোকানো ≠ Poison retrieve হওয়া ≠ LLM প্রভাবিত হওয়া ≠ Attack সফল হওয়া।
Prediction remains a hypothesis until validated by controlled experiments, ground truth, and reproducible evidence. Poison inserted ≠ poison retrieved ≠ LLM influenced ≠ attack successful.
মেমরি সিকিউরিটি ★ (প্রধান ফোকাস)
Memory Security ★ (Primary Focus)
থ্রেট ক্লাস (PERSIST-aligned)
Threat Classes (PERSIST-aligned)
ডিফেন্স লেয়ার
Defense Layers
Attack → Evidence Chain
Attack → Evidence Chain
Controlled attack → telemetry → indicators → memory / retrieval state change → detection → prediction hypothesis → ground truth → evidence।
Controlled attack → telemetry → indicators → memory/retrieval state change → detection → prediction hypothesis → ground truth → evidence.
যা মাপা হবে
Measured Metrics
Persistence · provenance integrity · semantic drift · retrieval shift · disagreement · time-to-detect · FP/FN · recovery effectiveness।
Persistence · provenance integrity · semantic drift · retrieval shift · disagreement · time-to-detect · FP/FN · recovery effectiveness.
RAG Vulnerability Shield
RAG Vulnerability Shield
| # | Vulnerability | Defense Direction |
|---|---|---|
| 15.1 | Embedding Inversion | Orthogonal rotation obfuscation · Recall@k preservation |
| 15.2 | Query Pattern Analysis | Query bundling with decoy queries |
| 15.3 | Steganographic Exfiltration | Signature over canonical byte representation |
| 15.4 | Knowledge Base Poisoning | Retrieval poisoning detection + provenance ranking |
| 15.5 | Indirect Prompt Injection | Transformer classifier + input minimizer + output sanitizer |
| 15.6 | Retrieval Pivot Attacks | Hybrid context selection + capability scoping |
| 15.7 | Cross-Tool Data Exfiltration | Dual tool firewalls: input minimizer + output sanitizer |
প্রেডিকটিভ সিকিউরিটি — EWLT / PCDR (Hypothesis)
Predictive Security — EWLT / PCDR (Hypothesis)
বাংলা RAG সিকিউরিটি বেঞ্চমার্ক
Bengali RAG Security Benchmark
চারটি immutable split — প্রতিটির sha256 manifest সহ। Dataset ID প্রস্তাব: bd-ragsec-2026-Q4-v1 · License target: CC-BY-4.0।
Four immutable splits — each with an sha256 manifest. Proposed Dataset ID: bd-ragsec-2026-Q4-v1 · License target: CC-BY-4.0.
RQ1–RQ4 — আনুষ্ঠানিক গবেষণা প্রশ্ন
RQ1–RQ4 — Formal Research Questions
RQ1 — আক্রমণ কার্যকারিতা
RQ1 — Attack Effectiveness
Bengali educational RAG-এ Retrieval Poisoning ও Indirect Prompt Injection পরিমাপযোগ্য হারে সফল হয় কি? Hypothesis: ASR ≥ 40%। Falsification: ASR < 10%।
Do Retrieval Poisoning and Indirect Prompt Injection succeed at measurable rates in Bengali educational RAG? Hypothesis: ASR ≥ 40%. Falsification: ASR < 10%.
RQ2 — প্রতিরক্ষা কার্যকারিতা
RQ2 — Defense Effectiveness
Combined defense ASR ≥ 50% হ্রাস করবে, FP < 10% সহ। Falsification: ASR reduction < 20% বা FP > 20%।
Combined defense reduces ASR by ≥ 50% while keeping FP < 10%. Falsification: ASR reduction < 20% or FP > 20%.
RQ3 — প্রেডিকটিভ সিগন্যাল
RQ3 — Predictive Signals
Cross-stage telemetry compromise-এর আগেই নির্ভরযোগ্য ঝুঁকি নির্দেশ করে কি? PCDR ≥ 50%, EWLT ≥ 1s। Falsification: PCDR < 20% বা EWLT < 0.2s।
Does cross-stage telemetry yield reliable risk signals before compromise? PCDR ≥ 50%, EWLT ≥ 1s. Falsification: PCDR < 20% or EWLT < 0.2s.
RQ4 — আর্কিটেকচার তুলনা
RQ4 — Architecture Comparison
Vector RAG · Hybrid RAG · GraphRAG-এর vulnerability ও defense প্রোফাইল আলাদা কি? p < 0.05।
Do Vector RAG, Hybrid RAG, and GraphRAG have different vulnerability and defense profiles? p < 0.05.
থ্রেট মডেল
Threat Model
| ID | Category | Threat | Likelihood | Impact | Mitigation Direction |
|---|---|---|---|---|---|
| T-28 | Memory | Sleeper memory poisoning | Medium | Critical | 4-stage write screen + consensus |
| T-29 | Memory | Cooperative stealthy injection | Medium | High | Behavioral shadow + fragmentation detector |
| T-30 | Memory | Tool hijacking via memory | Medium | High | Dual-memory lessons + tool call integrity |
| T-31 | RAG | Embedding inversion | Medium | High | Orthogonal rotation obfuscation |
| T-32 | RAG | Steganographic exfiltration | Medium | Critical | Canonical-byte signature verification |
| T-33 | RAG | Indirect prompt injection | High | Critical | Classifier + input minimizer + output sanitizer |
| T-34 | RAG | Knowledge base poisoning | Medium | High | 4-stage screen + provenance ranking |
| T-35 | Health | Correct-but-stuck agent | High | Medium | Idle watchdog + integrity monitoring |
| T-36 | Health | False readiness | Medium | High | Truthful readiness from real subsystem state |
DNS Zone ও Host Boundary
DNS Zone & Host Boundary
প্রমাণ ও পুনরুৎপাদনযোগ্যতা
Evidence & Reproducibility
Experiment ID
Experiment ID
প্রতিটি পরীক্ষার unique ID, version, configuration এবং timestamp থাকবে।
Each experiment carries a unique ID, version, configuration, and timestamp.
Ground Truth
Ground Truth
Clean control বনাম poisoned / control cases আলাদা রাখা হবে।
Clean control cases are kept strictly separate from poisoned/control cases.
Provenance
Provenance
Dataset / document source, transformation, approval এবং memory lineage traceable থাকবে।
Dataset/document source, transformation, approval, and memory lineage remain traceable.
Evidence Bundle
Evidence Bundle
Experiment ID + Git SHA + Dataset Hash + Config + Retrieval Trace + Telemetry + Response + Metrics + Evidence Hash।
Experiment ID + Git SHA + Dataset Hash + Config + Retrieval Trace + Telemetry + Response + Metrics + Evidence Hash.
Claim Gate
Claim Gate
Evidence ছাড়া “proven”, “predictive” বা “secure” দাবি করা হবে না।
No claim of “proven”, “predictive”, or “secure” is made without evidence.
Immutable History
Immutable History
Historical evidence silently overwrite করা হবে না; versioned correction log রাখা হবে।
Historical evidence is never silently overwritten; a versioned correction log is maintained.
ডাউনলোড
Downloads
প্রজেক্ট ডকুমেন্ট, রিপোর্ট এবং ডেটাসেট ডাউনলোড করুন।
Download project documents, reports, and datasets.
নোট: উপরের PDF ফাইলগুলো পরে /var/www/html/downloads/ ফোল্ডারে রাখা যাবে। এখন পর্যন্ত শুধু Live PDF (Print) কার্যকর।
Note: PDF files can be placed in /var/www/html/downloads/ later. Currently, only Live PDF (Print) is functional.
সুপারভাইজার ভিউ
Supervisor View
Actual progress values populate after controlled experiments. কোনো fabricated সংখ্যা নেই।
Actual progress values populate after controlled experiments. No fabricated numbers.
FAQ — দ্রুত উত্তর
FAQ — Quick Answers
ShorbornoAI কি কোনো cybersecurity company?
Is ShorbornoAI a cybersecurity company?
না — ShorbornoAI একটি স্বাধীন Bengali AI-security academic / research initiative।
No — ShorbornoAI is an independent Bengali AI-security academic/research initiative.
Novelty কোথায়?
Where is the novelty?
Bengali / Banglish RAG ও persistent memory-এর security behavior, বিশেষত memory poisoning, persistence / drift, provenance এবং evidence-based early-warning evaluation। “প্রথম” বা “proven” দাবি evidence ছাড়া নয়।
The security behavior of Bengali/Banglish RAG and persistent memory — particularly memory poisoning, persistence/drift, provenance, and evidence-based early-warning evaluation. No claim of “first” or “proven” without evidence.
Predictive RAG Security প্রমাণিত?
Is Predictive RAG Security proven?
না। এটি একটি পরীক্ষাযোগ্য hypothesis।
No. It is a testable hypothesis.
Attack Lab কি পাবলিক?
Is the Attack Lab public?
না। Public Portal ≠ Private Attack Lab।
No. Public Portal ≠ Private Attack Lab.
Predictive Security কাজ না করলে কী হবে?
What if Predictive Security does not work?
সেটিও বৈজ্ঞানিক ফলাফল — early signal অবিশ্বস্ত হলে, FP বেশি হলে, বা warning দেরি হলে সেটিও প্রকাশ করা হবে।
That is also a scientific result. If early signals prove unreliable, FP rates too high, or warnings arrive too late, that outcome will be published as well.
মাস্টার সিস্টেম আর্কিটেকচার
Master System Architecture
User → Hybrid Emulator → Local/Remote Model → RAG → Memory → Independent Security Sandbox। প্রতিটি component থেকে telemetry আলাদা sandbox-এ যায় — research subject এবং defense আলাদা trust boundary-তে।
User → Hybrid Emulator → Local/Remote Model → RAG → Memory → Independent Security Sandbox. Telemetry from every component flows into a separate sandbox — the research subject and defense live in distinct trust boundaries.
মেমরি পয়জনিং আক্রমণ চেইন
Memory Poisoning Attack Chain
Controlled attack → memory write → persistence → retrieval shift → answer change → ground truth comparison → evidence। প্রতিটি ধাপ আলাদাভাবে পরিমাপ করা হবে।
Controlled attack → memory write → persistence → retrieval shift → answer change → ground truth comparison → evidence. Each stage is measured independently.
প্রেডিকটিভ সিকিউরিটি ফ্লো — hypothesis → validate/reject
Predictive Security Flow — hypothesis → validate/reject
শেষের VALIDATE / REJECT গুরুত্বপূর্ণ — এটি প্রমাণ করে “Predictive” marketing claim নয়, বরং একটি পরীক্ষাযোগ্য hypothesis।
The final VALIDATE / REJECT is critical — it shows that “Predictive” is a testable hypothesis, not a marketing claim.
Trust Boundary — Research Subject বনাম Independent Sandbox
Trust Boundary — Research Subject vs Independent Sandbox
তিনটি আলাদা trust zone: Public Research UI, Private Research Sandbox (VPN-only), এবং Data/Evidence Store (isolated, no egress)।
Three distinct trust zones: Public Research UI, Private Research Sandbox (VPN-only), and Data/Evidence Store (isolated, no egress).
নলেজ / মেমরি লাইফসাইকল
Knowledge / Memory Lifecycle
Experiment / Evidence Pipeline
Experiment / Evidence Pipeline
Research Scope Matrix
Research Scope Matrix
| এখন গবেষণা করছি | In Scope Now | পরের ধাপ | Next Phase | Out of Scope | Out of Scope |
|---|---|---|---|---|---|
| Memory Poisoning (P0) | RAG Attack Extension | Full agent autonomy | |||
| Retrieval Poisoning | GraphRAG vulnerabilities | Model-level fine-tuning attacks | |||
| Indirect Prompt Injection | Multimodal poisoning | Hardware/firmware exploitation | |||
| Predictive (EWLT/PCDR) | Cross-architecture comparison | Production deployment hardening |
থ্রেট ম্যাপ — Memory ★ primary
Threat Map — Memory ★ primary
Memory Attacks ★ PRIMARY
Memory Attacks ★ PRIMARY
Sleeper poisoning · Cooperative injection · Tool hijacking · Fragmentation · Retrieval injection · State corruption
RAG Attacks
RAG Attacks
Embedding inversion · Query pattern analysis · Steganographic exfiltration · KB poisoning · Indirect prompt injection · Retrieval pivot
Health / Observability
Health / Observability
Correct-but-stuck agent · False readiness · Telemetry tampering · False health injection