What Survives the Filter Is Not What Hijacks the Model: Why Candidate Exposure Fails to Preserve Behavioral Ordering in RAG

Retrieval-augmented generation (RAG) systems use external documents to support language model responses. Retrieval filters aim to prevent malicious documents from reaching the model. However, security evaluations often use candidate exposure, whether an injected document survives filtering, as a measure of attack success. This raises an important question: Does a document surviving the filter mean that it can successfully influence the model? We investigate this question using 300 SciFact queries and a fixed-context replay design. We measure exposure rate (ER), survivor compliance (SC), and behavioral attack success (BAS) to examine the relationship between filter survival and downstream model behavior. Our results show that candidate exposure does not reliably reflect behavioral attack success. Under a fine-tuned DistilBERT filter, attack A3 achieves higher exposure than A4 (0.9867 versus 0.6767), yet produces lower behavioral attack success across all three tested models. We also find substantial differences in behavioral success between attacks with identical exposure. Across detector operating points, exposure and behavioral success show weak rank correlation on Qwen and Phi models. These findings show that candidate exposure alone is insufficient to evaluate retrieval-filter effectiveness. We recommend reporting exposure, survivor compliance, and behavioral attack success together, and validating intermediate security metrics against downstream model behavior.