The document-level normalization is doing a lot of the work here, because a poisoned chunk that is just shorter or more duplicate-y can look like a collapse even before it actually hijacks generation. I was a bit surprised they dont seem to separate that from the obvious length bias in Eq. 2, since attention mass over 5 docs is pretty easy to skew when two are adversarially written. In practice I’d want to see whether the entropy signal survives if the poison is length-matched and the retriever returns more than top-5, otherwise the detector may just be learning “one chunk looks unusually self-contained” rather than poisoning per se.