Vector and Embedding Weaknesses
Think of this as a digital filing system for an AI. If someone sneaks fake documents into the files, or if the system accidentally shows one person's private notes to another, the AI gets confused or leaks secrets. It’s like a librarian being tricked into giving out the wrong information or sharing confidential records.
These are security risks specific to RAG architectures where the vector database or embedding model is compromised. This includes data poisoning to manipulate retrieval results, cross-tenant data leakage due to improper access controls, and prompt injection attacks where malicious content retrieved from the vector store forces the LLM to behave unexpectedly or exfiltrate sensitive data.
Vector and Embedding Weaknesses encompass the attack surface of the retrieval-augmented generation (RAG) pipeline, specifically targeting the integrity and confidentiality of the vector store and embedding space. This includes adversarial poisoning of vector embeddings to induce retrieval bias, multi-tenant isolation failures leading to unauthorized data exposure, and indirect prompt injection via retrieved context, which exploits the trust boundary between the retrieval mechanism and the generative model to facilitate unauthorized data exfiltration or system manipulation.
evolution
- 2023-02 · historyEmergence of Indirect Prompt Injection
Researchers demonstrated that malicious content embedded in retrieved documents could hijack LLM instructions during RAG processes.
- 2023-09 · historyVector Database Poisoning Attacks
Studies identified that injecting adversarial data into vector stores can manipulate retrieval results to force specific model outputs.
- 2024-01 · historyFormalization of Embedding Inversion
Security research highlighted the risk of reconstructing sensitive training data or source documents from leaked vector embeddings.
- 2024-05 · historyMulti-tenant Vector Isolation Vulnerabilities
Exploits were documented showing that improper metadata filtering in shared vector databases allows cross-tenant data leakage.