Research

Research seriesL3offensive security

Embedding and Retrieval Security: When the Vector Store Leaks and Lies

Embeddings are treated as opaque numbers, but they are near-invertible and attacker-manipulable, and the retrieval layer is both a confidentiality leak and an injection vector. This threat lab measures text-embedding inversion, nearest-neighbor and cross-tenant leakage, retrieval corruption by neighborhood poisoning, and approximate-index abuse for denial and eviction — each paired with a hardening. Grounded in the primary embedding-inversion and vector-index literature.

Murali Chillakuru·5 articles
  1. 1
    Embeddings Are Not Anonymized: Text-Embedding Inversion and How Much a Vector Reveals

    A text embedding looks like an opaque list of numbers, but a learned inversion model reconstructs much of the original text from it — so a vector is as sensitive as the text it encodes.

  2. 2
    Cross-Tenant and Neighbor Leakage: The Similarity Oracle and Multi-Tenant Isolation Failures

    A nearest-neighbor search answers 'how close is this to what you have' — and that single, repeatable measurement lets an attacker reconstruct a corpus or read across tenant boundaries.

  3. 3
    Retrieval Corruption: The Geometry of Poisoning a Neighborhood to Dominate a Query

    An attacker who can add one document to a retrieval corpus can craft it to sit closest to a target query in embedding space — guaranteeing it is retrieved and its content reaches the model.

  4. 4
    Index-Level Attacks: Exploiting Approximate-Index Knobs for Denial and Eviction

    Approximate nearest-neighbor indexes trade exactness for speed; an attacker who understands the knobs can quietly deny recall, evict rivals, and inflate cost.

  5. 5
    Hardening Retrieval: Per-Tenant Indexes, Embedding-Space Access Control, and Provenance

    A defensive blueprint that treats the vector store as a security boundary: isolate tenants, put access control in embedding space, and carry provenance end to end.