Research seriesL3offensive security
Embeddings are treated as opaque numbers, but they are near-invertible and attacker-manipulable, and the retrieval layer is both a confidentiality leak and an injection vector. This threat lab measures text-embedding inversion, nearest-neighbor and cross-tenant leakage, retrieval corruption by neighborhood poisoning, and approximate-index abuse for denial and eviction — each paired with a hardening. Grounded in the primary embedding-inversion and vector-index literature.
A text embedding looks like an opaque list of numbers, but a learned inversion model reconstructs much of the original text from it — so a vector is as sensitive as the text it encodes.
A nearest-neighbor search answers 'how close is this to what you have' — and that single, repeatable measurement lets an attacker reconstruct a corpus or read across tenant boundaries.
An attacker who can add one document to a retrieval corpus can craft it to sit closest to a target query in embedding space — guaranteeing it is retrieved and its content reaches the model.
Approximate nearest-neighbor indexes trade exactness for speed; an attacker who understands the knobs can quietly deny recall, evict rivals, and inflate cost.
A defensive blueprint that treats the vector store as a security boundary: isolate tenants, put access control in embedding space, and carry provenance end to end.