Banana Navy
Catalog FR
Lab · AI threat modeling · Detailed card

Vector and embedding weaknesses

exploiting vector geometry and access to reconstruct or exfiltrate content from another scope.

SheetF23
CategoryI-TB7-01 (vector layer)
Layers14 · LLM Interpretation, 20 · Model & Supply Chain
SystemAI voicebot

similarity is access: control vector geometry, not just documents.

The threat

weaknesses of the RAG vector storage and retrieval layer: embedding inversion (recovering part of the source text from a vector), semantic collisions (distinct contents sharing a neighborhood), similarity leakage (a neighboring query returns content from another scope), partition bypass through close queries (probing the neighborhood to exfiltrate from a supposedly isolated index).

Blind spotWhy classic frameworks miss it

a vector index is a database of similar objects, not a per-document ACL store: similarity IS access. Classic grids audit document-level read permissions, never what a neighbor query reveals nor how reversible embeddings are.

MitigationProposed approach

access control on the vector store and embedding endpoints (caller identity on every query), physical/logical per-tenant isolation, similarity thresholds plus membership check before returning results, inversion tests (assess reversibility of sensitive embeddings), monitoring of neighborhood probing, do not index sensitive data in reversible embeddings.

The proposed control
a vector lets you neither reconstruct nor retrieve data outside its scope.

Expected evidence
intra and inter-tenant inversion and neighbor-query tests; no proven leak.

SourcesReferences and public research

OWASP GenAIOWASP GenAI LLM08:2025 Vector and Embedding Weaknesses
Public researchEmbedding inversion: Morris et al. (arXiv 2305.03010), arXiv 2504.16609, arXiv 2401.12192 ; RAG membership inference : arXiv 2502.00306 ; retrieval-stage defenses : arXiv 2512.24268. The OWASP LLM08 page explicitly cites the first two.
layer 14 · LLM Interpretationlayer 20 · Model & Supply Chain

Explore the 20 security layers

MITRE ATLAS 2026.07 · OWASP GenAI · risk-voicebot