Vector & embedding security testing

How it works

Retrieval evaluation asks whether the right passages come back; this method asks whether the storage layer underneath is safe to hold what it holds. Embedding-inversion attacks reconstruct meaningful fragments of the original text from its vector alone, which matters wherever the embedded content is private. Access-control testing checks whether a multi-tenant vector store actually isolates rows by tenant or namespace, rather than relying on the application layer to always filter correctly. Ingestion testing checks whether an attacker-crafted document, once embedded, can be pulled back by an unrelated query and trusted as if it were legitimate context — the storage-side half of a poisoning or indirect-injection attack. Stale-embedding testing checks that deleting a source document actually removes what was derived from it.

When to use it

Any RAG system storing embeddings from private or multi-tenant sources; before allowing externally sourced documents into an index that any user's queries can reach.

Limitations

Embedding-inversion resistance depends heavily on the embedding model and dimensionality, so results don't transfer across models. Access-control checks only cover the isolation boundaries tested, not every possible tenancy misconfiguration.

Cite this