Amine Raji argues that similarity scores in a vector database say nothing about truth or authority. He shows how a few crafted documents can crowd out a legitimate one in retrieval. Three fabricated finance documents beat the real figure in his lab pipeline. Framing, not retrieval tricks, often does the damage. He adds two ingestion-time checks that flag documents too close to existing content or to each other. In his lab that cut attack success sharply. He also urges metadata filters so retrieval respects each user's permissions. Twenty of twenty test queries returned restricted content without them. Published work on embedding inversion shows stored vectors can be turned back into readable text. He recommends reclassifying a vector store breach as a partial document leak.
What changed
Stored embedding vectors were widely assumed to be one-way and treated as low-severity metadata.
What it unlocks
Flagging coordinated document injection at ingestion, and scoping vector queries to a user's clearances.
- 5 poisoned docs in 2.6M corpus
- 95% to 20% attack success with check
- 92% of 32-token inputs recovered
- ~1,000 pairs for inversion setup
What you need to act on it
- access to the vector database ingestion and retrieval code
- a baselined similarity distribution per embedding model
Sources