Your Vector Database Is Leaking More Than You Think
Embedding stores were deployed fast and secured late. Inversion attacks, over-broad retrieval scopes and missing tenant isolation are turning RAG pipelines into data-disclosure engines.
Every retrieval-augmented generation deployment makes the same quiet bargain: to make the model useful, you concentrate your most valuable documents into a single, searchable embedding store. Security teams are now discovering what that bargain costs when the store was configured for demo speed rather than production rigour.
Three failure modes dominate this year's incident reports. First, tenant isolation that exists in the application layer but not in the index — one customer's query retrieving another's chunks because metadata filters were applied after retrieval, not during. Second, embeddings treated as 'not really data': logged, cached, replicated to analytics pipelines, and backed up without the access controls applied to the source documents. Third, inversion research maturing from academic curiosity to practical attack.
Embeddings are not anonymous
The comforting assumption was that a vector of floating-point numbers reveals nothing about the source text. That assumption is dead. Published inversion techniques now recover substantial portions of original documents from their embeddings, and the results improve every quarter. If your embeddings would embarrass you as plaintext, they will embarrass you as vectors.
The scope problem
RAG systems retrieve by semantic similarity, not by need-to-know. A sales engineer asking about a product roadmap can pull chunks from board minutes if the embeddings are close enough and the access controls are loose enough. Similarity is not authorisation — but in too many deployments it is the only filter that exists.
- Enforce access control at index-build time: separate indexes or namespaces per trust boundary, not filters after the fact.
- Classify embedding stores with the same sensitivity as the source data — including backups, replicas and logs.
- Audit what your retrieval layer *can* return, not what it usually returns. Red-team it with cross-tenant queries.
- Encrypt embeddings at rest and treat any export as a data event worth logging.
The vector database is the most concentrated collection of your organisation's knowledge ever assembled. It deserves the paranoia that implies.
None of this argues against RAG — it argues for growing up. The teams getting this right treat the embedding pipeline as a data product with owners, classification and lifecycle, not as plumbing behind a chatbot.
