Geometric RAG access control isolates policies but not embeddings
Original title: Isolation Is Not Confidentiality: Security Boundaries of Geometric Access Control in RAG
A curious user can recover original embeddings from a few hundred pairs and forge policy-compatible queries.
A security analysis of search-preserving geometric access control for RAG vector databases finds that the transformations keep retrieval utility and strongly isolate policies. They do not provide representation confidentiality, query-forgery resistance, or policy-membership hiding. Tests of available implementations across three encoders show a user with aligned embedding pairs can recover originals and forge queries, while policy-dependent geometry can leak membership.
Unconfirmed: The paper evaluates available implementations of prior geometric mechanisms, not a named production RAG deployment.
- Threats include a curious cloud provider and a curious user with aligned pairs.
- Recovery uses a few hundred original and protected embedding pairs.
- Forgery cost grows with encoder dimension for secret per-policy transformations.
- Unauthorized retrieval can still be prevented while membership leaks.
From the original article
1 min read at arxiv.orgRetrieval-Augmented Generation (RAG) systems increasingly rely on vector databases containing documents governed by different access-control policies. Recent search-preserving geometric approaches enforce such access control by structuring the embedding space so that transformed embeddings, which we call protected representations, remain retrievable without exposing information across policy boundaries.
By Steve Nouyep · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.