Beyond Private Training: The New Landscape of AI Privacy
TSD-AUDIT reveals graph-based vector indexes like Faiss HNSW still score deleted embeddings during search, exposing process-level privacy leaks beyond output-filtering audits.
The paper formalizes output safety versus traversal safety in graph-based approximate nearest-neighbor retrieval, where deleted identifiers are filtered from results but their embeddings still get scored during graph traversal. On Faiss IndexHNSWFlat, native filtering leaves distance computations unchanged, and trace-faithful replay detected deleted-vector scoring in all 100 audited queries at a 70% deletion rate; hnswlib's mark_deleted path shows the same scoring-before-liveness pattern. TSD-AUDIT enforces an alive-before-scoring invariant, repairs connectivity using live candidates, and emits per-query scored-trace certificates, improving Recall@10 by 4.3 to 42.2 percentage points under region-targeted deletion.
- Distinguishes output safety from traversal safety in graph-based approximate nearest-neighbor retrieval.
- Trace-faithful replay detected deleted-vector scoring in all 100 audited Faiss queries.
- hnswlib's mark_deleted path exhibits the same scoring-before-liveness pattern.
- TSD-AUDIT enforces alive-before-scoring and emits independently verifiable scored-trace certificates.
- Recall@10 improves 4.3-42.2 points over native filtering under region-targeted deletion.
From the original article
1 min read at arxiv.orgRetrieval-augmented systems increasingly rely on vector indexes that may retain deleted items in their search graph. Existing deletion interfaces can prevent deleted identifiers from appearing in returned results while still computing distances to their embeddings during graph traversal.
By Sean Culatana · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.