Vector Store Contamination

The direct insertion of malicious vector embeddings into a vector database to manipulate nearest neighbor search results. Attackers craft embeddings that are mathematically close to legitimate query vectors, ensuring their payloads are retrieved for specific semantic triggers.

• Mechanism: Attacker gains write access to the vector store and inserts vectors with high cosine similarity to target query clusters.
• Impact: Legitimate user queries return attacker-controlled documents as top-k results.
• Example: Injecting an embedding for a malicious 'API documentation' page that gets retrieved whenever an agent queries 'how to authenticate.'

The corruption of Approximate Nearest Neighbor (ANN) index structures such as HNSW or FAISS graphs. By inserting strategically placed nodes, attackers alter graph navigation paths so that queries traverse through adversarial regions of the embedding space.

• HNSW Attack: Inserting nodes that create 'shortcuts' from legitimate query entry points to malicious document clusters.
• FAISS IVF Attack: Contaminating inverted file centroids so that queries are assigned to buckets containing adversarial documents.
• Detection Difficulty: The index structure itself appears valid; only retrieval behavior reveals the compromise.

An attack targeting the Hypothetical Document Embedding (HyDE) retrieval technique. The attacker crafts a query that causes the LLM to generate a hallucinated document embedding which is mathematically closer to malicious vectors than to legitimate content.

• How it works: The LLM generates a hypothetical ideal document from the query; this synthetic embedding is used for retrieval.
• Exploit: Crafted queries induce hallucinated embeddings that align with attacker-planted vectors.
• Result: The agent retrieves and grounds its response in adversarial content, believing it matched its own generated hypothesis.

The falsification of document metadata fields—such as source, date, author, or trust score—to deceive retrieval pipelines into prioritizing attacker-controlled chunks. Agents often use metadata as a relevance or authority signal during re-ranking.

• Source Impersonation: Tagging malicious documents as originating from trusted internal wikis or official documentation.
• Temporal Exploitation: Setting dates to 'most recent' to exploit freshness-biased retrieval.
• Trust Score Manipulation: Inflating authority scores in systems that use metadata-weighted retrieval.

A technique that exploits document chunking strategies by placing malicious content precisely at chunk boundaries. When the chunker splits text, the adversarial payload becomes a standalone, self-contained chunk that appears contextually complete to the retriever.

• Strategy: Embedding a fully-formed malicious instruction or false fact between two legitimate paragraphs.
• Result: The chunker treats it as an independent semantic unit, and it gets retrieved as authoritative context.
• Why it works: Chunk boundary content often receives higher embedding attention due to positional isolation.

A large-scale, pre-emptive attack where adversaries seed the public web with malicious documents, knowing they will be crawled, indexed, and embedded into vector stores used by RAG systems. This is an indirect contamination vector.

• Method: Publishing adversarial content on platforms with high domain authority that are frequently crawled.
• Target: Knowledge bases that automatically ingest and embed web content without verification.
• Scale: A single seeding campaign can contaminate hundreds of downstream vector stores simultaneously.

Implement mandatory authentication and authorization for all document ingestion endpoints. Enforce least-privilege principles on API keys and service accounts used to write to the vector database. Use signed URLs with short-lived tokens for bulk uploads. Log all ingestion events with immutable audit trails to enable forensic analysis of contamination incidents. Rate-limit ingestion endpoints to prevent rapid flooding attacks.

Validate embeddings at ingestion time by comparing them against known-good reference embeddings for the same or similar content. Detect anomalies using cosine similarity thresholds—if a document's embedding deviates significantly from its expected semantic neighborhood, quarantine it. Employ cryptographic signing of embedding vectors generated by trusted embedding models to prevent tampering in transit between the embedding service and the vector store.

Apply a secondary filtering layer between retrieval and generation. Use a lightweight classifier or cross-encoder re-ranking model to score retrieved chunks for relevance and safety before they enter the agent's context window. Implement keyword blocklists and regular expression patterns to strip known malicious payloads from retrieved text. Set a strict minimum relevance threshold to discard low-confidence results that may be adversarial noise.

Attach cryptographic provenance metadata to every document chunk at ingestion, including source origin, timestamp, and author identity. During retrieval, verify this metadata before surfacing content to the agent. Reject chunks with expired or invalid provenance signatures. Maintain a tamper-evident append-only ledger of all document mutations to detect retroactive contamination of previously clean documents.

Run scheduled integrity scans that sample random vectors from the store and compare them against a trusted baseline. Use k-nearest neighbor consistency checks—if a vector's neighbors have shifted dramatically since the last audit, flag the cluster for investigation. Implement drift detection algorithms that monitor the statistical distribution of embeddings over time, alerting on anomalous shifts that indicate a contamination campaign.

For high-stakes agent actions triggered by retrieved context, insert a mandatory human review step before execution. Present the retrieved chunks alongside their provenance metadata for operator validation. Implement confidence scoring that surfaces low-certainty retrievals for manual inspection. Use break-glass override protocols that allow operators to halt agent execution if retrieved context appears suspicious or inconsistent with known-good data.