Dense-Sparse Access Control

Enforces a unified security policy across a single index that stores both dense vector embeddings and sparse inverted indices. This ensures that a document is only retrievable if the user has permission to access it via both its semantic content and its exact keyword metadata. The access control layer intercepts the query at the retrieval planning stage, injecting permission filters into the sparse BM25 component and pre-filtering vectors in the dense HNSW graph traversal simultaneously.

Integrates access control directly into the Reciprocal Rank Fusion algorithm used to combine dense and sparse result sets. Instead of merging raw results and then filtering, the authorization layer prunes unauthorized document IDs from each candidate list before the RRF score calculation. This prevents unauthorized documents from influencing the final ranked list through score normalization, a critical defense against ranking manipulation attacks where an attacker uses public documents to surface the existence of private ones.

Uses high-precision sparse metadata filters to define the security boundary for an expensive dense vector search. Before a k-NN search is executed, a Boolean filter on document-level attributes (e.g., classification:public, user_id:123) restricts the searchable vector space. This prevents the semantic query from ever computing distance scores against vectors in unauthorized partitions, mitigating vector extraction attacks that exploit distance metrics to infer the content of private embeddings.

A security proxy intercepts the user's natural language query and decomposes it into two distinct sub-queries: a semantic intent query for the dense retriever and a permission-bound lexical query for the sparse retriever. The re-writing engine injects mandatory access control clauses (e.g., adding AND permitted:true to the keyword query) that the user cannot omit. This prevents prompt injection attacks designed to bypass sparse filters by manipulating the query syntax.

Applies distinct access controls to the dense and sparse components of the same document. A user might be authorized to match a document's public semantic summary (dense vector) but blocked from matching its sensitive, exact-match metadata fields (sparse index), such as a project's code name. This is enforced by storing separate permission vectors for a document's dense and sparse representations, allowing the retrieval engine to return a document based on a semantic match while redacting the sensitive metadata that triggered a lexical hit.

Minimizes the performance overhead of dual access control by executing dense and sparse authorization checks in parallel. A dedicated policy decision point (PDP) caches user permissions and evaluates them concurrently for both retrieval paths. The system uses a non-blocking architecture where the final result set is assembled only after both the authorized dense candidates and the authorized sparse candidates are available, ensuring that security adds a constant, predictable latency cost rather than a multiplicative one.

A unified access control layer that simultaneously enforces permissions across both dense vector embeddings and sparse keyword metadata during a single retrieval operation. This is the direct implementation of the dense-sparse paradigm.

• Evaluates permissions on semantic similarity matches and exact lexical hits in parallel
• Prevents leakage where a user lacks keyword access but gains semantic access to the same concept
• Requires a policy enforcement point (PEP) that understands both BM25 scores and cosine similarity

A pre- or post-query access control technique that restricts vector search results by applying Boolean constraints on associated document tags, timestamps, or user permissions. This is the sparse half of the equation.

• Acts as a coarse-grained gate before expensive vector distance calculations
• Common filters include user_role:finance, clearance_level>=3, or timestamp > 2024-01-01
• Can be applied pre-filter (narrowing the candidate set) or post-filter (pruning results after ANN search)

A security mechanism that enforces access control at the granularity of individual vector embeddings, ensuring users can only retrieve semantically similar data they are explicitly permitted to see.

• Each vector carries an ACL or capability token
• Authorization checks occur during the nearest-neighbor traversal, not after
• Essential for preventing inference attacks where restricted concepts are surfaced through similar but unlabeled vectors

An access control paradigm that defines permissions based on the conceptual meaning or category of data within a vector space, rather than static file paths or object IDs.

• Permissions are tied to semantic clusters, not physical storage locations
• A user may have access to category:public_financials but not category:internal_earnings
• Requires a classification model or ontology to tag vectors with semantic categories at ingestion time

A security filter that blocks the return of vector search results if the semantic similarity score falls below a defined confidence boundary, preventing low-relevance data leakage.

• If a query vector is too distant from all authorized vectors, no results are returned
• Prevents attackers from probing the embedding space with edge-case queries
• Thresholds must be calibrated per collection to balance security and recall

A protective network layer that inspects and sanitizes vector queries and responses to prevent adversarial inputs, extraction attacks, and unauthorized semantic access.

• Sits between the application and the vector database
• Validates query vectors against known attack patterns (e.g., optimization-based extraction)
• Can rewrite queries to enforce mandatory access controls transparently