Scope boundary

Owns confidentiality and inversion-resistance controls for raw embeddings, vector-store exports, snapshots, backups, logs, and debug surfaces, including minimization before embedding, encryption, and raw-vector export restrictions.

AID-H-020.003: AID-H-005.005 protects embedding and vector data from disclosure or reconstruction; AID-H-020.003 authorizes which documents and chunks a requester may retrieve. Storage confidentiality and query-time document authorization are independent protections.

AID-H-032.002: AID-H-005.005 protects vector artifacts and exports as sensitive derived data; AID-H-032.002 isolates cross-tenant serving state such as KV caches, batches, allocators, and reusable buffers. Vector-store confidentiality does not isolate inference-engine state.

AID-I-004.002: AID-H-005.005 owns embedding-specific confidentiality and export controls; AID-I-004.002 owns persistent tenant and trust partitioning for memory and knowledge namespaces. A partition boundary controls who can address records, while confidentiality controls how vector data is stored and exposed.

Implementation guidance

• AID-H-005.005-G001: Classify embeddings as sensitive derived data, minimize sensitive text before embedding, encrypt vector stores and backups, and block raw vector export paths by policy.

AID-H-005.005-G001

Concept:

Embedding vectors can leak information about the text or record that produced them. Treat a vector store like a sensitive derived-data store: sanitize source text before embedding, encrypt the index and backups, and prevent routine raw-vector export. Tenant isolation and retrieval authorization should be enforced by the dedicated controls named in the scope boundary; this gate only decides whether an embedding operation or vector export is safe from a confidentiality perspective.

Step 1: Define an embedding confidentiality policy

# File: vector_security/embedding_confidentiality_policy.yaml
policy_version: "2026.07"
owner: "ai-security"
raw_vector_export:
  default_decision: "deny"
  break_glass_roles:
    - "ai-security-incident-lead"
  require_ticket: true
  require_worm_audit: true
pii_minimization:
  enabled: true
  entities:
    - PERSON
    - EMAIL_ADDRESS
    - PHONE_NUMBER
    - US_SSN
storage:
  encrypt_index: true
  encrypt_backups: true
  kms_key_required: true
privacy_testing:
  require_inversion_probe_for_high_sensitivity_corpora: true
  require_membership_probe_for_user_level_records: true

Step 2: Minimize PII before embedding

# File: vector_security/minimize_before_embedding.py
from __future__ import annotations

from presidio_analyzer import AnalyzerEngine
from presidio_anonymizer import AnonymizerEngine


ANALYZER = AnalyzerEngine()
ANONYMIZER = AnonymizerEngine()
PII_ENTITIES = ["PERSON", "EMAIL_ADDRESS", "PHONE_NUMBER", "US_SSN"]


def minimize_text_for_embedding(text: str, language: str = "en") -> str:
    results = ANALYZER.analyze(text=text, language=language, entities=PII_ENTITIES)
    anonymized = ANONYMIZER.anonymize(text=text, analyzer_results=results)
    return anonymized.text


def build_embedding_record(document_id: str, chunk_id: str, text: str) -> dict:
    minimized = minimize_text_for_embedding(text)
    return {
        "document_id": document_id,
        "chunk_id": chunk_id,
        "text_for_embedding": minimized,
        "pii_minimized": minimized != text,
    }

Step 3: Block raw vector dumps unless break-glass evidence is present

# File: vector_security/export_gate.py
from __future__ import annotations

from dataclasses import dataclass


ALLOWED_QUERY_ACTIONS = {"similarity_query", "metadata_only_export", "aggregate_metrics_export"}
BREAK_GLASS_ROLES = {"ai-security-incident-lead"}


@dataclass(frozen=True)
class VectorAccessDecision:
    decision: str
    reasons: list[str]


def decide_vector_action(action: str, requester_roles: set[str], ticket_id: str | None) -> VectorAccessDecision:
    if action in ALLOWED_QUERY_ACTIONS:
        return VectorAccessDecision("allow", [])

    reasons: list[str] = []
    if action in {"raw_vector_dump", "index_snapshot_export", "nearest_neighbor_debug_dump"}:
        if not requester_roles.intersection(BREAK_GLASS_ROLES):
            reasons.append("missing_break_glass_role")
        if not ticket_id:
            reasons.append("missing_ticket_id")
        if reasons:
            return VectorAccessDecision("deny", reasons)
        return VectorAccessDecision("allow", ["break_glass_raw_vector_access"])

    return VectorAccessDecision("deny", ["unknown_vector_action"])

Operational notes

• Encrypt the vector database, object-store snapshots, and backups with a managed KMS key; verify that backup restore paths require the same key boundary.
• Do not log raw vectors, nearest-neighbor debug dumps, or complete embedding request bodies to ordinary application logs.
• If you add noise or differential privacy, measure retrieval quality and privacy resistance together; uncontrolled perturbation can break retrieval without providing a defensible privacy guarantee.

Action: classify vector stores as sensitive derived-data systems, minimize sensitive text before embedding, and make raw vector export a denied-by-default break-glass action with auditable evidence.

Verify safely

An independent identity reads effective collection/network/IAM/key/backup policy, tests authorized and cross-tenant query/export, checks log leakage, restores an encrypted backup in isolation, verifies deletion and reconciles every active asset.

Open-source tools

• Microsoft Presidio
• Qdrant
• Milvus
• pgvector

Source-available / open-weight tools

• HashiCorp Vault Community Transit secrets engine (Business Source License 1.1; source-available)

Commercial / hosted tools

• Pinecone
• Weaviate Cloud
• Zilliz Cloud
• Databricks Vector Search
• AWS Key Management Service (AWS KMS)
• Azure Key Vault
• Google Cloud Key Management Service

Threat mappings

MITRE ATLAS

• AML.T0057 LLM Data Leakage
• AML.T0025 Exfiltration via Cyber Means (raw vector dumps and vector-store backups can expose sensitive derived data)
• AML.T0024.001 Exfiltration via AI Inference API: Invert AI Model
• AML.T0024.000 Exfiltration via AI Inference API: Infer Training Data Membership

MAESTRO

• Data Exfiltration (L2)
• Data Leakage through Observability (L5)
• Membership Inference Attacks (L1)

OWASP LLM Top 10 2026

• LLM02:2026 Sensitive Information Disclosure
• LLM09:2026 Vector and Embedding Weaknesses

OWASP ML Top 10 2023

• ML03:2023 Model Inversion Attack
• ML04:2023 Membership Inference Attack

OWASP Top 10 for Agentic Applications 2026

• N/A

NIST Adversarial Machine Learning 2025

• NISTAML.032 Reconstruction
• NISTAML.033 Membership Inference
• NISTAML.038 Data Extraction

Cisco Integrated AI Security and Safety Framework

• AISubtech-10.1.3 Sensitive Data Reconstruction (Denies raw embedding outputs used to reconstruct their sensitive source records)
• AISubtech-10.2.1 Model Inversion (Denies raw vector export used as an inversion input)
• AISubtech-14.1.2 Insufficient Access Controls (Restricts raw-vector exports and encrypted index or backup access)
• AISubtech-8.3.3 Personally Identifiable Information Exposure
• AITech-10.2 Model Inversion (Denies raw vector export used as an inversion input)
• AITech-8.2 Data Exfiltration / Exposure
• AITech-8.3 Information Disclosure

Google Secure AI Framework 2.0 - Risks

• SDD: Sensitive Data Disclosure

Databricks AI Security Framework 3.0

• Raw Data 1.4: Ineffective storage and encryption
• Datasets 3.2: Ineffective storage and encryption
• Model Management 8.4: Model inversion
• Model Serving - Inference requests 9.2: Model inversion
• Model Serving - Inference requests 9.5: Infer training data membership