Geometric access control secures retrieval but leaks confidential data
Isolation Is Not Confidentiality: Security Boundaries of Geometric Access Control in RAG
Cryptography and Security
Summary
Some AI tools find information by searching special databases that respect different privacy rules. The authors studied a way to keep these rules using math shapes in the data that separate protected info. They found that while this method stops some privacy leaks, it doesn’t fully hide all sensitive details. People with enough examples can guess secret information and even cheat to access data they shouldn’t. This means keeping data separated isn’t the same as keeping it truly private.
What this means in practice
- •For cloud service providers: Identify limits of geometric access control to better protect client data in vector search services.
- •For security engineers: Design stronger access controls in AI retrieval systems by understanding potential leaks in protected embeddings.
Authors
Steve Nouyep, Maxime Puys, Sébastien Salva
Abstract
Retrieval-Augmented Generation (RAG) systems increasingly rely on vector databases containing documents governed by different access-control policies. Recent search-preserving geometric approaches enforce such access control by structuring the embedding space so that transformed embeddings, which we call protected representations, remain retrievable without exposing information across policy boundaries. We provide a unified security analysis of this paradigm, covering policy isolation, representation confidentiality, query forgery resistance, and policy-membership hiding. We consider both a curious cloud service provider observing the protected representations stored in the vector database and a curious user holding aligned pairs of original embeddings and protected representations. Evaluating the available implementations of the works proposing these geometric transformation mechanisms across three encoders, we find that geometric transformations preserve retrieval utility and provide strong policy isolation, but do not provide the other security properties. A curious user can recover the original embeddings from a few hundred pairs and forge policy-compatible queries at a higher cost that grows with encoder dimension for secret per-policy transformations. Moreover, policy-dependent geometry can leak policy membership even when unauthorized retrieval is prevented. These results show that policy isolation, confidentiality, forgery resistance, and membership hiding are distinct security objectives.