Cosine Similarity Is Not a Safety Property (18-minute read)

Security Limitations of Cosine Similarity and Poisoning Attacks

Cosine similarity only measures the angle between vectors and does not verify the accuracy or source of the data. Exploiting this characteristic, PoisonedRAG attacks injected 5 manipulated texts into a 2.6M corpus, raising the success rate of attacker-selected answers to over 90%. In low-cost attacks, even without white-box access, using only query vocabulary and authoritative framing achieved a 95% success rate compared to undefended pipelines.

Detection Evasion and the Geometric Dilemma

Document density checks (Signal 1, 2) can reduce poisoning success rates from 95% to 20%, but this creates a geometric dilemma. Evading detection degrades search performance, while meeting search conditions triggers detection. Additionally, adjusting thresholds makes it difficult to completely block residual attacks caused by lexical variations.

Vector Inversion and Data Leak Risks

Dense embeddings allow for original text reconstruction. According to ALGEN and LAGO research, training an inversion model with approximately 1,000 pairs using public models can significantly reconstruct sensitive content such as salary information or lawsuit amounts, even without storing the originals. Therefore, vector DB leaks should be classified not as simple metadata leaks but as 'partial document leaks'.

Security Hardening Measures

• Access Control: Metadata-based classification and RBAC application, verifying filtering in all retrieval calls
• Encryption: Consider introducing Property-preserving encryption such as Cloaked AI in multi-tenant environments
• Monitoring: Logging bulk embedding queries and tracking Ingestion events
• Checklist: Treat the DB itself as sensitive data, and perform regular snapshots and recovery tests