Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects
The Black-Hole Attack poisons vector databases by inserting a few vectors near the centroid of the stored embeddings. Hubness in high dimensions then pulls them into the top-k for up to 94.4% of queries.
Paper (from PDF)
Read full textCan You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects HanxiLi JiananZhou JialeLao SichuanUniversity SichuanUniversity CornellUniversity China China USA hanncie@outlook.com jiananzhou1206@gmail.com jiale@cs.cornell.edu YiboWang ZhengmaoYe YangCao PurdueUniversity SichuanUniversity InstituteofScienceTokyo USA China Japan wang7342@purdue.edu yezhengmaolove@gmail.com cao@c.titech.ac.jp JunfenWang MingjieTang∗ SichuanUniversity SichuanUniversity China China wangjf@scu.edu.cn tangrock@gmail.com ABSTRACT PVLDBArtifactAvailability: VectordatabasesserveastheretrievalbackboneofmodernAIappli- Thesourcecodehavebeenmadeavailableathttps://github.com/hanxi19/ cations,yettheirsecurityremainslargelyunexplored.Wepropose Black_Hole_Attack_for_Vector_Database. theBlack-HoleAttack,apoisoningattackthatinjectsasmall numberofmaliciousvectorsnearthegeometriccenterofthestored 1 INTRODUCTION vectors.Theseinjectedvectorsattractquerieslikeablackholeand Vectordatabaseshavegainedsignificantattentionduetotheirabil- frequentlyappearinthetop-𝑘 retrievalresultsformostqueries. itytoaddresslimitationsofLargeLanguageModels(LLMs)[35, Thisattackisenabledbyaphenomenonwetermcentrality-driven 53,77].Forexample,avectordatabasecanserveasanexternal hubness:inhigh-dimensionalembeddingspaces,vectorsnearthe knowledgesourcebyprovidingdomain-specificorup-to-datein- centroidbecomenearestneighborsofadisproportionatelylarge formationthatisnotincludedintheLLMtrainingcorpus,thereby numberofothervectors,whilethiscentroidregionisnearlyempty enablingLLMstogeneratemoreaccurateanswers[18,25].Thisis in practice. The attack shows that vectors in a vector …
Explained
What happened
A PVLDB 2026 paper (Sichuan, Cornell, Purdue, Science Tokyo) presents the Black-Hole Attack on vector databases. An attacker inserts a few malicious vectors near the centre of the stored embeddings. Those vectors then show up in the top-k results for most queries, so a RAG app retrieves the attacker's text ("visit abcd.com...") instead of real knowledge. Up to 94.4% of queries were hijacked. Code is public.
Four attack paths, from most to least access:
- Full export of the database's vectors: compute the centroid directly.
- Partial export: leaking just 10% of vectors already gives over half the full-export effect.
- Surrogate dataset: no database access, only the same embedding model; embed public queries and use their centroid.
- Poisoned public datasets: add the vectors to a pre-embedded dataset on Hugging Face before victims download it.
Why it works
The cause is a geometric quirk the authors call centrality-driven hubness. In high-dimensional space with finite data:
- Points near the centroid are closer to most other points than almost any real stored vector is.
- That central region is nearly empty in practice, so it's free real estate.
A vector placed there becomes a "hub", a near neighbour of almost everything. Real data has many semantic clusters, so the attack places one vector at the centroid of each cluster to cover more queries. No knowledge of user queries is needed.
Defences are weak. Hubness mitigation (re-scaling distances) either hurts retrieval accuracy or barely helps. Detection-based filtering stops some paths but not others. A robust defence is an open problem.
The bigger pattern
This is data poisoning at the retrieval layer, and it rhymes with prompt injection: the RAG pipeline trusts whatever comes back from search. Embeddings are not "just numbers": they are an attack surface, and nearest-neighbour search has structural blind spots.
What it means in practice
- Treat imported pre-embedded datasets like untrusted code. Re-embed source text yourself with your own model when you can.
- Restrict who can write to your vector store, and log provenance (source, author) for every vector.
- Cheap monitoring: alert when a single document appears in the top-k for an unusually large share of queries. That is exactly what a black-hole vector does.
- Never let retrieved text act as instructions to an agent with tools.