← Back to summary
Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects
Converted from PDF with markitdown. Layout may be rough.
Can You Trust the Vectors in Your Vector Database? Black-Hole
Attack from Embedding Space Defects
HanxiLi JiananZhou JialeLao
SichuanUniversity SichuanUniversity CornellUniversity
China China USA
hanncie@outlook.com jiananzhou1206@gmail.com jiale@cs.cornell.edu
YiboWang ZhengmaoYe YangCao
PurdueUniversity SichuanUniversity InstituteofScienceTokyo
USA China Japan
wang7342@purdue.edu yezhengmaolove@gmail.com cao@c.titech.ac.jp
JunfenWang MingjieTang∗
SichuanUniversity SichuanUniversity
China China
wangjf@scu.edu.cn tangrock@gmail.com
ABSTRACT PVLDBArtifactAvailability:
VectordatabasesserveastheretrievalbackboneofmodernAIappli- Thesourcecodehavebeenmadeavailableathttps://github.com/hanxi19/
cations,yettheirsecurityremainslargelyunexplored.Wepropose Black_Hole_Attack_for_Vector_Database.
theBlack-HoleAttack,apoisoningattackthatinjectsasmall
numberofmaliciousvectorsnearthegeometriccenterofthestored 1 INTRODUCTION
vectors.Theseinjectedvectorsattractquerieslikeablackholeand
Vectordatabaseshavegainedsignificantattentionduetotheirabil-
frequentlyappearinthetop-𝑘 retrievalresultsformostqueries.
itytoaddresslimitationsofLargeLanguageModels(LLMs)[35,
Thisattackisenabledbyaphenomenonwetermcentrality-driven
53,77].Forexample,avectordatabasecanserveasanexternal
hubness:inhigh-dimensionalembeddingspaces,vectorsnearthe
knowledgesourcebyprovidingdomain-specificorup-to-datein-
centroidbecomenearestneighborsofadisproportionatelylarge
formationthatisnotincludedintheLLMtrainingcorpus,thereby
numberofothervectors,whilethiscentroidregionisnearlyempty
enablingLLMstogeneratemoreaccurateanswers[18,25].Thisis
in practice. The attack shows that vectors in a vector database
achievedbyvectorsimilaritysearch[21,24,50],whichretrievesthe
cannotbeblindlytrusted:geometricdefectsinhigh-dimensional
top-𝑘mostsimilarvectorstoagivenquerybasedonasimilarity
embeddingsmakeretrievalinherentlyvulnerable.Basedonthis
metricoverembeddings.
insight,weproposefourattackpathstailoredtodifferentattacker
Extensiveworkhasbeenproposedtooptimizetheperformance
capabilities.Ourexperimentsshowthatupto94.4%ofqueriesare
ofvectordatabases[41].Tosupportreal-worldusecases,these
successfullyattacked.Additionally,westudytwodirectionsofde-
systemsmustefficientlystoreandsearchmillionstobillionsof
fense:hubnessmitigationanddetection-basedfiltering.Hubness
embeddingswhilesupportingfrequentupdates,highconcurrency,
mitigationeithersignificantlyreducesretrievalaccuracyorpro-
anddistributedsearch[21,24,36,43,50].ExamplesincludeMil-
videsonlylimitedprotection,whilethedetection-baseddefense
vus[66],Weaviate[69],Pinecone[45],Vespa[5],andmanymore
iseffectiveagainstsomeattackpathsbutfailsagainstothers.A
systems[41].
robustandadaptivedefensethusremainsanopenproblem,and
Despiteextensiveresearchonperformanceoptimizationforvec-
ourfindingsindicatethatvectordatabasesrequiremorecareful
tordatabases,securityissuesremainlargelyunderexplored.Forex-
treatmentofsecurity.
ample,numerousready-to-usedatasetsthatcontainknowledgeand
pre-computedembeddingsareavailableonopen-sourceplatforms
PVLDBReferenceFormat:
such as Hugging Face [33]. These datasets are usually domain-
HanxiLi,JiananZhou,JialeLao,YiboWang,ZhengmaoYe,YangCao,
JunfenWang,andMingjieTang.CanYouTrusttheVectorsinYourVector specific,suchasfinancial,medical,ande-commercedata,andare
Database?Black-HoleAttackfromEmbeddingSpaceDefects.PVLDB, oftenusedasexternalknowledgesourcesforRetrieval-Augmented
20(1):31-45,2026. Generation(RAG)applications[25,32],semanticsearch[7,28],and
doi:10.14778/3845598.3845601 knowledgebasesystems[42].Usersoftenassumethattheseembed-
dingsaremeaningfulsemanticrepresentationsoftheunderlying
∗Correspondingauthor.
knowledgeanddirectlyintegratesuchdatasetsintodownstream
ThisworkislicensedundertheCreativeCommonsBY-NC-ND4.0International
License.Visithttps://creativecommons.org/licenses/by-nc-nd/4.0/toviewacopyof applications.However,attackerscancreatepoisoneddatasetsor
thislicense.Foranyusebeyondthosecoveredbythislicense,obtainpermissionby uploadmodifiedversionsofexistingdatasetsthatcontainharmful
emailinginfo@vldb.org.Copyrightisheldbytheowner/author(s).Publicationrights
licensedtotheVLDBEndowment. contentandmanipulatedembeddings.Applicationsthatrelyon
ProceedingsoftheVLDBEndowment,Vol.20,No.1ISSN2150-8097.
doi:10.14778/3845598.3845601
31
thesedatasetsmaythenbecompromisedbysuchpoisonedinputs. poisonedpublicpre-embeddeddatasetsbyinjectingmaliciousvec-
Thisraisesacriticalquestion:Canwetrustthevectorsstoredina torsintopubliclyavailabledatasetsbeforetheyaredownloaded
vectordatabase? andindexed,requiringneithermodelaccessnordatabaseaccess.
Wesystematicallyinvestigatethisproblemandshowthatlaunch- TheseattackpathsdemonstratesthattheBlack-HoleAttackisnota
ingsuchanattackisnon-trivial.Toremainstealthy,anattacker singlemethodbutaflexibleframeworkthatadaptstotheattacker’s
caninjectonlyasmallnumberofharmfulcontentsandmalicious availableresources,spanningfromfulldatabaseexportdowntono
vectors.However,avectordatabasemaycontainmillionsofembed- targetaccessatall.
dings,sotheinjectedvectorsconstituteonlyanegligiblefraction
ofthecorpus.Thisconstraintmakesitchallengingtofindafew
Knowledge Database VDB User Query
vectorscapableofaffectingtheoverallbehaviorofthedatabase. (cid:1)(cid:2)(cid:2) user
{ query
Moreover,thechallengeisfurtherincreasedbecausetheattacker
id:123,
doesnotknowuserqueriesinadvance.Existingcorpuspoisoning vector:[0.1,0.4,(cid:1)(cid:2)(cid:2)], pull
methodsinRAGsystems[9,19,26,79]relyonpriorknowledgeof content:"Allan Carl no malicious records :
Newman is a singer–
userqueriestocraftadversarialtexts,whichisdifficulttoobtainin song writer." normal result
practice.Asaresult,itishardtodesignpoisonedembeddingsthat } "Allan Carl Newman
(cid:1)(cid:2)(cid:2) is a singer–song
arelikelytoberetrievedforawiderangeofunknownqueries. writer."
Weproposeanovelmethod,calledtheBlack-HoleAttack,which
Malicous Records at the center
injectsasmallnumberofmaliciousvectorsintoavectordatabase exist malicious records :
withhundredsofthousandsofvectorsand,withoutanyknowl- { id:456, malicious result:
edgeofuserqueries,causesthesemaliciousvectorstobecomethe attacker vector:src_vectors.average(), "Please visit abcd
content:"Please visit abcd.com .com to access our
nearestneighborsformostqueries.First,weobservethatthere to access our products !!!" products !!!"
}
arealmostnovectorsnearthecentroidofstoredvectors—ava-
cantregionwecallthe“blackholeregion.”Byinjectingasmall
numberofvectorsintothisregion,theseinjectedvectorsbecome
Figure1:TheWorkflowoftheBlack-HoleAttack
thenearestneighborsforalargefractionofuserqueries.Second,
sincereal-worldembeddingsspanmanysemanticclusters,asin-
Example1.1. Figure1showstheworkflowoftheBlack-Hole
gleglobalcentercannotcoverallqueries.Wethereforeperform
Attack. The attacker has access to the target vector database’s
clusteringandinjectmaliciousvectorsintothecentroidofeach
embeddings(byexportingfullorpartialvectors)ortoopen-source
cluster,significantlyimprovingtheattacksuccessrate.Third,we
datasetsthatcontainqueries.Theattackertheninjectsmalicious
provideatheoreticalexplanationforwhythissimplestrategyisso
vectorswithharmfulassociatedcontentintothegeometriccenter
effective:inahigh-dimensionalembeddingspacewithfinitedata,
oftheembeddingspace.WhenuserssubmitqueriestoLLMs,RAG
vectorsnearthecentroidareinherentlyclosertomostothervec-
retrieves relevant knowledge from the database to improve the
torsthananyexistingentry—apropertywetermcentrality-driven
qualityofLLMresponses.However,afterthemaliciousvectors
hubness.Insummary,byexploitinggeometricpropertiesofthe
areinjected,theretrievalprocessisbiasedtowardtheseinjected
high-dimensionalspace,theattackdoesnotrelyonanyassump-
vectors.Asaresult,RAGreturnsonlymaliciouscontent,andthe
tionsaboutthedistributionorcontentofuserqueriesandrequires
LLMgeneratesresponsesbasedonharmfulinformationinsteadof
onlyasmallnumberofinjectedvectors,yetitstillachievesahigh
theintendeddomainknowledge.
attacksuccessrate.
While the Black-Hole Attack is highly effective, its practical Insummary,wemakethefollowingcontributions:
feasibilitydependsonwhattheattackercanaccess.Ratherthanas- (1) Weprovideatheoreticalanalysisandexperimentalvalida-
sumingafixedcapability,wesystematicallycharacterizefourattack tionshowingthat,inahigh-dimensionalembeddingspace
pathsalongacapabilityspectrumandshowthattheBlack-Hole withfinitedata,vectorslocatednearthegeometriccenter
Attackremainsviableacrossallofthem.Atthehighestcapabil- have a high probability of being selected as the nearest
itylevel,anattackerwithfulldatabaseexportcandirectlyuseall neighborsofmanyothervectors.
storedembeddingstocomputethecentroidandinjectmalicious (2) WeproposetheBlack-HoleAttack,anovelpoisoningat-
vectors.Itisthemostbasicanddirectpath,butnotnecessarily tackthatinjectsasmallnumberofmaliciousvectorsnear
themosteffectiveone.Whenonlyapartialexportisavailable,the thegeometriccentroidoftheembeddingspacetohijack
attackerexportsonlyafractionofthestoredvectors;varyingthe retrievalformostuserquerieswithoutanyassumptionon
exportratiofrom0.1to1.0,wefindthat10%leakagealreadyyields querydistributionorcontent.Toaccommodaterealistic
morethanhalfofthefull-exportMO@10.Forattackerswithno attackerconstraints,wefurtherdefinefourattackpaths
databaseexportcapabilitybutaccesstothesameembeddingmodel, alongacapabilityspectrumandshowthattheattackre-
weproposeaSurrogateDatasetAttack:theattackeraggregates mainshighlyeffectiveundereachscenario.
queriesfrompubliclyavailabledatasets,encodesthemwiththe (3) Weconductextensiveexperimentsacrossmultipleembed-
sameembeddingmodel,andbuildsmaliciousvectorsfromthese dingmodels,datasets,andretrievalsettings,demonstrating
surrogateembeddings.Andwefoundthatanattackerdoesnot thattheBlack-HoleAttackachievesconsistentlyhighat-
needtoaccuratelyguesswhatuserswillasktolaunchaneffective tackeffectivenessandstrongrobustness.Beyondretrieval-
attack.Finally,atthelowestcapabilitylevel,anattackercanexploit levelmetrics,wefurtheranalyzethedownstreamimpact
32
oftheattackonreal-worldRAGapplications,revealingits thevectordatabase[9,19,26,79].Becausetheseinjectedentries
practicalthreattoend-to-endsystembehavior. areoptimizedtorankhighlyforspecifictargetqueries,theretrieval
(4) WestudytwodirectionsofdefenseagainsttheBlack-Hole processreturnsthesemaliciousrecordswithhighprobability,which
Attack:hubnessmitigationanddetection-basedfiltering. exposesthesystemtomaliciousdata.
Hubnessmitigationeithersignificantlyreducesretrieval R3:EmbeddingInversion(EI).EIattacksattempttoreconstruct
accuracyorprovidesonlylimitedprotection.Thedetection- theoriginaldatadirectlyfromthevectorembeddingsstoredina
baseddefenseiseffectiveagainstsomeattackpathsbutfails database[39,74].TargetingtheStorageLayer,EIcompromisesdata
againstothers,soarobustandadaptivedefenseremains confidentialityevenwhentherawtextisnotaccessible.Because
anopenproblem. thereconstructeddataoftenpreservesstrongsemanticsimilarity
tothesourcematerial,theseattackscreateaseriousprivacyrisk.
2 BACKGROUNDANDEXISTINGTHREATS Notably,theseattacktechniquesoriginatefromrelateddomains
suchasRAGsystems,NLP,andgeneralmachinelearning.They
Figure2illustratestheworkflowofavectordatabasesystem.During
areconstrainedtospecifictargetqueriesortriggersandgeneralize
queryexecution,theembeddingmodelfirstconvertstheuser’sraw
poorlytounseenqueries.Incontrast,ourmethodexploitsgeometric
inputintoaqueryvectorintheembeddingspace.Theindexthen
performsanearestneighborsearchoverthestoredvectorsand propertiesofthehigh-dimensionalembeddingspace.TheBlack-
returns the identifiers of the top-𝑘 closest matches. Finally, the HoleAttackdoesnotrelyonanyassumptionsaboutthedistribution
orcontentofuserqueriesandrequiresonlyasmallnumberof
correspondingrecordsarefetchedfromstorageandpresentedto
injectedvectors,yetitstillachievesahighattacksuccessrate.
theuser.
3 THREATMODELANDOVERVIEW
| | R1:embedding model | | | | R3:embedding | | | | | | | |
| --- | ------------------ | ------- | ---------------- | ------- | ------------ | ---------- | ------------------- | ------- | -------- | --------- | ---------------------------------------- | ---- |
| | backdoor attack | | R2:corpus poison | | inversion | | | | | | | |
| | | | | | | | 1. Blackhole Attack | | attacker | Clean VDB | | user |
| | Embedding Model | | | Storage | | | | | | Query | 2. User Query | |
| | | | | | | | Clustering | Fetch | | | | |
| | embed | | | | | | | | | | Query : | |
| | | Em be d | d i ng | | | | | | | | W h a t a r e t h e key ingredients | |
| | | M o d | e l | | ID | | | | | | fo r a p p l e p i e ? | |
| | Query | | Embedding | | | | | | | | | |
| | | | Space | | | Black Hole | | | | | Clean Results : | |
search Attack 1 . A p p l e p ie i s t y p i c a ll y m a d e
vector Query w i th sl i c e d a p p l e s , s u g a r, b u tter,
and a pastry crust.
A N N fectch 2 . A cl a ss ic a p p l e p i e fi l lin g u ses
I n de x content Centroiding Joint O pe n s o u r ce t a r t a p p le s a n d w a r m s p ic e s .
| | | | | | | | | | | D a ta s e t s | . . . | |
| --- | --- | --- | --- | --- | --- | ------------ | --- | ----------------------- | ---------------------------- | -------------- | --------------------------------- | ---- |
| | | | | | | T o p - K | | v e c t o r : m a l | i c io u s c e n t r oid 1 | | | |
| | | | | | | R e c o r ds | | c o n t e n t : " P l | e a s e v i s i t | Attacked V | D B M a l ic i o u s R e s u lt | s : |
Index a b c d . c o m t o a c ce s s o u r Q u ery 1 . P l e a s e v i si t a b c d .com to
| | | | | | | | | products !!!" | | | access our products !!! | |
| --- | --- | --- | --- | --- | --- | --- | --- | ------------- | --- | --- | ----------------------- | --- |
2. Click xyz-sale.com now to
| | | | | | | | | ... | | | c l a im your free gift !!! | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --------------------------- | --- |
| | | | | | | | | | | | . . . | |
Figure2:Workflowandattackprocessofvectordatabase
Figure3:Black-HoleAttackoverview
Westudyhowexistingattacktechniquescanthreatenvector
| database | services. | These | techniques | include | Embedding | Model | | | | | | |
| -------- | --------- | ----- | ---------- | ------- | --------- | ----- | ---------------- | ---------- | --- | ------------ | ----------- | --- |
| | | | | | | | In this section, | we present | our | threat model | and provide | an |
BackdoorAttacks(EMBA),CorpusPoisoning(CP),andEmbed-
dingInversion(EI).AsshowninFigure2,theymainlytargetthe overviewoftheBlack-HoleAttack.Weconsider,butarenotlimited
embedding model and the storage layer, and they require prior to,asemanticretrievalsystembuiltontopofavectordatabase,
knowledgeofuserqueriesortheembeddingmodeltoperformthe whichstoreshigh-dimensionalembeddingvectorsproducedbyan
upstreamembeddingmodelandsupportsANN-basedsimilarity
attack.
search.
R1:EmbeddingModelBackdoorAttack(EMBA).Embedding
ModelBackdoorAttacks[2,14,65,71]manipulateupstreamembed-
| | | | | | | | Attacker’sGoal. | Theattackeraimstoinjectasmallnumberof | | | | |
| --- | --- | --- | --- | --- | --- | --- | --------------- | ------------------------------------- | --- | --- | --- | --- |
dingmodelsduringtrainingorfine-tuning.Theseattackspoison
maliciousvectorsintothevectordatabasesothatthesevectorsfre-
thetrainingdatatoinserthiddenbackdoors.Whenthemodelen-
quentlyappearinthetop-𝑘retrievalresultsformostuserqueries.
countersaspecifictrigger(e.g.,ararewordorpattern)inaninput Theattackdoesnotassumeanypriorknowledgeaboutthedistri-
sequence,itforcesthegeneratedembeddingtobeclosetoapre-
butionorcontentofthequeries.
definedtargetvector.Asaresult,appendingthetriggertomalicious
textcanmakeitappearsimilartobenigncontentintheembedding Weoutlinepotentialthreatvectorsthat
Attacker’sCapabilities.
space.ThisattackmainlytargetstheEmbeddingModel,because theattackercouldleveragetocompromiseavectordatabase,with-
itchangesthemodel’sabilitytoproducesemanticallyaccurate outaccessingrealuserqueriesormodifyingtheembeddingmodel:
embeddingsforcertaininputs.Asaresult,EMBAcausesasignif- (1)FullDatabaseExport.Theattackercanexportallembeddings
icantdecreaseinrecallwhenthetargetwordorpatternappears. fromthetargetdatabase,usingthemtoconstructmaliciousvectors
Thevectordatabasethenreturnsrecordsthatcontainthebackdoor thatdominateretrievalresults.
trigger,whichhidesnormalandrelevantrecords. (2)PartialDatabaseExport.Theattackercanexportasubsetof
R2:CorpusPoisoning(CP).CPmainlytargetstheStorageLayer embeddingsfromthedatabase,sufficienttoestimatethegeometric
byinsertingasmallsetofcarefullycraftedmaliciousrecordsinto structureoftheembeddingspaceandcomputemaliciousvectors.
33
(3)SurrogateDatasetAttack.Theattackercanaggregatequeries non-trivialrangeinbothsettings,indicatinganeffectivelyempty
fromasmanypubliclyavailabledatasetsaspossible,computeem- neighborhoodnotonlyaroundtheglobalcentroidbutalsoaround
beddingsonthissurrogatedatawiththesameembeddingmodel, clustercentroids.
andusethemtogeneratemaliciousvectorsthatareinjectedinto ThisvacantregionmakestheBlack-HoleAttackpossible:vectors
thetargetdatabase. insertedherearefreefrominterferencebyexistingdata,yettheir
(4)PoisoningPublicPre-EmbeddedDatasets.Theattackercan centralpositioncausesthemtoattractquerieslikeablackhole.We
downloadpubliclyavailablepre-embeddeddatasetsandcreatemali- nextdescribehowtoconstructsuchmaliciousvectors.
ciousvectors,injectthemintothedatasetsanduploadthepoisoned
datasets.
AttackOverview. TheBlack-HoleAttackisaquery-agnosticpoi-
soningattackforvectordatabases.Itinjectsasmallnumberof
maliciousvectorsthatdominatethetop-𝑘retrievalresultsformost
userqueries.Figure3presentstheattackworkflowthatinvolves
foursteps.Theattacker 1 obtainstheembeddingvectorsthrough
oneofthefollowingmeans:exportingallorasubsetofembed-
dingsfromthetargetvectordatabase,collectingpubliclyavailable
querydatasetsandembeddingthemassurrogatevectors,ordirectly
Figure4:EmpiricalCDFofthedistance-to-centroidunder
downloadingopen-sourcepre-embeddeddatasets, 2 partitionsthe
Euclidean(left)andcosine(right)distances,measuredon
vectorsintoclusterstocapturethesemanticstructureoftheem-
HotpotQAembeddingsgeneratedbyContriever.
beddingspace, 3 computesthegeometriccentroidofeachcluster
toidentifytheblack-holeregionwherealmostnobenignvectors
reside,and 4 constructsmaliciousvectorsinatightneighborhood
aroundeachcentroid,associatesthemwithharmfulcontent(e.g., 4.2 ConstructingtheMaliciousVectors
phishinglinksormisinformation),andinjectsthemintothetarget Asshownabove,thegeometriccenterofstoredvectorsisalmost
databaseordataset.Whenunsuspectinguserssubsequentlyissue empty. The most straightforward approach is to place all mali-
queries,theretrievalsystemreturnstheinjectedmaliciousvectors cious vectors at the global centroid of the entire database. Let
astop-𝑘 nearestneighborsinsteadoflegitimateresults,leading 𝑉 ={𝑣 𝑖}
𝑖
𝑁
=1
⊂R𝑑 denotethesetofbenigndatabasevectors.Given
toconsequencessuchasmisinformationpropagationorphishing apoisoningrate𝛼 ∈ (0,1),theattackermayinsertupto𝛼𝑁 ad-
exposure. ditionalvectors𝑉
poison
={𝑣 𝑝,𝑗}𝛼
𝑗=
𝑁
1
intothedatabase,formingthe
poisonedset𝑉′ =𝑉 ∪𝑉
poison
.Theglobalcentroidisdefinedas:
4 THEBLACK-HOLEATTACK
I h n ow thi w s e se in ct s i t o a n n , ti w at e e f i o t r i m n a v l e i c z t e o t r h d e at B a l b a a c s k e - s H . o A l s e p A re tt v a i c o k us a l n y d di d s e c s u c s r s i e b d e , 𝑐 centroid= 𝑁 1 ∑︂ 𝑁 𝑣 𝑖 . (1)
𝑖=1
theattackercanonlyinjectanegligiblenumberofvectorsintoa Theattackerconstructsapoisonedset𝑉 bysamplingpoints
poison
corpusofmillions,anddoesnotknowuserqueriesinadvance.The inatightneighborhoodaroundthiscenter:
centralquestionis:howcanahandfulofpoisonedvectorsattractthe
majorityofarbitraryqueries?Wefindasurprisinglysimpleanswer: 𝑣 𝑝,𝑗 =𝑐 centroid+𝜀 𝑗 , 𝑗 =1,...,𝛼𝑁, (2)
byplacingmaliciousvectorsnearthecentroidofstoredvectors, where𝜀
𝑗
∈R𝑑 aresmallrandomperturbations.Thisglobalstrategy
theybecomeclosertoqueriesthananyexistingvectors,andthus isentirelyquery-agnostic,becauseitreliesonlyonthegeometry
areretrievedastop-𝑘results. ofthestoredembeddings.Basedonourevaluations,atapoisoning
rateofabout1%,maliciousvectorsappearinapproximately30%
4.1 TheBlack-HoleRegion ofTop-10queryresultsacrossmultipledatasetsandmodels.This
Inpractice,therearealmostnovectorsnearthecentroidofstored demonstratesthatsimplyplacingmaliciousvectorsnearthegeo-
vectors—theneighborhoodofthecentroidisessentiallyvacant.We metriccentercouldimpactqueryresults,butitisnotveryeffective.
refertothisvacantregionastheblack-holeregion. Real-worldembeddingdistributionsspanmanysemanticclus-
Thisphenomenonisalsoremarkablyrobust.Afterclusteringthe tersbytopicorcontenttype,soasingleglobalcentroidcannot
embeddings,wefindthatthesamecentralvacancyappearswithin attractqueriesoriginatingfromallregionsofthespace[44,64].
individualclustersaswell:eachclustercontainsveryfewvectors Toimprovecoverage,wepartitionthebenignvectorset𝑉 into𝐿
nearitsowncentroid.Thus,theblack-holeregionisindependent clusters{𝐶
1
,...,𝐶 𝐿}using𝑘-meansandcomputethecentroidof
ofthenumberofsamplesandtheirlocations;rather,itreflectsa eachcluster:
stablegeometricpropertyoftheembeddingdistribution. 1 ∑︂
Tovisualizethisrobustness,weplottheempiricalCDFofdis- 𝑐 𝑗 = |𝐶 𝑗|
𝑣∈𝐶𝑗
𝑣, 𝑗 =1,...,𝐿.
tancestothecentroid.Weconsiderboth(i)distancestotheglobal
Aroundeach𝑐 weconstructalocalpoisonedset𝑉(𝑗) bysampling
centroid of the entire database and (ii) distances to the cluster 𝑗 poison
centroidafterapplying𝑘-means.Figure4showsthat,underboth vectorsinatightneighborhoodof𝑐 𝑗 ,andformtheoverallpoisoned
Euclideanandcosinedistances,theCDFstaysnearzeroovera set𝑉 poison=⋃︁𝐿
𝑗=1
𝑉
p
(
o
𝑗
i
)
son
.
34
Empirically,thecluster-wisedesignsubstantiallyamplifiesthe 5 THEORETICALANALYSISOFBLACK-HOLE
attack’simpact.Inourexperiments,withapoisoningrateofonly
ATTACK
about1%,maliciousvectorsappearinroughly80%ofTop-10results
TheprecedingsectiondemonstratesthattheBlack-HoleAttack
across datasets and embedding models. This demonstrates that achievesstrongattackeffectivenessbysimplyinjectingasmall
byexploitinglocalcentroidsacrossdistinctsemanticclusters,the
numberofvectorsnearthecentroid.Anaturalquestionarises:why
Black-HoleAttacksignificantlydominatesthemajorityofqueries.
doessuchasimplestrategyworksowell?Inthissection,weprovide
atheoreticalanswer.Weshowthathigh-dimensionalembedding
4.3 SurrogateDatasetAttack spacesexhibitastructuralproperty,whichwetermcentrality-driven
Thecluster-wiseattackinSection4.2requirestheattackertoaccess hubness:vectorsnearthecentroidtendtobethenearestneighbor
thetargetdatabase’sstoredembeddings.However,thiscapability ofmostothervectors.Thispropertyisthefundamentalreasonwhy
maynotalwaysbeavailableinpractice—forinstance,whenthe theBlack-HoleAttacksucceeds.
databaseishostedinacontrolledenvironmentthatdoesnotex- Webeginwithamotivatingexample.
poseitsinternalvectors.Toaddressthisconstraint,weintroduce
Consideratypicalvectordatabasethatstores𝑛
| theSurrogateDatasetAttack,whichconstructsmaliciousvectors | | | | | | | Example5.1. | | | | | | |
| --------------------------------------------------------- | --- | --- | --- | --- | --- | --- | ----------- | --- | --- | --- | --- | --- | --- |
documentembeddings,eachofdimension𝑑,producedbyanem-
usingonlypubliclyavailabledata,withoutanyaccesstothetarget
| | | | | | | bedding | model. | The | embeddings | follow | some distribution | | with |
| --- | --- | --- | --- | --- | --- | ------- | ------ | --- | ---------- | ------ | ----------------- | --- | ---- |
database’sembeddings.
covariancematrixΣ.
Ourkeyobservationisthatqueryembeddingsandcorpusem-
beddingsexhibitasystematicdistributionalgapintheembedding TomakethesettinginExample5.1precise,wenowformalize
space:queriesaretypicallyinrelativelyfixedformssuchasinterrog- theembeddingsettingandthegeometricconditionsunderwhich
ativesentencesorentityphrases.Althoughqueriesfromdifferent centrality-drivenhubnessarises.
datasetscoverdiversetopics,theytendtoclusterinsimilarregions
Definition5.2.
thatareoffsetfromthecorpusdistribution.Thismeansthatqueries
• Followingpriorstudies[17,47],whichshowthatembed-
collectedfromonedatasetcanserveaseffectiveproxiesforthe
dingssatisfyacertaintypeofanisotropicdistribution,we
queriesofanotherdataset.
Giventhisinsight,theSurrogateDatasetAttackproceedsas assumethatqueriesaredrawnfromadistributionsimilar
| | | | | | | | tothatofthedatabasecorpus.Let𝑥 | | | | ,...,𝑥 | ∈ R𝑑 | bethe |
| ------------------------------------------------------- | --- | --- | --- | --- | --- | --- | ------------------------------ | --- | --- | --- | ------ | ---- | ----- |
| follows.Theattackercollectsquerytextsfromasmanypublicly | | | | | | | | | | | 1 | 𝑛 | |
embeddingvectors.Following[49,68,73],wemodelthem
availabledatasetsaspossibleandencodesthemusingthesame
asi.i.d.samplesfromananisotropicGaussianN(𝜇,Σ)with
| em b e d d i | ng m o de l | u se d b y | t h e t a r g et v | e c to r d a ta b a s | e . Le t 𝑄 = | | | | | | | | |
| ------------ | ----------- | ---------- | ------------------ | --------------------- | ------------ | --- | --- | ------- | --------- | ------------------ | -------- | --- | --- |
| | | | | | su rr | | Σ | 0. T he | s am p le | c en tr o i d is 𝑐 | 1 ∑︁ 𝑛 𝑥 | . | |
𝑞 ,. . . , 𝑞 ⊂ R 𝑑 d en o te t h e r e su l t in g s u r ro g at e q u e r y e m b e dd in g s. ⪰ = 𝑛 𝑘 1 𝑘
| 1 𝑀 | | | | | | | | | | | = | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
Theattackerthenpartitions𝑄 into𝐿 clustersusing𝑘-means • F ro m t he co v ar ia nc e m a t r ix Σ w e ex tr a c t t w otracestatis-
su r r
| | | | | | | | tics:𝑚 | 1 =tr(Σ),thetotalvarianceacrossalldimensions, | | | | | |
| -------------------------- | --- | --- | ------------ | --- | --- | --- | ------ | --------------------------------------------- | --- | --- | --- | --- | --- |
| andcomputesthecentroidofea | | | c h cluster: | | | | | | | | | | |
| | | | | | | | and𝑚 | =tr(Σ2),whichcaptureshowunevenlythevari- | | | | | |
2
| | | 1 | | | | | anceisdistributed.Wealsowrite𝐿=∥Σ∥op | | | | | forthelargest | |
| --- | ------ | ------- | -------- | ----------- | --- | --- | ------------------------------------ | --- | --- | ---- | ------ | ------------- | --- |
| | 𝑐surr= | | ∑︂ 𝑞, | 𝑗 =1,...,𝐿. | | | | | | | | | |
| | 𝑗 | |𝐶surr| | | | | | eigenvalue. | | | | | | |
| | | 𝑗 | 𝑞∈𝐶s urr | | | | Theeffectivedimension𝑑 | | | :=𝑚2 | [1,𝑑] | measures | |
| | | | 𝑗 | | | | • | | | eff | /𝑚 2 ∈ | | |
1
howmanydimensionscarrysubstantialvariance.Theef-
Maliciousvectorsarethengeneratedinatightneighborhoodaround
| | | | | | | | fectiverank𝑟(Σ):=𝑚 | | | 1/𝐿∈ [1,𝑑]quantifieshowdominant | | | |
| --- | --- | --- | --- | --- | --- | --- | ------------------ | --- | --- | ------------------------------- | --- | --- | --- |
eachsurrogatecentroid:
thetop-variancedirectionis;smaller𝑟(Σ)indicatesmore
| | | =𝑐s urr+𝜀 | ∼N(0,𝜎2 | | | | severeanisotropy[29,48]. | | | | | | |
| --- | ----- | --------- | ------- | ---- | --- | --- | ------------------------ | --- | --- | --- | --- | --- | --- |
| | 𝑣 𝑝,𝑗 | | 𝑗 , 𝜀 𝑗 | I𝑑), | | | | | | | | | |
𝑗
TheGaussianassumptionisadoptedtoenableacleanmathe-
andinjectedintothetargetdatabase.Notethattheattackernever
maticalanalysis;wewillverifythattheconclusioncontinuesto
accessesthetargetdatabase’sinternalvectors—itonlyneedssurro-
holdonrealembeddingsproducedbyembeddingmodels.Wenow
gatequerytextsandthecorrespondingembeddingmodel.
formallycharacterizetheconditionsunderwhichthecentroid𝑐is
WevalidatetheaboveinsightandevaluatetheSurrogateDataset
closertoatypicaldatapointthananyothervectorinthedatabase.
AttackinSection6(seeFigure7).Ouranalysisoftheembeddingdis-
| | | | | | | | Theorem5.3. | Fixafailureprobability𝛿 | | | (0,1).Define | | |
| --- | --- | --- | --- | --- | --- | --- | ----------- | ----------------------- | --- | --- | ------------ | --- | --- |
tributionsvalidatesthatquerydistributionsindeedtransferacross ∈
datasets.Meanwhile,across14surrogate–targetdatasetpairs,the 2 2(𝑛−1)
| | | | | | | | | 𝑡 1=log | , | 𝑡 2=log | . | | (3) |
| --- | --- | --- | --- | --- | --- | --- | --- | ------- | --- | ------- | --- | --- | --- |
attackachievessignificantimpactin10cases.Theremaining4pairs
| | | | | | | | | | 𝛿 | | 𝛿 | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
showlimitedeffectiveness,andineachcasethefailurestemsfrom
Ifthecovariancestatisticssatisfy
thetargetdataset’squeryandcorpusdistributionsbeingnearly
| | | | | | | | | √ | | 1)︂ | √ | | |
| --- | --- | --- | --- | --- | --- | --- | ---- | --- | --- | ------ | --- | --- | --- |
| | | | | | | | 2(︁𝑚 | | )︁ | (︂ (︁𝑚 | | )︁, | |
indistinguishableintheembeddingspace.Theseresultsleadto 1−2 𝑚 2 𝑡 2 > 1− 1+2 𝑚 2 𝑡 1+2𝐿𝑡 1 (4)
𝑛
twopracticalconclusions.First,anattackercanmountastrong
then,withprobabilityatleast1−𝛿,
Black-HoleAttackwithoutaccuratelyguessingtherealuserquery
distribution.Second,theattackismostdangerouswhenthereal min∥𝑥 𝑖−𝑥 𝑗∥2 > ∥𝑥 𝑖−𝑐∥2 . (5)
| queriesdeviatesubstantiallyfromthestoredcorpus,ascenario | | | | | | | | | 𝑗≠𝑖 | | | | |
| -------------------------------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
thatiscommoninreal-worlddeploymentswhereusersaskdiverse Intuitively,condition(4)reducesto
questionsbeyondtheknowledgebase. 𝑑 eff ≳log(𝑛/𝛿), 𝑟(Σ)≳log(1/𝛿), (6)
35
meaningthatthestoredvectorsareinsufficienttocovertheembedding effectiverankindirectionspace.Forany𝜀,𝛿 ∈ (0,1),providedthe
spaceofthisdimensionality,andtheanisotropyofthedistribution centralitygap(1−∥𝑐˜∥)𝜂 𝑖 staysboundedawayfrom0,thecondition
remainsmoderate. 2𝑚˜ 𝑛
𝑟(Σ˜ ) ≳ 1 log (13)
Proof. We first center the distribution. Since Euclidean dis- (1−∥𝑐˜∥)2𝜂2 𝜀𝛿
𝑖
N
tan
(
c
0
e
,Σ
s
)
ar
a
e
n
t
d
ra
𝑥
n
𝑖
s
−
la
𝑐
tio
=
n
𝑦
-i
𝑖
n
−
va
𝑦¯
ri
w
an
h
t
e
,
r
d
e
e
𝑦¯
fin
=
e
𝑛
𝑦
1
𝑘
∑︁
=
𝑛 𝑘=
𝑥
1
𝑘
𝑦 𝑘
−
.
𝜇
W
,
e
so
re
t
p
h
e
a
a
t
t
𝑦
e
𝑘
dl
∼
y
e
n
n
ei
s
g
u
h
re
b
s
ou
th
r
a
o
t
f
,w
at
it
l
h
ea
p
st
ro
(
b
1
a
−
bi
𝜀
li
)
t
𝑛
y
p
a
o
t
i
l
n
e
t
a
s
s
.
t1−𝛿,thehubisthenearest
usethefollowingstandardtailbound.
Lemma 5.4 (Gaussian qadratic-form tail [60]). Let 𝑧 ∼ 1. Mean-cosine identity. For a uniformly random index 𝐽 ∈
N(0,𝐼 𝑑)and𝐴⪰0.For𝑄 =𝑧⊤𝐴𝑧andany𝑡 ≥0,
{1,...,𝑛},anexactidentityholds:
Pr(︁𝑄 ≥tr(𝐴)+2√︁tr(𝐴2)𝑡+2∥𝐴∥op 𝑡)︁ ≤𝑒−𝑡, (7) E 𝐽[cos(𝑥˜ 𝑖 ,𝑥˜ 𝐽)] = 𝑛 1∑︂ 𝑛 𝑥˜ 𝑖 ·𝑥˜ 𝑗 =𝑥˜ 𝑖 ·𝑐˜=∥𝑐˜∥·𝜂 𝑖 . (14)
Pr(︁𝑄 ≤tr(𝐴)−2√︁tr(𝐴2)𝑡)︁ ≤𝑒−𝑡. (8) 𝑗=1
Thusthegapbetweenhubcosineandexpectedpairwisecosineis
Step1(upperboundonthecentroiddistance).Notethat𝑦 𝑖−𝑦¯∼
N(︁0, (1− 𝑛 1)Σ)︁.ApplyingLemma5.4with𝐴=(1− 𝑛 1)Σand𝑡 =𝑡 1 , Δ 𝑖 :=𝜂 𝑖−E 𝐽[cos(𝑥˜ 𝑖 ,𝑥˜ 𝐽)] =(1−∥𝑐˜∥)𝜂 𝑖 . (15)
√
Pr(︁∥𝑥 𝑖−𝑐∥2 2 > (︁1− 𝑛 1)︁(︁𝑚 1+2 𝑚 2 𝑡 1+2𝐿𝑡 1 )︁)︁ ≤𝑒−𝑡1. (9) 2.Beat-countexpectation.Define𝐵 𝑖 :=#{𝑗 ≠𝑖 : cos(𝑥˜ 𝑖 ,𝑥˜ 𝑗) >
Let𝐸
c
(
e
𝑖
n
)
t
denotetheeventthat∥𝑥 𝑖−𝑐∥2
2
doesnotexceedthisupper 𝜂
ex
𝑖}
p
,
e
t
c
h
t
e
at
n
io
u
n
m
,
berofstoredpointsbeatingthehub.Bylinearityof
bound.ThenPr(𝐸(𝑖) )≥1−𝛿/2.
cent
Step2(lowerboundonallpairwisedistances).Forany 𝑗 ≠ 𝑖, E[𝐵 𝑖] =(𝑛−1)·Pr(cos(𝑥˜ 𝑖 ,𝑥˜ 𝐽) >𝜂 𝑖). (16)
𝐽
𝑦 𝑖−𝑦
𝑗
∼N(0, 2Σ).ApplyingLemma5.4with𝐴=2Σ,𝑡 =𝑡
2
,and
aunionboundoverall𝑛−1choicesof𝑗 gives 3.TailestimateviaGaussianapproximation.Workingindi-
Pr(︁∃𝑗 ≠𝑖 :∥𝑥 𝑖−𝑥 𝑗∥2
2
<2(︁𝑚 1−2 √ 𝑚
2
𝑡
2
)︁)︁ ≤(𝑛−1)𝑒−𝑡2. (10) r
it
ec
h
t
a
io
s
n
m
s
e
p
a
a
n
ce
𝑥
,
˜ 𝑖
co
·
s
𝑐˜
(𝑥˜
=
𝑖 ,𝑥˜
∥
𝐽
𝑐˜
)
∥𝜂
=
𝑖
𝑥
a
˜ 𝑖
n
·
d
𝑥˜
v
𝐽
a
i
r
s
ia
a
n
l
c
in
e
e
𝜎
a
𝑖 2
rf
:
u
=
nc
𝑥˜
t
𝑖 𝑇
io
Σ˜
n
𝑥˜
a
𝑖
l
.
o
B
f
e
𝑥
c
˜
a
𝐽 ,
u
s
s
o
e
Let𝐸(𝑖) denotetheeventthateverypairwisedistanceexceedsthis thecovarianceΣ˜ isdefinedontheunitsphere,𝜎2 isdimension-
pair 𝑖
lowerbound.ThenPr(𝐸(𝑖) )≥1−𝛿/2. lessandmatchesthescaleofthecosine;since𝑥˜ 𝑖 isaunitvector,
Step3(comparingthe
pa
b
ir
ounds).On𝐸(𝑖) ∩𝐸(𝑖) ,whichoccurs
𝜎
𝑖
2≤∥Σ˜ ∥op=𝑚˜ 1/𝑟(Σ˜ ).UsingtheGaussiantailestimate,
cent pair
withprobabilityatleast1−𝛿,condition(4)guarantees (︃ Δ2 )︃ (︄ 𝑟(Σ˜ )Δ2)︄
2(︁𝑚 1−2 √ 𝑚
2
𝑡
2
)︁ > (︃ 1−
𝑛
1)︃ (︁𝑚 1+2 √ 𝑚
2
𝑡 1+2𝐿𝑡
1
)︁, (11) Pr(cos(𝑥˜ 𝑖 ,𝑥˜ 𝐽) >𝜂 𝑖)≲exp − 2𝜎 𝑖 𝑖 2 ≤exp − 2𝑚˜ 1 𝑖 . (17)
andthereforemin 𝑗≠𝑖∥𝑥 𝑖−𝑥 𝑗∥2 > ∥𝑥 𝑖−𝑐∥2 . □
Define𝛾 :=Δ
𝑖
2/(2𝑚˜ 1).Thus,
E[𝐵 𝑖] ≲(𝑛−1)exp(−𝑟(Σ˜ )𝛾). (18)
Interpretation. Tobuildintuitionforcondition(4),wederivea
looserbutmorereadableform.Ignoringthefactor (1− 𝑛 1) ≈ 1 4.Fromexpectationtofraction.Let𝑆 := ∑︁𝑛 𝑖=1 𝐵 𝑖 ,soE[𝑆] ≲
andnotingthat𝑡 2 ≈ log𝑛 𝛿 dominates𝑡 1 ≈ log 𝛿 1,thecondition 𝑛(𝑛−1)exp(−𝑟(Σ˜ )𝛾).DefineBad:={𝑖 :𝐵 𝑖 ≥1}.Since𝑆 ≥|Bad|,
approximatelyrequires Markov’sinequalitygives,forany𝜀 ∈ (0,1),
𝑚 1 ≳ √︁𝑚 2 log(𝑛/𝛿) + 𝐿log(1/𝛿). (12) Pr(|Bad|≥𝜀𝑛)≤ E[𝑆] ≲ 𝑛exp(−𝑟(Σ˜ )𝛾) . (19)
Dividingthefirsttermby √ 𝑚
2
andsquaringgives𝑑
eff
≳log(𝑛/𝛿); 𝜀𝑛 𝜀
dividingthesecondtermby𝐿gives𝑟(Σ) ≳ log(1/𝛿).Westress Forthistofallbelowaprescribed𝛿 ∈ (0,1),itsufficesthat𝑟(Σ˜ )𝛾 ≥
that these simplified conditions are not equivalent to the exact log(𝑛/(𝜀𝛿)).Substituting𝛾 =(1−∥𝑐˜∥)2𝜂
𝑖
2/(2𝑚˜ 1)yields
condition(4)—theyserveonlyasaninterpretiveguide.Nonetheless,
2𝑚˜ 𝑛
thesimplifiedformoffersclearintuition:thefirstconditionmeans 𝑟(Σ˜ ) ≳ 1 log . (20)
thatthe𝑛vectorsareinsufficienttocovertheembeddingspace, (1−∥𝑐˜∥)2𝜂2 𝜀𝛿
𝑖
whilethesecondensurestheanisotropyofthedistributionremains
Whenthisholds,Pr(|Bad| ≥ 𝜀𝑛) ≲ 𝛿,i.e.thehubisthenearest
moderate.
neighborofatleast(1−𝜀)𝑛pointswithprobabilityatleast1−𝛿.
Cosinedistance. Weshowcentrality-drivenhubnesspersistsun- Interpretation. The condition mirrors the Euclidean case and
der cosine distance. Normalize all vectors to unit length: 𝑥˜ 𝑘 = exposesthesametwoforces:alargercorpus(𝑛↑)raiseslog(𝑛/𝜀𝛿)
𝑥 𝑘/∥𝑥 𝑘∥for𝑘 =1,...,𝑛,andworkdirectlyinthisdirectionspace.
andmakesthehubhardertosustain,whilestrongeranisotropy
Let𝑐˜= 𝑛 1 ∑︁𝑛 𝑗=1 𝑥˜ 𝑗 bethesamplecentroidofthenormalizedvectors, (𝑟(Σ˜ )↓)inflatesthecosinevarianceandletsmorepointsovertake
anddefinethehubasitsprojectionbacktothesphere,ℎ=𝑐˜/∥𝑐˜∥.
thehub.Theboundisinformativeonlywhenthecentralitygap
Foraquerypoint𝑥˜
𝑖
,write𝜂
𝑖
:=𝑥˜
𝑖
·ℎ=cos(𝑥˜
𝑖
,ℎ).
Δ=(1−∥𝑐˜∥)𝜂
𝑖
isboundedawayfrom0;fortheembeddingmodels
Claim.Modelthenormalizedvectorsasi.i.d.withcovarianceΣ˜ := westudythisholds,andourexperimentsconfirmthepredicted
Cov(𝑥/∥𝑥∥).Write𝑚˜ 1 = tr(Σ˜ ) andlet𝑟(Σ˜ ) = 𝑚˜ 1/∥Σ˜ ∥op bethe scaling(Table1).
36
Table1:CentralitygapΔ=(1−∥𝑐˜∥)𝜂onHotpotQA[72]with Figure6reportstheresultsasfourheatmaps.Theexperimentcon-
modelBGE[70],Contriever[22],andGTE[75]. firmsourtheoryalongtwoaxes.First,dimensiongovernswhether
hubnessarisesatall:at𝑑=10thespaceistoolow-dimensionaland
BGE Contriever GTE
Prstaysnear0,butonce𝑑≥100theinjectedcentroiddominates,
withPrreaching1.0at𝑑=1000.Second,inthesingle-modesetting
Δ 0.23 0.24 0.24
Prdecaysasthecorpusgrows.Inthemulti-modesetting,theper-
modesizeisfixedat100pointsregardlessof𝑛,whichremovesthe
corpus-sizedependence:Prnolongerdecayswith𝑛andinsteadsta-
Discussion:FromSingleGaussiantoGaussianMixtures. Thethe-
bilizesaround0.6–0.7,dependingonlyondimension.Thisdirectly
oreticalanalysisaboveadoptsasingleanisotropicGaussianmodel
mirrorsourcluster-wisedesign,wherepartitioningthespaceinto
toobtainclean,interpretableconditions.Real-worldtextualembed-
manysmallclusterskeepseachlocaldistributioneffectivelylow-𝑛
dings,however,arenotoriouslymulti-modal:documentsspanning
andunimodal,sothehubnessconditioniseasilysatisfiedwithin
diversetopicsformdistinctsemanticclustersintheembedding
everycluster.
space.Undersuchamixturedistribution,theglobalcentroidmay
notliewithinanysinglesemanticregion,whichweakenscentrality-
drivenhubness.Thismulti-modalitycanbeaddressedbypartition-
ingtheembeddingspaceintosufficientlymanysmallclusters.In-
tuitively,fine-grainedclusteringisolatesdifferentsemanticmodes
fromoneanother,sothatwithineachclusterthelocaldistribution
isapproximatelyunimodal,bringingitclosertothesingle-Gaussian
regimeassumedbyTheorem5.3.Furthermore,sinceTheorem5.3’s
sufficientconditionscaleswithlog𝑛,asmallerper-clustersize𝑛
𝑗
substantiallyweakensthedependenceondatabasesize,making
thehubnessconditioneasiertosatisfylocally.
Validation. Wevalidatethecentrality-drivenhubnessphenome-
nononrealembeddings.WeconstructacorpusfromHotpotQA[72]
andembedthedocumentsusingthreeBGEmodels[70]withdi-
mensions 384, 768, and 1024. Let 𝑋 = {𝑥 1 ,...,𝑥 𝑛} denote the Figure 5: Hubness probability on real embeddings. Rows
databasevectorswithcentroid𝑐,and𝑄 ={𝑞
1
,...,𝑞 𝑚}thequery correspondtoembeddingdimensions(384,768,1024)and
vectors.Foreachvectorwecomputeitshubnessprobability,i.e., columnstodatabasesizes(100–100K).EachcellvalueisPr,
the probability that the centroid is closer than any other data- thefractionofvectorsforwhichthecentroidisthenearest
basevector:Pr 𝑋[𝑑(𝑥
𝑖
,𝑐) <min
𝑗≠𝑖
𝑑(𝑥
𝑖
,𝑥 𝑗)]forcorpusvectorsand neighbor.
Pr 𝑄[𝑑(𝑞 𝑖 ,𝑐) < min 𝑗 𝑑(𝑞 𝑖 ,𝑥 𝑗)] forqueryvectors.Figure5reports
thisprobabilityasaheatmap,whererowscorrespondtoembedding
dimensionsandcolumnstodatabasesizesrangingfrom100to100K.
Weevaluateundertwodistancemetrics(EuclideanandCosine)and
twocentroidscopes:theglobalcentroidoftheentiredatabaseand
cluster-wisecentroidsobtainedbypartitioningthedatabasewith
𝑘-means(eachclustercontainingabout100vectors).Theupperand
lowerhalvesofthefigurecorrespondtocorpusandqueryvectors,
respectively.Theresultsrevealpervasivecentrality-drivenhubness.
Undertheglobalcentroid,hubnessprobabilityishighforsmall Figure6:HubnessprobabilityonidealGaussiandistributions.
databasesbutdecaysasthedatabasegrows,sinceadenserspace Singledenotesaunimodalcorpusdrawnfromoneisotropic
weakensthecentroid’sdominance.Cluster-wisecentroidsdramat- Gaussian;Multidenotesamulti-modalcorpusdrawnfroma
icallyamplifytheeffect:hubnessprobabilityexceeds0.84under mixtureofGaussians.
Euclideanand0.74underCosineacrossalldatabasesizes,because
eachlocalcentroidonlyneedstodominateasmallneighborhood,
whichdirectlyexplainstheeffectivenessofthecluster-wiseBlack- 6 EVALUATIONONATTACKS 1
HoleAttack.Crucially,thelowerhalfofFigure5showsthatunseen
6.1 EvaluationSetup
queriesexhibitsimilarpatternstocorpusvectors,confirmingthat
centroidsattractindependentlydrawnqueriesaswell. 6.1.1 ModelSettings. Weadoptthefollowingembeddingmodels
Tobridgethegapbetweentheoryandrealdata,weconductan togeneratevectors:Contriever[22],astrongdenseretrievertrained
experimentonidealGaussiandistributions.Wesweeptwomodality
1Duetospaceconstraints,additionalexperimentsareprovidedintheappendixofthe
settings:single-mode,wheretheentirecorpusisdrawnfromone extendedversionathttps://arxiv.org/abs/2604.05480,including:(i)sensitivitytothe
Gaussian(asinglesemanticcluster),andmulti-mode,wherethe poisoningrate,(ii)ananalysisofclusteroverlap,(iii)thefullcluster-sizeimbalance
breakdown,(iv)attackeffectivenessonnon-Transformer-generatedembeddingssuch
corpusisdrawnfromamixtureofGaussianswith100pointsper
asSIFT[23],DEEP[1],andSPACEV[52],and(v)theeffectofmixingvectorsfrom
mode(emulatingthemanysemanticclustersofrealembeddings). differentembeddingmodels.
37
withcontrastivelearning;BGE-base-en-v1.5[70],BAAI’sgeneral- 6.2 OverallAttackEffectiveness
purposeembeddingmodel;andGTE-base-en-v1.5[75],anEnglish
Inthissection,wereporttheoveralleffectivenessoftheproposed
textembeddingmodelbasedontheGeneralizedTextEmbedding
Black-HoleAttack.Weevaluatethreeattackscenarios:thecluster-
architecture. wiseattackusingfulldatabaseaccess,theSurrogateDatasetAttack,
andtheattackonpre-embeddeddatasets.
| | | Our evaluation | involves 14 publicly | | | | | |
| ------------- | ------------ | -------------- | -------------------- | --- | --- | --- | --- | --- |
| 6.1.2 Dataset | Preparation. | | | | | | | |
availabletextdatasets:NaturalQuestions(NQ)[30],HotpotQA[72], FullDatabaseAccessAttack. Weinjectmaliciousvectorsata
MSMARCO[6],Climate-FEVER[12],NFCorpus[4],DBPedia[31], poisoningrateof1%,clusterthebenigndatabaseintomorethan
FiQA-2018[37],FEVER[57],SciFact[63],Touché-2020[3],SCI- 3000 clusters, and insert malicious vectors into the centroid of
DOCS[11],Quora[46],TREC-COVID[61],andArguAna[62].All eachcluster.Table2reportstheresultsacrossthreemodels,three
14datasetsarefromtheBEIRbenchmark[56].Wealsoincludethree datasets,andfourindextypes.Theattackisuniversallyeffective:
pre-embeddeddatasets:DBpedia-OpenAI-1M[54],Emoji-GTE[55], MO@10reaches68%–81%onHotpotQA(ASR>90%),47%–59%
and Wiki-CS-E5 [27]. For each text dataset, we use its original onNQ,and29%–58%onMSMARCO,withFPRvaluesaslowas
corpusandqueries.Duetothecomputationalcostofbrute-force 2.75.AllthreeANNindexes—HNSW,IVF-Flat,andIVF-PQ—exhibit
search,foreachevaluationrunwerandomlysample3,000queries attackeffectivenesscomparabletotheexactFlatindex,offering
fromthequerysettomeasureattackeffectiveness. noinherentresilience.Thevulnerabilityismodel-agnostic:while
Contrieveristhemostaffected,theattackremainshighlyeffective
WeemployFAISS[13]asourvector
| 6.1.3 VectorDatabaseSettings. | | | | | onBGEandGTEaswell. | | | |
| ----------------------------- | --- | --- | --- | --- | ------------------ | --- | --- | --- |
databasebackendandevaluateourapproachusingfourdistinct
index types: (1) Flat (exact brute-force search), (2) graph-based Table2:FullDatabaseAccessAttackEffectiveness
HNSW[38],(3)clustering-basedIVF-Flat[23],and(4)IVF-PQ[23].
SincetheFlatindexperformsexhaustivesearch,itservesasour
ground truth for nearest neighbors. Unless specified otherwise, Dataset Model Metric Flat HNSW IVF-F IVF-PQ
cosinesimilarityisusedasthedistancemetric. MO@10 76.97 80.86 79.98 75.36
| | | | | | Contriever | ASR 93.43 | 94.07 95.23 | 93.47 |
| --- | --- | --- | --- | --- | ---------- | --------- | ----------- | ----- |
| | | | | | | FPR 3.10 | 2.75 2.83 | 2.98 |
Weevaluateusingfourmetrics:Recall@K(R@K),
| 6.1.4 Metrics. | | | | | | MO@10 72.71 | 77.66 73.79 | 67.58 |
| -------------- | --- | --- | --- | --- | -------- | ----------- | ----------- | ----- |
| | | | | | HotpotQA | 94.40 | 95.30 95.10 | 91.13 |
MaliciousOccupancy@K(MO@K),FirstPoisonedRank(FPR),and BGE ASR
| | | | | | | FPR 3.58 | 3.11 3.48 | 3.84 |
| --- | --- | --- | --- | --- | --- | -------- | --------- | ---- |
AttackSuccessRate(ASR).
| | | | | | | M O @10 6 8 | . 1 0 7 2 . 1 3 7 0 . | 0 1 6 5 . 0 9 |
| ------ | ------------------------------------------ | --- | --- | --- | --- | ----------- | --------------------- | ------------- |
| LetD = | {𝑥 𝑖} 𝑁 denotethebenigndatabasevectorsandP | | | = | | | | |
| | 𝑖 =1 | | | | GTE | AS R 9 0 | . 4 3 9 1 . 8 3 9 2 . | 1 3 8 7 . 4 3 |
{𝑝 𝑗}𝑀 theinjectedmaliciousvectors.Thepoisoneddatabaseis FPR 3.99 3.60 3.81 4.07
𝑗=1
D′ =D∪P.LetQdenotethesetofevaluationqueries.Foreach MO@10 54.87 58.36 57.00 55.28
| | | | | | Contriever | ASR 72.10 | 75.13 74.87 | 73.27 |
| ------------------------------------------------ | ------ | --- | --- | ------- | ---------- | ----------- | ----------- | ----- |
| query𝑞 ∈Q,thevectordatabasereturnstherankedtop-𝐾 | | | | results | | | | |
| | | | | | | FPR 5.12 | 4.81 4.94 | 5.02 |
| 𝑅 𝐾(𝑞)=[𝑟 1(𝑞),...,𝑟 | 𝐾(𝑞)]. | | | | | | | |
| | | | | | | MO@10 29.62 | 31.03 30.84 | 30.14 |
MSMARCO
| | | | | | BGE | ASR 46.23 | 47.53 48.00 | 47.67 |
| --- | --- | --- | --- | --- | --- | --------- | ----------- | ----- |
MaliciousOccupancy@K(MO@K). MO@Kquantifiesthefrac- FPR 7.42 7.29 7.31 7.35
tionofthetop-𝐾resultsoccupiedbymaliciousitemsinthepoisoned
| | | | | | | MO@10 30.54 | 31.23 31.95 | 30.64 |
| --- | --- | --- | --- | --- | --- | ----------- | ----------- | ----- |
database.Definethenumberofmaliciousresultsinthetop-𝐾 list GTE ASR 48.10 48.83 50.07 48.53
| as | | | | | | FPR 7.36 | 7.30 7.23 | 7.29 |
| --- | --- | --- | --- | --- | --- | ----------- | ----------- | ----- |
| | | | | | | MO@10 52.91 | 55.32 54.44 | 51.67 |
𝐾
| | | ∑︂ | | | Contriever | ASR 72.63 | 73.87 74.50 | 72.47 |
| --- | ------- | -------- | ------ | --- | ---------- | --------- | ----------- | ----- |
| | 𝑚 𝐾(𝑞)= | [︁𝑟 𝑡(𝑞) | ∈P ]︁, | | | FPR 5.31 | 5.08 5.18 | 5.32 |
1
| | | 𝑡=1 | | | NQ | MO@10 57.90 | 59.41 59.02 | 57.96 |
| --- | --- | --- | --- | --- | --- | ----------- | ----------- | ----- |
| | | | | | BGE | ASR 80.30 | 80.97 81.43 | 80.67 |
then
| | | | | | | FPR 4.90 | 4.76 4.79 | 4.84 |
| --- | ---- | ----- | ---- | --- | --- | ----------- | --------------------- | ------------- |
| | | 1 ∑︂𝑚 | 𝐾(𝑞) | | | M O @10 4 7 | . 1 8 4 8 . 0 7 4 9 . | 1 5 4 6 . 0 3 |
| | MO@𝐾 | | . | | | AS R 6 9 | . 9 0 7 0 . 3 7 7 2 . | 9 7 6 9 . 3 3 |
| | | = | | | GTE | | | |
| | | |Q| | 𝐾 | | | FPR 5.87 | 5.79 5.70 | 5.88 |
𝑞∈Q
HigherMO@10andASRindicateastrongerattack,whilelowerFPRindicates
| | | FPRmeasureshowearlythefirstma- | | | astrongerattack. | | | |
| --- | --- | ------------------------------ | --- | --- | ---------------- | --- | --- | --- |
FirstPoisonedRank(FPR).
| liciousitemappearswithinthetop-𝐾 | | list: | | | | | | |
| -------------------------------- | --- | ----- | --- | --- | --- | --- | --- | --- |
Figure7evaluatestheSurrogate
FPR(𝑞)=min{𝑡 ∈{1,...,𝐾}:𝑟 𝑡(𝑞) ∈P}, min∅:=0. SurrogateDatasetAttack.
DatasetAttack,wheretheattackerconstructsmaliciousvectors
WereportthemeanFPRoverquerieswithFPR(𝑞) >0. solelyfrompubliclyavailablequerysetswithoutanyaccesstothe
targetdatabase’sinternalembeddings.Query-Corpussimilarityis
Attack Success Rate (ASR). ASR is the fraction of queries for themeancosinesimilaritybetweenqueryandcorpusembeddings
whichatleastonemaliciousitemappearsinthetop-𝐾 results: fromthesamesource,andQuery-Querysimilarityisthemean
pairwisecosinesimilarityamongsurrogatequeryembeddings.For
1 ∑︂ [︁FPR(𝑞) >0]︁. comparison,wealsoplottheFullDatabaseAccessAttack(orange
| | ASR= | 1 | | | | | | |
| --- | ---- | --- | --- | --- | --- | --- | --- | --- |
|Q|
| | | 𝑞∈Q | | | dashedline),whichusesthevictim’sowncorpusembeddingsto | | | |
| --- | --- | --- | --- | --- | ----------------------------------------------------- | --- | --- | --- |
38
constructmaliciousvectors.TheSurrogateAttack(bluesolidline)
achievesstrongeffectivenesson10of14datasets(MO@10>30%),
withclimate-feverreaching98.3%,whilethefourfailures—scidocs,
quora,trec-covid,andarguana—allsharehighQuery-Corpussim-
ilarity(0.594–0.949),indicatingnear-overlapbetweenqueryand
corpusdistributionsthatmitigatestheperformanceoftheattack.
Notably,onseveraldatasets(climate-fever,hotpotqa,nfcorpus,db-
pedia,fiqa,fever),theSurrogateAttackevensurpassestheFull
Accessbaseline,demonstratingthatpreciselymatchingthevic-
tim’scorpusdistributionisunnecessary:asurrogatequerypool
canexploitthesamehubnessgeometrymoreeffectivelythanthe
victim’sownembeddings.Attackeffectivenessdependsonthis
distributionalgapratherthanonaccuratelyguessinguserqueries,
dramaticallyloweringthepracticalbarrieroftheBlack-HoleAttack.
100
80
60
40
20
0
climate-fever hotpotqa nfcorpus nq dbpedia fiqa fever scifact msmarco touche2020 scidocs quora trec-covid arguana
)%(
01@OM
Surrogate MO@10 Full Access MO@10 Query-Corpus Sim. Query-Query Sim.
1.0
0.8
0.6
0.4
ytiralimiS
enisoC
19.3%to54.8%—a184%increase—whileonNQ,MO@10nearlydou-
blesfrom26.4%to52.1%.Notably,HotpotQAachievesanMO@10
of61.9%atonly10%export,indicatingthatevenminimaldatabase
accesssufficesforapracticalattack.Theseresultshighlightthatour
attackdoesnotdependonfullcorpusaccessandscalespredictably
withtheexportedportion.
6.3.2 Robustness to Dynamic Data Updates. Real-world vector
databasesarecontinuallyupdated,soweevaluatehowdynamic
data updates affect the attack. We vary both data addition and
deletionfrom0%to50%ofthecorpussize.Totesttheattackun-
derstrongdistributionaldrift,theinsertedvectorsaredrawnfrom
otherdatasetsratherthanthetargetcorpusitself.Theresults(Fig-
ure8b)showthatdeletionslightlyimprovesattackeffectiveness,
asremovingbenignvectorsthinstheneighborhoodaroundthe
maliciouscentroids.Insertionshiftsthedatadistributionandde-
gradestheattack,buttheeffectislimited:evenafter50%insertion,
MSMARCOdropsbyonly1%inMO@10,andHotpotQAstillmain-
tains33%MO@10.Inadditiontodatachurn,productionsystems
alsorebuildtheirindexesandoccasionallyre-embedtheircorpora.
Re-indexingdoesnotaffecttheattack:asTable2shows,attack
effectivenessremainsconsistentacrossfourindextypes,sincethe
attackexploitsembeddinggeometryratherthanindexstructure.
Re-embeddingthecorpuswithanewmodelremovestheinjected
maliciousvectorsfromthedatabaseentirely,andisthereforeanef-
Figure7:SurrogateDatasetAttackvs.FullDatabaseAccess fectivedefense.However,itsprohibitivecomputationalcostmakes
Attackacross14BEIRdatasets. itimpracticalforfrequentdeploymentinproductionsystems.
6.4 SensitivityAnalysis
PoisoningPublicPre-EmbeddedDatasets. Table3reportsthe
attackonthreepubliclyavailablepre-embeddeddatasets,wherethe 6.4.1 SensitivitytoNumberofClusters. Toanalyzetheeffectofthe
attackerdirectlydownloadsthepre-computedvectors,constructs cluster-wisedesigninSection4.2,wevarythenumberofcluster
maliciousvectorsviaclustering,andinjectsthem—withoutever centersusedtoconstructlocalblack-holecenters.Figure8creports
runninganembeddingmodel.Acrossallthreedatasets,theattack theresultingMO@10asafunctionof𝐿underafixedpoisoning
achievesMO@10above71%,ASRabove93%,andFPRbelow4, rateof1%.WeobservethatMO@10generallyincreasesas𝐿grows,
coveringdifferentembeddingmodels(OpenAItext-embedding-3- indicating stronger malicious presence in the Top-10 results. It
large,GTE-large-en-v1.5,E5-base)anddiversedatamodalities(en- suggeststhatamoderatenumberofclustercentersissufficientto
titydescriptions,emoji-textpairs,Wikipediaarticles).Thisdemon- covermostqueryregionsforthisdataset.
stratesthattheBlack-HoleAttackreadilyextendstoreal-world
6.4.2 SensitivitytoClusteringQuality. WeuseFAISS-GPUtoclus-
pre-embeddeddatasetssharedonopenplatformssuchasHugging
terthecorpus,whichproceedsintwostages:(1)ittrainsthecen-
Face.
troidsonasampleofthecorpus,and(2)itassignsallcorpusvectors
tothelearnedcentroids.Thetrainingsamplesizegovernsthequal-
Table3:Resultsonprecomputed-vectordatasets.
ityofclustering.Wefixthenumberofcentroids𝐿andthenumberof
trainingiterationsto25,thenvarythenumberoftrainingsamples
Dataset MO@10 ASR FPR percentroid𝑠(sothetotaltrainingsetsizeis𝐿·𝑠),therebycontrol-
DBpediaOpenAI1M 71.10 93.74 3.76 lingclusteringquality.Figure8dreportsMO@10underincreasing
EmojiGTE 75.52 98.66 3.43 𝑠. When only one point per centroid is sampled (𝑠=1), MO@10
WikiCSE5 72.38 94.09 3.62 remainsbelow2%acrossalldatasets.As𝑠 grows,MO@10rises
sharplyandsaturatesunderfullsamplingat76.97%,52.91%,and
54.87%onHotpotQA,NQ,andMSMARCO,respectively.Overall,
higherclusteringqualityconsistentlyleadstostrongerattackper-
6.3 RobustnessAnalysis
formance,confirmingthatawell-clusteredcorpusrepresentation
6.3.1 RobustnesstoPartialDatabaseExport. Toanalyzetheimpact isessentialtotheeffectivenessofourmethod.
ofpartialdatabaseaccess,weevaluatetheattackunderexportra-
tiosrangingfrom0.1to1.0.Figure8ademonstratesthatourattack 6.4.3 SensitivitytoClusterSize. Weanalyzehowclustersizeaffects
remainshighlyeffectiveunderlimitedexports,withMO@10im- theBlack-HoleAttackbymeasuringMO@10acrossclustersof
provingsteadilyastheratioincreases.OntheMSMARCOdataset, differentsizes.AsshowninFigure9,𝑘-meansclusteringproduces
expandingtheexportratiofrom0.1to1.0improvesMO@10from clusterswhosesizesspanawiderange,fromaround100upto
39
| | | | | HotpotQA | NQ | MSMARCO | | | | | |
| --- | --- | --- | --------- | -------- | --- | ------- | --- | --- | --- | --- | --- |
| | | | Insertion | | | | | | 80 | | |
| 60 | | 50 | | | | 60 | | | 60 | | |
)%( 01@OM
| 40 | | 0 | Deletion | | | 40 | | | 40 | | |
| --- | --- | --- | -------- | --- | --- | --- | --- | --- | --- | --- | --- |
20
| 20 | | 50 | | | | 20 | | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
0
| 0 | | 0 | | | | 0 | | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
0.1 0.3 0.5 1.0 0.0 0.1 0.2 0.3 0.4 0.5 1K 2K 3K 4K 5K 6K 7K 8K 9K 1 10 100 Full
Ratio of exported vectors Ratio Number of clusters kc Sample Points per Centroid
(a)PartialExport (b)Addition&Deletion (c)NumberofClusters (d)ClusteringQuality
Figure8:RobustnessandSensitivityAnalysisoftheBlack-HoleAttack.
2K+.Theresultsshowthatclustersizehasdifferenteffectsacross thisextremecompressionalreadydegradesretrievalaccuracy;at
datasets,andMO@10remainsconsistentlysignificantacrossall standardsettings(𝑀 64),theattackremainsintact.Together,
≥
sizegroups.ThisconfirmsthattheBlack-HoleAttackisrobust theseresultsconfirmthatunderdifferentANNindexparameters,
tothesizeimbalanceof𝑘-meansclusteringanddoesnotrelyon theBlack-HoleAttackisalwayseffective.
uniformlysizedclusters.
Wefurtheranalyzehowthe HNSW: ef_search HNSW: M HNSW: ef_construction
| 6.4.4 SensitivitytoClusterDensity. | | | | | | 100 | | 100 | | 100 | |
| ---------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
)%( 01@OM
localdensityaroundaqueryaffectstheBlack-HoleAttack.Foreach 75 75 75
query,wedefineitslocaldensityasthemeansimilaritytoits10 50 50 50
nearestlegitimatedocuments:ahighervaluemeansthequerysits 25 25 25
| inadenserregion.Wesortqueriesbythisdensityandmeasure | | | | | | 0 | | 0 | | 0 | |
| ---------------------------------------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
MO@10acrossdensitygroups,fromthesparsesttothedensest.As 16 32 64128256512 4 8 16 32 64 40 100200400800
showninFigure9,MO@10decreasesasdensityincreases:whena ef_search M ef_construction
| | | | | | | IVF: nprobe | | | IVF: nlist | | IVFPQ: M |
| --- | --- | --- | --- | --- | --- | ----------- | --- | --- | ---------- | --- | -------- |
queryisclosetocorpusvectors,thosenearbydocumentscompete 100 100 100
)%( 01@OM
morestronglywiththeinjectedcentroidandpulldowntheattack 75 75 75
effectiveness.Nevertheless,eveninthedensestregionsMO@10 50 50 50
remainssignificantacrossalldatasets,showingthathigherdensity 25 25 25
onlyweakenstheattackgraduallyratherthaneliminatingit.
| | | | | | | 0 | | 0 | | 0 | |
| --- | -------- | ---------- | --- | --- | --- | --- | ------------ | --- | -------------- | ---- | --------------- |
| | | | | | | 16 | 32 64 128256 | | 1024 2048 4096 | 8192 | 48 64 96 128192 |
| | | | | | | | nprobe | | nlist | | M |
| | HotpotQA | NQ MSMARCO | | | | | | | | | |
MO@10 vs cluster size MO@10 vs cluster density Figure10:SensitivityoftheBlack-HoleAttacktoANNindex
| 100 | | 100 | | | | | | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
)%( 01@OM parameters (HNSW, IVF, IVFPQ) on HotpotQA with Con-
| | | | | | triever. | Gray | dashed | lines | indicate | the Flat | (exact search) |
| --- | --- | --- | --- | --- | -------- | ---- | ------ | ----- | -------- | -------- | -------------- |
| 50 | | 50 | | | | | | | | | |
baseline.
| 0 | | 0 | | | | | | | | | |
| --------- | ------- | --- | --- | ------- | --- | --- | --- | --- | --- | --- | --- |
| 100- 500- | 1K- 2K+ | | 0.5 | 0.6 0.7 | | | | | | | |
| 500 1K | 2K | | | | | | | | | | |
Query local density
| Cluster size | | | | | 6.5 | CostandAnalysis | | | | | |
| --------------- | -------------- | ---- | ----------- | -------- | ----- | --------------------------- | --- | --- | ------------------------- | --- | --- |
| | | | | | 6.5.1 | ScalabilitytoLargerCorpora. | | | ToverifythattheBlack-Hole | | |
| Figure 9: MO@10 | versus cluster | size | and cluster | density. | | | | | | | |
Attackscalesbeyondthe1M–10Mrange,weconductexperiments
Querylocaldensityisdefinedasthemeansimilarityofa
onMSMARCOv2[6,15,40](138Mdocuments,Contrieverembed-
querytoits10nearestlegitimatedocuments;ahighervalue
dings).WeevaluateboththeFullDatabaseAccessAttackandthe
indicatesadenserregion.
SurrogateDatasetAttack.Toobtainasufficientlylargesurrogate
queryset,weleveragethequerysetofMSMARCOWebSearch[8],
6.4.5 SensitivitytoANNIndexParameters. Wesystematicallyab- whosequeriesareindependentlycollectedandhavenooverlap
latethekeyparametersofthreewidelyusedANNindexes—HNSW, withtheMSMARCOv2queries,eliminatinganyriskofqueryleak-
IVF,andIVFPQ,comparingtoaFlatbaselinethatusesexactsearch: age.Wefilter4MEnglishqueriesfromthisdatasetandcombine
77.30%.TheresultsareconsolidatedinFigure10.Acrossallthree themwithqueriesfromotherBEIRdatasetstoformthesurrogate
indextypes,attackeffectivenessfluctuatesonlymoderatelyand pool.Table4reportstheresults.Bothattackvariantsachievestrong
remains closetothe Flat baselineunder allpracticalparameter effectivenessonthis138M-documentcorpus.TheSurrogateDataset
settings. For HNSW, varying ef_search (16–256), M (4–64), and AttackattainsMO@10of81.53%andASRof89.80%,andtheFull
ef_construction(40–800)yieldsMO@10consistentlywithin±10% Database Access Attack reaches MO@10 of 63.99% and ASR of
ofFlat.ForIVF,varyingnprobe(16–256)andnlist(1024–8192)pro- 75.60%.Notably,bothmethodsperformevenbetterthanonthe9M
ducessimilarlystableresults.ForIVFPQ,settingthesub-quantizer MSMARCObenchmark,confirmingthattheBlack-HoleAttack
countMto48slightlyweakenstheattack(stillaround50%),but remainseffectiveatlargerdatabasesizes.
40
Table4:Black-HoleAttackonMSMARCOv2.
Clean Poisoned
| | | | rerank: 10 | | rerank: 15 |
| -------------- | --------- | --- | ---------- | --- | ---------- |
| AttackScenario | MO@10 ASR | FPR | 50 | 50 | |
1F
| | | | 25 | 25 | |
| ---------------------- | ----------- | ---- | ---------- | --- | ---------- |
| FullDatabaseAccess | 63.99 75.60 | 4.29 | | | |
| SurrogateDatasetAttack | 81.53 89.80 | 2.70 | 0 | 0 | |
| | | | rerank: 20 | | rerank: 25 |
| | | | 50 | 50 | |
1F
6.5.2 AnalysisofClusteringCost. Weexaminethecostoftheclus- 25 25
teringusingMSMARCO-v2.WeusetheFAISS-GPU𝑘-meansimple-
| | | | 0 | 0 | |
| --- | --- | --- | --- | --- | --- |
mentationonanH200GPUandmeasuretheclusteringtimealong HotpotQA 2WikiMQA MuSiQue HotpotQA 2WikiMQA MuSiQue
twoaxes:(i)thecorpussize,variedfrom100Kto100Mvectorsata
fixedsamplingbudget(25%ofthecorpus);and(ii)thenumberof
Figure12:ImpactoftheBlack-HoleAttackondownstream
trainingsamplespercentroid,variedonafixed10M-vectorcorpus. RAGapplications.
TheresultsareshowninFigure11.Evenat100Mvectors,clustering
completeswithinthreehours.Forcorporaatthebillion-vectorscale,
theattackercanalternativelyusetheSurrogateDatasetAttack:it flagsvectorstooclosetoclustercentroidsasmalicious—adesign
clustersafarsmallersetofsurrogatequeriesratherthantheentire thatmirrorstheFullDatabaseAccessAttack.Figure13reports
corpus,sidestepsthelarge-corpusclusteringcost,andstillachieves theconfusionmatricesunderbothattackmodesonHotpotQA.At
10,000clusters,thefilterflags98.3%ofmaliciousvectorsunder
strongattackeffectiveness.
FullDatabaseAccess(TP),butonly13.5%ofmaliciousvectorsare
flaggedunderSurrogateDatasetAttack.Thisgaparisesbecausethe
| 104 Runtime vs dataset size | Runtime vs sample size | | | | |
| --------------------------- | ---------------------- | --- | --- | --- | --- |
surrogatequerydistributiondivergesfromthevictimcorpusdistri-
| )s( emit gniretsulC | 125 | | | | |
| ------------------- | --- | --- | --- | --- | --- |
103 bution;centroidslearnedfromsurrogatequeriesdonotprecisely
100 alignwiththevictim’sembeddingclusters,causingthefiltertomiss
102
| | 75 | | mostinjectedvectors.TrustRAG[78]appliesK=2clusteringtothe | | |
| --- | --- | --- | --------------------------------------------------------- | --- | --- |
101
50
top-10retrievalresultsofeachqueryandflagsthedenserclusteras
| 100 | 25 | | | | |
| --- | --- | --- | --- | --- | --- |
malicious.Figure14showsthatthismethodcanflagasubstantial
100K 1M 10M 100M 1 10 100 Full fractionofmaliciousvectors(TP73.7%forFullAccess,58.3%for
| Dataset size | Samples per centroid | | | | |
| ------------ | -------------------- | --- | --- | --- | --- |
Surrogate).However,theBlack-HoleAttackalreadydominatesthe
top-10results—MO@10isupto76.97%.EvenafterTrustRAGre-
Figure11:ClusteringcostonanH200GPU.Left:runtime
versuscorpussizeatafixedsamplingbudget.Right:runtime movesmostflaggedmaliciousvectors,theremainingtop-10consists
versusthenumberoftrainingsamplespercentroidonafixed oftheunflaggedmaliciousones,withonly1–3cleandocuments
surviving.Moreover,unlikeSeCon-RAG,TrustRAGcannotdirectly
10M-vectorcorpus.
removemaliciousvectorsfromthecorpus—itonlyfiltersatquery
time,leavingthepoisonedvectorsinthedatabase.
6.6 AnalysisonDownstreamRAGApplications
| | | | Full Access | Full Access | Full Access |
| --------------------------------------- | ------------------ | --- | ------------ | ------------- | -------------- |
| 6.6.1 AttackEffectivenessonQAPipelines. | Weusethereproduced | | | | |
| | | | Clusters=100 | Clusters=1000 | Clusters=10000 |
LongRAG[76]pipelineasthedownstreamapplicationandpoison TP FP TP FP TP FP
its underlying vector database with the Black-Hole Attack. Fig- 30.4% 0.0% 82.3% 0.2% 93.7% 2.4%
ure12reportstheend-to-endQAperformancebeforeandafter FN TN FN TN FN TN
| | | | 69.6% 100.0% | 17.7% 99.8% | 6.3% 97.6% |
| --- | --- | --- | ------------ | ----------- | ---------- |
poisoning.Theresultsshowthattheattacksubstantiallydegrades Surrogate Surrogate Surrogate
answerqualityonallthreebenchmarks.OnHotpotQA,theF1score Clusters=100 Clusters=1000 Clusters=10000
| | | | TP FP | TP FP | TP FP |
| --- | --- | --- | ----- | ----- | ----- |
dropsfrom51.8to37.0;on2WikiMQA[20],itdropsfrom44.5to
| | | | 0.2% 0.0% | 1.2% 0.2% | 13.5% 2.4% |
| --- | --- | --- | --------- | --------- | ---------- |
33.3;andonMuSiQue[58],itdropsfrom23.2to7.5.Theseresults
| | | | FN TN | FN TN | FN TN |
| --- | --- | --- | ----- | ----- | ----- |
indicatethatpoisoningonlythevectordatabaseissufficientto 99.8% 100.0% 98.8% 99.8% 86.5% 97.6%
severelyimpairtheperformanceofastrongdownstreamRAGsys-
Figure13:DetectionaccuracyofSeCon-RAGonmalicious
tem.Wefurtherevaluatetheeffectofvaryingthererankdepth.
Figure12showsthatwhilemorecandidatesimprovethecleanF1 vectors. Columns: number of clusters used by the SeCon-
asexpected,theattacksuccessrateremainsabove80%acrossall RAGfilter.TP:maliciousvectorscorrectlyflagged.FP:clean
datasetsevenunderthelargestrerankbudgettested.Thisindicates vectorsfalselyremoved.FN:maliciousvectorsmissed.TN:
cleanvectorscorrectlyretained.
thatrerankingalone,withoutdedicateddefensemechanisms,does
notmeaningfullymitigatetheBlack-HoleAttack.
Beyondclustering-
6.6.2 ImpactofFiltering-BasedDefensesontheBlack-HoleAttack. 6.6.3 RobustnesstoContent-LevelInspection.
RAGpipelinesoftenemployclustering-basedmethodsforseman- basedfilters,RAGpipelinesalsodeploycontent-levelinspection,
ticfilteringandduplicatedetectiontodefendagainstadversarial includingsourcevalidationandlightweightcontentsanity
poisoning.SeCon-RAG[51]partitionsthecorpusintoclustersand checks.Suchdefenses,however,areill-suitedtotheBlack-Hole
41
Full Access Surrogate top-𝑘 nearestneighborsin𝑋,anddefinethehitcountℎ
𝑖
ofeach
TP FP TP FP vector𝑥 asthenumberofprobesthatretrieveit.Sincemostvectors
73.7% 4.2% 58.3% 0.5% 𝑖
areneverretrieved(ℎ
𝑖
=0),wecomputethemedian𝑚overonly
FN TN FN TN thestrictlypositivehitcounts,andmarkavectorassuspiciousand
26.3% 95.8% 41.7% 99.5%
removeitbeforeretrievalifℎ >2𝑚.Whenusingabrute-force(Flat)
𝑖
index,thedetectionprocedurerequiresanadditional𝑘-NNpassfor
Figure14:DetectionaccuracyofTrust-RAG.
eachprobevector,yielding𝑂(|𝑃|·𝑁 ·𝑑)complexity,i.e.,𝑂(𝑁2𝑑)
intheworstcase.Thedefensereusesthedatabase’sexistingANN
Attack.Unlikeadversarial-corpus-poisoningattacksthatperturba index,soitincursnoadditionalindexingoverhead.Weevaluate
giventexttoderiveanadversarialembedding,theBlack-HoleAt- thisdetection-baseddefensewithaproberatioof0.1%percluster.
tackconstructsmaliciousvectorsdirectlyintheembeddingspace Table6reportstheresultsunderboththeFull-ExportAttackand
andonlylaterassignstextcontenttothem.Theattackerthere- the Surrogate Dataset Attack. Under the full-export attack, the
foreretainscompletefreedomtodesigntheaccompanyingtextto defenseishighlyeffective:itreducesMO@10from76.97%,54.87%,
evadetext-levelfilters.Forsourcevalidation,RAGParadox[10]has and52.91%to7.09%,1.50%,and1.63%onHotpotQA,MSMARCO,
shownthatmalicioustextscanbepairedwithfabricatedbutplau- andNQrespectively,whilepreservinghighretrievalquality(R@10
siblesourceattributions,effectivelybypassingsource-levelchecks. 94.51%–96.34%).Underthesurrogateattack,however,thedefense
Forlightweightcontentsanitychecks,CPA-RAG[34]showsthat issubstantiallyweakened—onHotpotQAandNQ,MO@10drops
adversariallygeneratedmalicioustextswithstrongfluencyand onlymarginally(from93.36%to91.90%andfrom81.45%to68.13%,
generalizationcanreliablyevadeperplexityandreadabilityfilters. respectively).Thisgaparisesfromthesamedistributionalmismatch
discussedinSection6.6.2:theprobevectorsaredrawnfromthe
7 DEFENSESAGAINSTBLACK-HOLEATTACK corpusdistribution,whereasthesurrogateattackplacesmalicious
HubnessMitigation. SincetheBlack-HoleAttackexploitscen- vectorsinquery-offsetregions,sotheyarerarelyretrievedbythe
tralitydrivenhubness,anaturaldefenseistoreducehubnessin probesandevadethehit-countfilter.Despiteitslimitationsagainst
theembeddingspace.Weevaluatethreerepresentativemethods: surrogateattacks,thedetection-baseddefenseiscomputationally
ZN(Z-scorenormalization)[16,59],CL2(CenteredL2normaliza- lightweight:withANNacceleration,theprobesearchcompletes
tion) [67], and noHub [59]. Table 5 reports MO@10 and R@10 inseconds,makingitpracticaltodeployasaroutinesafeguard
undereachdefensewithContrieverembeddingsandFlatsearch. againstfull-export-stylethreats.
ZNpreserveshighretrievalquality(R@1085.83%–89.67%)butfails
tosuppresstheattack(MO@1065.36%–83.13%).noHubachieves Table6:Detection-baseddefenseunderFull-ExportAttack
strongattacksuppressiononHotpotQAandMSMARCO(MO@10 andSurrogateDatasetAttack,andprobesearchtimeacross
0.71%–13.91%),butdegradesR@10tonearzeroandleaksseverely ANNindextypes.
onNQ(MO@1047.27%).CL2providesthebestoveralltradeoff,
reducingMO@10to1.66%–12.25%whileretainingmoderateR@10 Full(MO@10) Surrogate Time(s)
Dataset R@10
(58.65%–76.70%).Theseresultsshowthathubnessmitigationcan Before After Before AfterFlat HNSW IVF IVFPQ
defendagainsttheBlack-HoleAttack,buteverymethodforcesadif- HotpotQA 96.34 76.97 7.09 93.36 91.90 9k 4.4 7.5 1.3
MSMARCO 94.55 54.87 1.50 38.99 17.37 25k 6.1 16.6 2.3
ficultchoicebetweensecurityandretrievalutility—noneachieves
NQ 94.51 52.91 1.63 81.45 68.13 2k 2.1 1.8 0.6
bothsimultaneously.
Table5:DefenseeffectivenessagainsttheBlack-HoleAttack: 8 CONCLUSION
MO@10andR@10withFlatsearch.
WepresenttheBlack-HoleAttack,aquery-agnosticpoisoningattack
againstvectordatabasesgroundedincentrality-drivenhubness.By
MO@10 R@10 injectingasmallnumberofmaliciousvectorsattheglobalorcluster-
Dataset ZN CL2 noHub ZN CL2 noHub wisecentroid,anattackercanhijackTop-𝑘resultsformostqueries
HotpotQA 83.13 1.66 0.71 85.83 58.65 5.45 withoutanyknowledgeoftheircontent.Wedefinefourattackpaths
MSMARCO 65.36 12.25 13.91 89.67 76.70 11.38 alongacapabilityspectrumandshowstrongeffectivenessacross
NQ 68.66 10.00 47.27 87.48 66.78 10.44
allscenarios.Amongthedefenseswestudy,hubnessmitigation
providesonlypartialprotection.Thedetection-baseddefenseis
Detection-Based Defense. We next study a more conservative highlyeffectiveagainstthefull-exportattack.However,itlargely
defensethatoperatesdirectlyonthestoredcorpusvectors.Theidea failsagainsttheSurrogateDatasetAttack.Arobustandadaptive
istouseasmallprobesetdrawnfromthedatabaseitself,measure defenseremainsanopenproblem.
howofteneachstoredvectorisretrievedasanearestneighborof
theseprobes,andremovethevectorsthatareselectedunusually ACKNOWLEDGMENTS
often.Letthestoredcorpusvectorsbe𝑋 ={𝑥 𝑖}
𝑖
𝑁
=1
⊂R𝑑.Wefirst ThisworkwassupportedinpartbytheNationalNaturalScience
partition𝑋 into𝐿clustersand,tocoverdifferentsemanticregions, FoundationofChina(No.92470204,U24B20147),andJSTPRESTO
sampleasmallprobesetfromeachcluster(0.1%ofitsvectors,at (JPMJPR23P5),JSTCREST(JPMJCR21M2),andJSTNEXUS(JP-
leastone)toformtheprobeset𝑃.Foreachprobeweretrieveits MJNX25C4).
42
REFERENCES JordanClive,GayatriKrishnakumar,AnnaMaksimova,SilvanWehrli,Maria
[1] ArtemBabenkoandVictorLempitsky.2016.EfficientIndexingofBillion-Scale Tikhonova,HenilPanchal,AleksandrAbramov,MalteOstendorff,ZhengLiu,
DatasetsofDeepDescriptors.InProceedingsoftheIEEEConferenceonComputer SimonClematide,LesterJamesMiranda,AlenaFenogenova,GuangyuSong,
VisionandPatternRecognition(CVPR).2055–2063. https://doi.org/10.1109/CVPR. RuqiyaBinSafi,Wen-DingLi,AlessiaBorghini,FedericoCassano,HongjinSu,
2016.226 JimmyLin,HowardYen,LasseHansen,SaraHooker,ChenghaoXiao,Vaibhav
[2] GauravBagwe,LanZhang,LinkeGuo,MiaoPan,XiaolongMa,andXiaoy- Adlakha,OrionWeller,SivaReddy,andNiklasMuennighoff.2025.MMTEB:Mas-
ong(Brian)Yuan.2025.IsEmbedding-as-a-ServiceSafe?Meta-Prompt-Based siveMultilingualTextEmbeddingBenchmark.arXivpreprintarXiv:2502.13595
BackdoorAttacksforUser-SpecificTriggerMigration.TransactionsonArtificial (2025). https://doi.org/10.48550/arXiv.2502.13595
Intelligence(2025). https://api.semanticscholar.org/CorpusID:279133462 [16] NanyiFei,YizhaoGao,ZhiwuLu,andTaoXiang.2021.Z-ScoreNormalization,
[3] AlexanderBondarenko,MaikFröbe,MeriemBeloucif,LukasGienapp,Yamen Hubness,andFew-ShotLearning.2021IEEE/CVFInternationalConferenceonCom-
Ajjour,AlexanderPanchenko,ChrisBiemann,BennoStein,HenningWachsmuth, puterVision(ICCV)(2021),142–151. https://api.semanticscholar.org/CorpusID:
MartinPotthast,andMatthiasHagen.2020.OverviewofTouché2020:Argument 247191876
Retrieval.InExperimentalIRMeetsMultilinguality,Multimodality,andInteraction: [17] AlejandroFusterBaggettoandVictorFresno.2022. Isanisotropyreallythe
11thInternationalConferenceoftheCLEFAssociation(CLEF2020)(LectureNotes
causeofBERTembeddingsnotbeingsemantic?.InFindingsoftheAssociationfor
inComputerScience),Vol.12260.Springer,384–395. https://doi.org/10.1007/978- ComputationalLinguistics:EMNLP2022,YoavGoldberg,ZornitsaKozareva,and
3-030-58219-7_26 YueZhang(Eds.).AssociationforComputationalLinguistics,AbuDhabi,United
[4] VeraBoteva,DemianGholipour,ArtemSokolov,andStefanRiezler.2016.AFull- ArabEmirates,4271–4281. https://doi.org/10.18653/v1/2022.findings-emnlp.314
TextLearningtoRankDatasetforMedicalInformationRetrieval.InProceedings [18] Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi,
ofthe38thEuropeanConferenceonInformationRetrieval(ECIR).Springer,716–722. Yi Dai, Jiawei Sun, Qianyu Guo, Meng Wang, and Haofen Wang. 2023.
https://doi.org/10.1007/978-3-319-30671-1_58 Retrieval-AugmentedGenerationforLargeLanguageModels:ASurvey.ArXiv
[5] JonBratseth.2017. OpenSourcingVespa,Yahoo’sBigDataProcessingand abs/2312.10997(2023). https://api.semanticscholar.org/CorpusID:266359151
ServingEngine. https://blog.vespa.ai/open-sourcing-vespa-yahoos-big-data- [19] RunpengGeng,YantingWang,YingChen,andJinyuanJia.2025. UniC-RAG:
processing/. Accessed:2025-10-12. UniversalKnowledgeCorruptionAttackstoRetrieval-AugmentedGeneration.
[6] DanielFernandoCampos,TriNguyen,MirRosenberg,XiaSong,JianfengGao, arXivpreprintarXiv:2508.18652(2025).
SaurabhTiwary,RanganMajumder,LiDeng,andBhaskarMitra.2016. MS [20] XanhHo,Anh-KhoaDuongNguyen,SakuSugawara,andAkikoAizawa.2020.
MARCO:AHumanGeneratedMAchineReadingCOmprehensionDataset.ArXiv ConstructingAMulti-hopQADatasetforComprehensiveEvaluationofReason-
abs/1611.09268(2016). https://api.semanticscholar.org/CorpusID:1289517 ingSteps.InProceedingsofthe28thInternationalConferenceonComputational
[7] ChengChen,ChenzheJin, YunanZhang, SashaPodolsky,ChunWu,Szu- Linguistics.InternationalCommitteeonComputationalLinguistics,Barcelona,
PoWang,EricHanson,ZhouSun,RobertWalzer,andJianguoWang.2024. Spain(Online),6609–6625. https://doi.org/10.18653/v1/2020.coling-main.580
SingleStore-V:AnIntegratedVectorDatabaseSysteminSingleStore.Proceedings [21] GuoyuHu,ShaofengCai,TienTuanAnhDinh,ZhongleXie,CongYue,Gang
oftheVLDBEndowment17,12(Aug.2024),3772–3785. https://doi.org/10.14778/ Chen,andBengChinOoi.2025.HAKES:ScalableVectorDatabaseforEmbedding
3685800.3685805 SearchService.ProceedingsoftheVLDBEndowment18,9(May2025),3049–3062.
[8] QiChen,XiuboGeng,CorbyRosset,CarolynBuractaon,JingwenLu,TaoShen, https://doi.org/10.14778/3746405.3746427
KunZhou,ChenyanXiong,YeyunGong,PaulBennett,NickCraswell,Xing [22] GautierIzacard,MathildeCaron,LucasHosseini,SebastianRiedel,PiotrBo-
Xie,FanYang,BryanTower,NikhilRao,AnleiDong,WenqiJiang,ZhengLiu, janowski,ArmandJoulin,andEdouardGrave.2021.UnsupervisedDenseInfor-
MingqinLi,ChuanjieLiu,ZengzhongLi,RanganMajumder,JenniferNeville, mationRetrievalwithContrastiveLearning.Trans.Mach.Learn.Res.2022(2021).
AndyOakley,KnutMagneRisvik,HarshaVardhanSimhadri,ManikVarma, https://api.semanticscholar.org/CorpusID:249097975
YujingWang,LinjunYang,MaoYang,andCeZhang.2024.MSMARCOWeb [23] HervéJégou,MatthijsDouze,andCordeliaSchmid.2011.ProductQuantization
Search:ALarge-ScaleInformation-RichWebDatasetwithMillionsofRealClick forNearestNeighborSearch. IEEETransactionsonPatternAnalysisandMa-
Labels.InCompanionProceedingsoftheACMWebConference2024(WWW’24 chineIntelligence33(2011),117–128. https://api.semanticscholar.org/CorpusID:
Companion).292–301. https://doi.org/10.1145/3589335.3648327 5850884
[9] ZhuoChen,YuyangGong,JiaweiLiu,MiaokunChen,HaotanLiu,QikaiCheng, [24] WenqiJiang,HangHu,TorstenHoefler,andGustavoAlonso.2025.FastGraph
FanZhang,WeiLu,andXiaozhongLiu.2025.FlippedRAG:Black-BoxOpinion VectorSearchviaHardwareAccelerationandDelayed-SynchronizationTraversal.
ManipulationAdversarialAttackstoRetrieval-AugmentedGenerationModels. ProceedingsoftheVLDBEndowment18,11(July2025),3797–3811. https://doi.
org/10.14778/3749646.3749655
Proceedingsofthe2025ACMSIGSACConferenceonComputerandCommunications
Security(2025). https://api.semanticscholar.org/CorpusID:275337175 [25] WenqiJiang,MarcoZeller,RogerWaleffe,TorstenHoefler,andGustavoAlonso.
[10] ChanwooChoi,JinsooKim,SukminCho,SoyeongJeong,andBuruChang.2025. 2024.Chameleon:AHeterogeneousandDisaggregatedAcceleratorSystemfor
TheRAGParadox:ABlack-BoxAttackExploitingUnintentionalVulnerabilities Retrieval-AugmentedLanguageModels.ProceedingsoftheVLDBEndowment18,
inRetrieval-AugmentedGenerationSystems.InFindingsoftheAssociationfor 1(Sept.2024),42–52. https://doi.org/10.14778/3696435.3696439
ComputationalLinguistics:EMNLP2025.23723–23744. [26] YangJiao,XiaodongWang,andKaiYang.2025.PR-Attack:CoordinatedPrompt-
[11] ArmanCohan,SergeyFeldman,IzBeltagy,DougDowney,andDanielWeld.2020. RAGAttacksonRetrieval-AugmentedGenerationinLargeLanguageMod-
SPECTER:Document-levelRepresentationLearningusingCitation-informed elsviaBilevelOptimization. Proceedingsofthe48thInternationalACMSI-
Transformers.InProceedingsofthe58thAnnualMeetingoftheAssociationfor GIRConferenceonResearchandDevelopmentinInformationRetrieval(2025).
ComputationalLinguistics(ACL).AssociationforComputationalLinguistics, https://api.semanticscholar.org/CorpusID:277667367
2270–2282. https://doi.org/10.18653/v1/2020.acl-main.207 [27] Karmiq. 2024. wikipedia-embeddings-cs-e5-base. https://huggingface.co/
[12] ThomasDiggelmann,JordanBoyd-Graber,JannisBulian,MassimilianoCia- datasets/karmiq/wikipedia-embeddings-cs-e5-base.
ramita,andMarkusLeippold.2020.CLIMATE-FEVER:ADatasetforVerification [28] VladimirKarpukhin,BarlasOguz,SewonMin,PatrickLewis,LedellWu,Sergey
ofReal-WorldClimateClaims.arXiv:2012.00614[cs.CL]NeurIPS2020Workshop Edunov,DanqiChen,andWen-tauYih.2020.DensePassageRetrievalforOpen-
onTacklingClimateChangewithMachineLearning. DomainQuestionAnswering.InProceedingsofthe2020ConferenceonEmpirical
[13] MatthijsDouze,AlexandrGuzhva,ChengqiDeng,JeffJohnson,GergelySzilvasy, MethodsinNaturalLanguageProcessing(EMNLP).AssociationforComputational
Pierre-EmmanuelMazaré,MariaLomeli,LucasHosseini,andHervéJégou.2024. Linguistics,Online,6769–6781. https://doi.org/10.18653/v1/2020.emnlp-main.
TheFaisslibrary.(2024).arXiv:2401.08281[cs.LG] 550
[14] WeiDu,PeixuanLi,BoLi,HaodongZhao,andGongshenLiu.2023. UOR: [29] VladimirKoltchinskiiandKarimLounici.2014.AsymptoticsandConcentration
UniversalBackdoorAttacksonPre-trainedLanguageModels.InAnnualMeeting BoundsforBilinearFormsofSpectralProjectorsofSampleCovariance.arXiv:
oftheAssociationforComputationalLinguistics. https://api.semanticscholar.org/ StatisticsTheory(2014). https://api.semanticscholar.org/CorpusID:88513200
CorpusID:258714833 [30] TomKwiatkowski,JennimariaPalomaki,OliviaRedfield,etal.2019. Natural
[15] KennethEnevoldsen,IsaacChung,ImeneKerboua,MártonKardos,Ashwin Questions:ABenchmarkforQuestionAnsweringResearch.InTACL.
Mathur,DavidStap,JayGala,WissamSiblini,DominikKrzemiński,GentaIndra [31] JensLehmann,RobertIsele,MaxJakob,AnjaJentzsch,DimitrisKontokostas,
Winata,SabaSturua,SaitejaUtpala,MathieuCiancone,MarionSchaeffer,Gabriel PabloN.Mendes,SebastianHellmann,MohamedMorsey,PatrickvanKleef,
Sequeira,DigantaMisra,ShreeyaDhakal,JonathanRystrøm,RomanSolomatin, SörenAuer,andChristianBizer.2015. DBpedia–ALarge-Scale,Multilingual
ÖmerÇağatan,AkashKundu,MartinBernstorff,ShitaoXiao,AkshitaSukhlecha, KnowledgeBaseExtractedfromWikipedia.SemanticWeb6,2(2015),167–195.
BhavishPahwa,RafałPoświata,KranthiKiranGV,ShawonAshraf,DanielAuras, [32] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir
BjörnPlüster,JanPhilippHarries,LoïcMagne,IsabelleMohr,MariyaHendrik- Karpukhin,NamanGoyal,HeinrichKüttler,MikeLewis,Wen-tauYih,Tim
sen,DaweiZhu,HippolyteGisserot-Boukhlef,TomAarsen,JanKostkan,Konrad Rocktäschel,SebastianRiedel,andDouweKiela.2020.Retrieval-AugmentedGen-
Wojtasik,TaeminLee,MarekŠuppa,CrystinaZhang,RobertaRocca,Mohammed
erationforKnowledge-IntensiveNLPTasks.InAdvancesinNeuralInformation
Hamdy,AndrianosMichail,JohnYang,ManuelFaysse,AlekseiVatolin,Nandan
ProcessingSystems,H.Larochelle,M.Ranzato,R.Hadsell,M.F.Balcan,andH.Lin
(Eds.),Vol.33.CurranAssociates,Inc.,9459–9474. https://proceedings.neurips.
Thakur,MananDey,DipamVasani,PranjalChitale,SimoneTedeschi,Nguyen
Tai,ArtemSnegirev,MichaelGünther,MengzhouXia,WeijiaShi,XingHanLù, cc/paper_files/paper/2020/file/6b493230205f780e1bc26945df7481e5-Paper.pdf
43
[33] QuentinLhoest,AlbertVillanovaDelMoral,YacineJernite,AbhishekThakur, 2022.ResultsoftheNeurIPS’21ChallengeonBillion-ScaleApproximateNearest
PatrickVonPlaten,SurajPatil,JulienChaumond,MariamaDrame,JulienPlu, NeighborSearch. https://doi.org/10.48550/arXiv.2205.03763arXiv:2205.03763.
LewisTunstall,JoeDavison,MarioŠaško,GunjanChhablani,BhavitvyaMalik, [53] JiSun,GuoliangLi,JamesPan,JiangWang,YongqingXie,RuichengLiu,and
SimonBrandeis,TevenLeScao,VictorSanh,CanwenXu,NicolasPatry,Angelina WenNie.2025. GaussDB-Vector:ALarge-ScalePersistentReal-TimeVector
McMillan-Major,PhilippSchmid,SylvainGugger,ClémentDelangue,ThéoMa- DatabaseforLLMApplications. ProceedingsoftheVLDBEndowment18,12
tussière,LysandreDebut,StasBekman,PierricCistac,ThibaultGoehringer,Vic- (2025),4951–4963.
torMustar,FrançoisLagunas,AlexanderRush,andThomasWolf.2021.Datasets: [54] Supabase.2024.dbpedia-openai-3-large-1M.https://huggingface.co/datasets/
ACommunityLibraryforNaturalLanguageProcessing.InProceedingsofthe2021 Supabase/dbpedia-openai-3-large-1M.
ConferenceonEmpiricalMethodsinNaturalLanguageProcessing:SystemDemon- [55] PiotrSzemraj.2024. local-emoji-search-gte. https://huggingface.co/datasets/
strations.AssociationforComputationalLinguistics,OnlineandPuntaCana, pszemraj/local-emoji-search-gte.
DominicanRepublic,175–184. https://doi.org/10.18653/v1/2021.emnlp-demo.21 [56] NandanThakur,NilsReimers,AndreasRücklé,AbhishekSrivastava,andIryna
[34] ChunyangLi,JunweiZhang,AndaCheng,ZhuoMa,XinghuaLi,andJianfengMa. Gurevych.2021.BEIR:AHeterogeneousBenchmarkforZero-shotEvaluationof
2025.CPA-RAG:CovertPoisoningAttacksonRetrieval-AugmentedGeneration InformationRetrievalModels.InThirty-fifthConferenceonNeuralInformation
inLargeLanguageModels.arXivpreprintarXiv:2505.19864(2025). ProcessingSystemsDatasetsandBenchmarksTrack(Round2). https://openreview.
[35] GuoliangLi,XuanheZhou,andXinyangZhao.2024.LLMforDataManagement. net/forum?id=wCu6T5xFjeJ
ProceedingsoftheVLDBEndowment17,12(Aug.2024),4213–4216. https://doi. [57] JamesThorne,AndreasVlachos,ChristosChristodoulopoulos,andArpitMittal.
org/10.14778/3685800.3685838 2018. FEVER:ALarge-ScaleDatasetforFactExtractionandVERification.In
[36] DaweiLiu,BolongZheng,ZiyangYue,FuhaoRuan,XiaofangZhou,andChris- Proceedingsofthe2018ConferenceoftheNorthAmericanChapteroftheAssociation
tianS.Jensen.2025.Wolverine:HighlyEfficientMonotonicSearchPathRepair forComputationalLinguistics:HumanLanguageTechnologies(NAACL-HLT).
forGraph-BasedANNIndexUpdates.ProceedingsoftheVLDBEndowment18,7 AssociationforComputationalLinguistics,809–819. https://doi.org/10.18653/
(March2025),2268–2280. https://doi.org/10.14778/3734839.3734860 v1/n18-1074
[37] MacedoMaia,SiegfriedHandschuh,AndréFreitas,BrianDavis,RossMcDer- [58] HarshTrivedi,NiranjanBalasubramanian,TusharKhot,andAshishSabharwal.
mott,ManelZarrouk,andAlexandraBalahur.2018.WWW’18OpenChallenge: 2022. MuSiQue:MultihopQuestionsviaSingle-hopQuestionComposition.
FinancialOpinionMiningandQuestionAnswering.InCompanionProceedings TransactionsoftheAssociationforComputationalLinguistics10(2022),539–554.
oftheTheWebConference2018(WWW’18).ACM. https://doi.org/10.1162/tacl_a_00475
[38] YuA.MalkovandD.A.Yashunin.2020. EfficientandRobustApproximate [59] DanielJ.Trosten,RwiddhiChakraborty,SigurdLøkse,KristofferWickstrøm,
NearestNeighborSearchUsingHierarchicalNavigableSmallWorldGraphs. RobertJenssen,andMichaelC.Kampffmeyer.2023. HubsandHyperspheres:
IEEETransactionsonPatternAnalysisandMachineIntelligence42,4(2020),824– ReducingHubnessandImprovingTransductiveFew-ShotLearningwithHyper-
836. https://doi.org/10.1109/TPAMI.2018.2889473 sphericalEmbeddings.2023IEEE/CVFConferenceonComputerVisionandPattern
[39] JohnX.Morris,VolodymyrKuleshov,VitalyShmatikov,andAlexanderM.Rush. Recognition(CVPR)(2023),7527–7536. https://api.semanticscholar.org/CorpusID:
2023. TextEmbeddingsReveal(Almost)AsMuchAsText.InConferenceon 257557374
EmpiricalMethodsinNaturalLanguageProcessing. https://api.semanticscholar. [60] RomanVershynin.2018. High-DimensionalProbability:AnIntroductionwith
org/CorpusID:263829206 ApplicationsinDataScience.CambridgeUniversityPress.
[40] NiklasMuennighoff,NouamaneTazi,LoïcMagne,andNilsReimers.2022.MTEB: [61] Ellen Voorhees, Tasmeer Alam, Steven Bedrick, Dina Demner-Fushman,
MassiveTextEmbeddingBenchmark. arXivpreprintarXiv:2210.07316(2022). WilliamR.Hersh,KyleLo,KirkRoberts,IanSoboroff,andLucyLuWang.2020.
https://doi.org/10.48550/ARXIV.2210.07316 TREC-COVID:ConstructingaPandemicInformationRetrievalTestCollection.
[41] JamesJiePan,JianguoWang,andGuoliangLi.2024.Surveyofvectordatabase arXivpreprintarXiv:2005.04474(2020).
managementsystems.TheVLDBJournal33,5(2024),1591–1615. [62] HenningWachsmuth,ShahbazSyed,andBennoStein.2018. Retrievalofthe
[42] JamesJiePan,JianguoWang,andGuoliangLi.2024. VectorDatabaseMan- BestCounterargumentwithoutPriorTopicKnowledge.InProceedingsofthe
agement Techniques and Systems. In Companion of the 2024 International 56thAnnualMeetingoftheAssociationforComputationalLinguistics(Volume
ConferenceonManagementofData(SantiagoAA,Chile)(SIGMOD’24).As- 1:LongPapers).AssociationforComputationalLinguistics,241–251. https:
sociationforComputingMachinery,NewYork,NY,USA,597–604. https: //doi.org/10.18653/v1/P18-1023
//doi.org/10.1145/3626246.3654691 [63] DavidWadden,ShanchuanLin,KyleLo,LucyLuWang,MadeleinevanZuylen,
[43] ZhencanPeng,MiaoQiao,WenchaoZhou,FeifeiLi,andDongDeng.2025. ArmanCohan,andHannanehHajishirzi.2020.FactorFiction:VerifyingScientific
DynamicRange-FilteringApproximateNearestNeighborSearch.Proceedingsof Claims.InProceedingsofthe2020ConferenceonEmpiricalMethodsinNatural
theVLDBEndowment18,10(June2025),3256–3268. https://doi.org/10.14778/ LanguageProcessing(EMNLP).AssociationforComputationalLinguistics,7534–
3748191.3748193 7550. https://doi.org/10.18653/v1/2020.emnlp-main.609
[44] AlinaPetukhova,JoãoP.Matos-Carvalho,andNunoFachada.2024.TextClus- [64] DongshengWang,DandanGuo,HeZhao,HuangjieZheng,KorawatTanwisuth,
teringwithLargeLanguageModelEmbeddings. CoRRabs/2403.15112(2024). BoChen,andMingyuanZhou.2022.RepresentingMixturesofWordEmbeddings
arXiv:2403.15112[cs.CL] https://arxiv.org/abs/2403.15112 withMixturesofTopicEmbeddings.InInternationalConferenceonLearning
[45] PineconeSystems,Inc.2024.PineconeDocumentation.https://docs.pinecone.io/. Representations(ICLR)2022. https://openreview.net/forum?id=IYMuTbGzjFU
Accessed:2026-09-01. [65] H.Wang,S.Guo,J.He,H.Liu,T.Zhang,andT.Xiang.2025.ModelSupplyChain
[46] Quora.2017. FirstQuoraDatasetRelease:QuestionPairs. https://quoradata. Poisoning:BackdooringPre-trainedModelsviaEmbeddingIndistinguishability.
quora.com/First-Quora-Dataset-Release-Question-Pairs. InProceedingsoftheACMWebConference2025(WWW’25).
[47] SaraRajaeeandMohammadTaherPilehvar.2022.AnIsotropyAnalysisinthe [66] J.Wang,X.Yi,R.Guo,H.Jin,P.Xu,S.Li,X.Wang,X.Guo,C.Li,X.Xu,etal.2021.
MultilingualBERTEmbeddingSpace.InFindingsoftheAssociationforCom- Milvus:Apurpose-builtvectordatamanagementsystem.InProceedingsofthe
putationalLinguistics:ACL2022,SmarandaMuresan,PreslavNakov,andAline 2021InternationalConferenceonManagementofData(SIGMOD’21).2614–2627.
Villavicencio(Eds.).AssociationforComputationalLinguistics,Dublin,Ireland, [67] YanWang,Wei-LunChao,KilianQ.Weinberger,andLaurensvanderMaaten.
1309–1316. https://doi.org/10.18653/v1/2022.findings-acl.103 2019.SimpleShot:RevisitingNearest-NeighborClassificationforFew-ShotLearn-
[48] StefanoRecanatesi,SerenaBradde,VijayBalasubramanian,NicholasA.Stein- ing. ArXivabs/1911.04623(2019). https://api.semanticscholar.org/CorpusID:
metz,andEricShea-Brown.2020.Ascale-dependentmeasureofsystemdimen- 207863469
sionality.Patterns3(2020). https://api.semanticscholar.org/CorpusID:229549825 [68] ZihanWang,ChengyuDong,andJingboShang.2021.“Average”Approximates
[49] LingfengShen,HaiyunJiang,LemaoLiu,andShumingShi.2023.Sen2Pro:A “FirstPrincipalComponent”?AnEmpiricalAnalysisonRepresentationsfrom
ProbabilisticPerspectivetoSentenceEmbeddingfromPre-trainedLanguage NeuralLanguageModels.InProceedingsofthe2021ConferenceonEmpiricalMeth-
Model.InProceedingsofthe8thWorkshoponRepresentationLearningforNLP odsinNaturalLanguageProcessing.AssociationforComputationalLinguistics,
(RepL4NLP2023).AssociationforComputationalLinguistics,Toronto,Canada, 5594–5603. https://doi.org/10.18653/v1/2021.emnlp-main.453
315–333. https://doi.org/10.18653/v1/2023.repl4nlp-1.26 [69] WeaviateB.V.[n.d.].weaviate/weaviate:Weaviate–Open-sourceVectorData-
[50] JooboShim,JaewonOh,HongchanRoh,JaeyoungDo,andSang-WonLee.2025. base.https://github.com/weaviate/weaviate. Accessed:2025-10-12.
TurbochargingVectorDatabasesUsingModernSSDs.ProceedingsoftheVLDB [70] ShitaoXiao,ZhengLiu,PeitianZhang,NiklasMuennighoff,DefuLian,and
Endowment18,11(July2025),4710–4722. https://doi.org/10.14778/3749646. Jian-YunNie.2024.C-pack:Packedresourcesforgeneralchineseembeddings.
3749724 InProceedingsofthe47thinternationalACMSIGIRconferenceonresearchand
[51] XiaonanSi,MeilinZhu,SimengQin,LijiaYu,LijunZhang,ShuaitongLiu,Xin- developmentininformationretrieval.641–649.
fengLi,RanjieDuan,YangLiu,andXiaojunJia.2026.Secon-rag:Atwo-stage [71] WenkaiYang,LeiLi,ZhiyuanZhang,XuanchengRen,XuSun,andBinHe.2021.
semanticfilteringandconflict-freeframeworkfortrustworthyrag.Advancesin BeCarefulaboutPoisonedWordEmbeddings:ExploringtheVulnerabilityof
NeuralInformationProcessingSystems38(2026),70652–70681. theEmbeddingLayersinNLPModels. ArXivabs/2103.15543(2021). https:
[52] HarshaVardhanSimhadri,GeorgeWilliams,MartinAumüller,MatthijsDouze, //api.semanticscholar.org/CorpusID:232404131
ArtemBabenko,DmitryBaranchuk,QiChen,LucasHosseini,RavishankarKr- [72] ZhilinYang,PengQi,SaizhengZhang,etal.2018. HotpotQA:ADatasetfor
ishnaswamy,GopalSrinivasa,SuhasJayaramSubramanya,andJingdongWang. Diverse,ExplainableMulti-hopQuestionAnswering.InEMNLP.
44
[73] ShoheiYoda,HayatoTsukagoshi,RyoheiSasano,andKoichiTakeda.2024.Sen- GenerationParadigmforLong-ContextQuestionAnswering.InProceedings
tenceRepresentationsviaGaussianEmbedding.InProceedingsofthe18thCon- ofthe2024ConferenceonEmpiricalMethodsinNaturalLanguageProcessing,
ferenceoftheEuropeanChapteroftheAssociationforComputationalLinguistics: YaserAl-Onaizan,MohitBansal,andYun-NungChen(Eds.).Associationfor
Volume2,ShortPapers.AssociationforComputationalLinguistics,418–425. ComputationalLinguistics,Miami,Florida,USA,22600–22632. https://doi.org/
https://aclanthology.org/2024.eacl-short.36/ 10.18653/v1/2024.emnlp-main.1259
[74] CollinZhang,JohnX.Morris,andVitalyShmatikov.2025.UniversalZero-shot [77] XinyangZhao,XuanheZhou,andGuoliangLi.2024.Chat2data:Aninteractive
EmbeddingInversion.ArXivabs/2504.00147(2025). https://api.semanticscholar. dataanalysissystemwithrag,vectordatabasesandllms. Proceedingsofthe
org/CorpusID:277467864 VLDBEndowment17,12(2024),4481–4484.
[75] XinZhang,YanzhaoZhang,DingkunLong,WenXie,ZiqiDai,JialongTang,Huan [78] HuichiZhou,Kin-HeiLee,ZhonghaoZhan,YueChen,ZhenhaoLi,Zhaoyang
Lin,BaosongYang,PengjunXie,FeiHuang,MeishanZhang,WenjieLi,andMin Wang,HamedHaddadi,andEmineYilmaz.2025.TrustRAG:EnhancingRobust-
Zhang.2024.mGTE:GeneralizedLong-ContextTextRepresentationandRerank- nessandTrustworthinessinRetrieval-AugmentedGeneration.arXivpreprint
ingModelsforMultilingualTextRetrieval.InConferenceonEmpiricalMeth- arXiv:2501.00879(2025).
odsinNaturalLanguageProcessing. https://api.semanticscholar.org/CorpusID: [79] WeiZou,RunpengGeng,BinghuiWang,andJinyuanJia.2024.PoisonedRAG:
271534420 KnowledgeCorruptionAttackstoRetrieval-AugmentedGenerationofLarge
[76] QingfeiZhao,RuobingWang,YukuoCen,DarenZha,ShichengTan,Yuxiao LanguageModels.InUSENIXSecuritySymposium. https://api.semanticscholar.
Dong,andJieTang.2024.LongRAG:ADual-PerspectiveRetrieval-Augmented org/CorpusID:271854736
45