Enterprise adoption of retrieval-augmented generation (RAG) has moved sensitive corporate content into a new storage format that existing security tools cannot inspect. Companies deploying internal AI assistants convert documents into high-dimensional numerical vectors and ship them to embedding services and vector databases over ordinary HTTPS connections. Data loss prevention products scan documents and network traffic, but they read none of it.

Understanding the vulnerability

Vector embeddings are mathematical representations of text, images, or other data that capture semantic meaning in a high-dimensional space. When a RAG system processes a query, it converts the question into an embedding, then searches a vector database for the most similar precomputed embeddings. That similarity search retrieves relevant context, which is fed to a large language model to generate a response. The pipeline depends on the integrity of the embeddings themselves.

Current security architectures treat these embeddings as opaque binary blobs. Firewalls inspect packet headers, data loss prevention (DLP) tools analyze file contents and network payloads, and egress monitoring systems scan for known patterns of sensitive data. None of these tools are designed to interpret the numerical values inside a vector. An attacker who gains access to the ingestion pipeline can modify embeddings to carry hidden payloads while preserving their functional behavior for legitimate search queries.

The VectorSmuggle attack framework

Jascha Wanger of ThirdKey released a research framework called VectorSmuggle under the Apache 2.0 license. The project pairs an empirical study of steganographic exfiltration techniques against vector embeddings with a proposed cryptographic defense called VectorPin. The study catalogs six distinct methods an attacker can use to hide data inside embeddings.

Some methods add small amounts of noise to each vector, making the perturbation imperceptible to the semantic search while encoding hidden bits. Others rotate, rescale, or shift the entire vector. One technique splits content across multiple embedding models so that each individual vector store only sees a fragment. The perturbed vectors still return the right documents when someone runs a legitimate search — they just also carry information the attacker wants to smuggle out.

The companion preprint tested these techniques against the OpenAI text-embedding-3-large model and four open models from Nomic, EmbeddingGemma, Snowflake Arctic, and MXBai. The corpus testing spans a synthetic personally identifiable information set, the BEIR medical research corpus NFCorpus, and a Quora question subset, totaling more than 26,000 chunks of content.

Detection gaps and practical impact

The findings split along a line that matters for defenders. Noise, scaling, and offset techniques shift the statistical distribution of the embeddings enough that off-the-shelf anomaly detectors catch them reliably. Rotation does something different. Because rotating a vector preserves its mathematical relationships with other vectors, the same detectors miss it across every model and corpus combination the researchers tested. At the channel's theoretical ceiling, a working encoder built on rotation can move roughly 1,920 bytes of hidden payload per vector at zero error rate.

The payload survives passage through popular vector databases that security teams already use, including FAISS, Chroma, and Qdrant in standard and scalar-quantized configurations. When researchers gave attackers full knowledge of the defending anomaly detectors, the attackers could evade detection entirely. Statistical detection is useful as a first filter but does not hold up as a primary control.

This capability means an insider or a compromised pipeline component can exfiltrate sensitive data — customer records, intellectual property, trade secrets — hidden inside embeddings that appear normal to any current monitoring tool. Because the embeddings are sent over ordinary HTTPS connections, they blend in with legitimate API traffic to embedding services and vector database providers.

Leadership conversations and organizational risks

Wanger frames the deal organizations are making when they approve internal AI assistants in stark terms. In exchange for productivity gains, the company agrees to convert its sensitive documents into a new file format and ship them to a service nobody on the security team has visibility into. That new file format is called a vector embedding. Existing DLP tools cannot read it. Existing egress monitoring cannot interpret it.

He says VectorSmuggle shows that an attacker with insider access, or a compromised RAG pipeline, can hide arbitrary data inside those vectors using techniques borrowed from steganography. The vectors still function correctly for legitimate search. They just also carry payloads the security team cannot see, headed somewhere the security team is not monitoring.

For CISOs and board members signing off on these deployments, Wanger recommends one specific question for security teams: What is our visibility into the contents of the vector embeddings leaving our network, and who is responsible for monitoring that channel? His assessment of where most companies stand today: no visibility and no one. That answer is the finding.

A cryptographic defense: VectorPin

The repository also includes a companion defense called VectorPin. It cryptographically signs each embedding when it is created so that any later modification breaks the signature. If an attacker perturbs a vector to hide data inside it, verification fails and the tampered embedding gets flagged. Reference implementations are available in Python and Rust.

VectorPin uses a keyed hash function to compute a signature over the embedding's numerical values. The signature is stored alongside the embedding in the vector database. When the embedding is retrieved for a search or transmitted to a downstream service, the system verifies the signature before trusting the embedding. Any tampering — whether for steganographic exfiltration or manipulation of search results — will be detected.

The approach requires that the signing key is protected and that the signing process runs in a trusted environment, such as the ingestion pipeline itself. If an attacker compromises the signing key, they could generate valid signatures for malicious embeddings. However, in typical enterprise deployments, the key can be managed through hardware security modules (HSMs) or cloud key management services.

While VectorPin addresses the specific exfiltration channel identified by VectorSmuggle, it also lays the foundation for broader integrity guarantees in AI infrastructure. The same concept could be extended to agent identity tokens, tool contract payloads, and other components of the AI stack that currently lack cryptographic binding.

Broader implications for AI security

Wanger sees the work as part of a broader investigation. Almost all current AI security work is happening at the model layer — prompt injection, jailbreaks, output filtering, alignment. That is the visible surface, and it is where the conference talks and the funding go. The infrastructure layer underneath, the embeddings, the vector stores, the tool contracts, the agent identity, has been largely treated as plumbing. Plumbing is exactly the place attackers go when the front door is heavily defended.

He predicts the next several years of enterprise AI security incidents will come from this layer. Companies will fine-tune their models, train refusals, run red team exercises against prompts, and still leak data through channels that existing tooling was never designed to see.

The VectorSmuggle research also highlights a broader pattern: security controls are being bypassed not through novel exploits but through the use of new data formats and protocols that legacy inspection tools cannot parse. Encryption, HTTPS, and now vector embeddings all provide cover for data exfiltration because security teams lack the ability to inspect inside those channels. The challenge is not just to build better detectors but to design AI infrastructure with security built in from the start.

Enterprise architects evaluating RAG deployments should consider adding cryptographic signing of embeddings as a standard practice, just as they sign software artifacts and container images. They should also implement anomaly detection on embedding distributions as a temporary compensating control while longer-term solutions mature. The VectorSmuggle project provides both the evidence of the threat and the outline of a defense — but closing the gap will require coordinated effort across tooling vendors, cloud providers, and enterprise security teams.

Source: Help Net Security News