Geometric RAG isolation leaked policy membership and admitted forged searches

A protected vector index can prevent obvious cross-policy retrieval while still disclosing structure that matters for access control. The paper studies rotations and keyed embedding transforms intended to keep document classes apart. Under its defined attacker knowledge, aligned plaintext/protected embedding pairs let an adversary infer enough of the transformation to issue searches resembling authorized ones.

The authors obtained top-ten overlap of roughly 0.84 to 1.00 in tested query-forgery settings and almost perfectly clustered some policy memberships. That is not plaintext extraction and does not demonstrate bypass of an independent document ACL. The failure concerns treating a geometrically hidden embedding space as if it were a complete authorization and confidentiality boundary.

Security claims for RAG require separate tests for retrieval isolation, membership leakage, document authorization and plaintext exposure.

Policy-isolated nearest-neighbor results and true confidentiality are separate properties. Membership clustering can expose that a document belongs to a sensitive class without disclosing the document; forged vector search becomes an access violation only where the application mistakes similarity for authority. A separately enforced document ACL would change the exploit outcome and must be tested, not assumed absent.