The report
Vector-search isolation can keep one class of documents from appearing in another class's results and still leak useful information about the protected index. The geometric RAG investigation examined rotations, permutations and anchor-derived transformations that partition retrieval by policy. Some selected configurations prevented obvious cross-policy hits while continuing to return relevant documents for authorized queries.
The index gave away its shape
With access to a limited set of aligned original and transformed embeddings, the researchers reconstructed enough geometric structure to generate protected-space queries without a legitimate key. Depending on the scheme and known-pair budget, top-ten overlap with legitimate results reached approximately 0.84 to 1.00 in their controlled tests. Separately, even without corresponding plaintext vectors or keys, they inferred policy-membership groupings from protected embeddings with adjusted Rand scores near 0.97 to 1.00 for selected schemes.
These are two different effects. Query forgery produces a vector that resembles a permitted search in the transformed space; membership inference reveals how documents cluster into protected classes. Neither automatically exposes the raw document text. A separate enforcement layer that checks authorization before fetching source text can still reject the resulting retrieval. The Case dossier preserves that boundary instead of calling the result universal ACL bypass.
Why retrieval accuracy was not enough
The study compared retrieval quality and security behavior, and some transformed schemes maintained useful rankings in the chosen data sets. But hiding exact plaintext and maintaining Recall@10 do not measure whether the protected representation conveys policy structure to a knowledgeable observer. Production-style follow-up should separate inferred membership, successful cross-policy retrieval and actual text delivered to an unauthorized principal, then repeat the attack under realistic known-pair availability and independently enforced document ACLs. No production victim was identified.