黑客可将秘密信息藏进嵌入向量，论文提出用签名验证保护数据完整性。
VectorSmuggle: Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense
- 通过微调嵌入向量隐藏数据，保持检索功能正常
- 小角度正交旋转可避开多数检测，实测有效
- 提出加密签名方案，修改即失效，适合安全敏感场景
现代检索增强生成系统将敏感内容转换为高维嵌入并存于向量数据库，但主流产品缺乏嵌入完整性控制、异常检测与可信溯源机制。本文揭示一类隐蔽的数据外泄攻击：攻击者在注入环节对嵌入施加简单扰动（噪声、旋转、缩放、偏移、碎片化等），即可在不破坏表面检索效果的前提下嵌入秘密数据。实验覆盖text-embedding-3-large、四款本地开源模型、BEIR NFCorpus与Quora子集（共超26,000个文本块）、七种向量库配置，及自适应攻击者测试。结果表明，分布偏移类扰动易被检测，但小角度正交旋转在所有（模型，语料）组合中均能规避检测。理论分析显示，分离式吉文斯旋转编码器每向量容量上限为floor(d/2) * b比特，但实际嵌入流存在容量-可检测性权衡，操作点远低于理论极限。为此提出VectorPin，一种基于Ed25519的溯源协议，通过哈希签名绑定嵌入与其源内容和模型，任何后处理修改均导致签名失效。嵌入级完整性是可部署、标准化的安全控制，可彻底关闭此类攻击面。
原文摘要 · Abstract (English)
Modern retrieval-augmented generation (RAG) systems convert sensitive content into high-dimensional embeddings and store them in vector databases that treat the resulting numerical artifacts as opaque. Major vector-store products do not provide native controls for embedding integrity, ingestion-time distributional anomaly detection, or cryptographic provenance attestation. We show this opens a class of steganographic exfiltration attacks: an attacker with write access to the ingestion pipeline can hide payload data inside embeddings using simple post-embedding perturbations (noise injection, rotation, scaling, offset, fragmentation, and combinations thereof) while preserving the surface-level retrieval behavior the RAG system exposes to legitimate users. We evaluate these techniques across a synthetic-PII corpus on text-embedding-3-large, four locally hosted open embedding models, a cross-corpus replication on BEIR NFCorpus and a Quora subset (over 26,000 chunks combined), seven vector-store configurations, an adaptive-attacker variant of the detector evaluation, and a paraphrased-query retrieval benchmark. Distribution-shifting perturbations are often caught by simple anomaly detectors; small-angle orthogonal rotation defeats distribution-based detection across every (model, corpus) pair tested. A disjoint-Givens rotation encoder gives a closed-form per-vector capacity ceiling of floor(d/2) * b bits, but real embedding manifolds impose a capacity-detectability trade-off, and the retrieval-preserving operating point sits well below it. We propose VectorPin, a cryptographic provenance protocol that pins each embedding to its source content and producing model via an Ed25519 signature over a canonical byte representation. Any post-embedding modification breaks signature verification. Embedding-level integrity is a deployable, standardizable control that closes this attack class.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。