HNSW向量库软删除后仍可恢复隐私数据，新方法实现0%泄露且毫秒级删除。
Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases
- 通过加密向量并销毁密钥，实现彻底删除
- 在真实数据上恢复率最高达100%，验证严重漏洞
- 适合需合规删除的医疗、金融等敏感场景
检索增强生成（RAG）使大模型能访问外部私有数据以生成事实性回答。现代RAG系统使用层次导航小世界（HNSW）向量数据库进行高效相似性搜索。当用户请求删除数据时，系统通常仅标记记录为已删除，而嵌入向量在磁盘上物理未变。分析三个HNSW实现表明，攻击者可通过直接读取存储层索引文件恢复已删除向量，绕过API。使用无需领域微调的Vec2Text反演模型，在多个真实数据集和模态上验证该漏洞：在维基百科人物生者数据集（BLP）上，成功恢复25.5%的人名和46.4%地理位置（ROUGE-L 0.185）；在结构化敏感数据（NIH Synthea）中，患者年龄与性别标记恢复率达100%（ROUGE-L 0.290）。对图像嵌入软删除后，组织病理学切片分类准确率100%（p=1.02e-07），人脸嵌入身份恢复率99%（p<0.01）。本文提出Epoch Key Rotation，加密向量并在删除时丢弃密钥，使个人身份信息（PII）恢复率降至0%，500条删除操作耗时2.5毫秒（约0.005毫秒/记录），同时生成可审计的ECDSA签名证明删除事件。
原文摘要 · Abstract (English)
Retrieval-augmented generation (RAG) allows large language models to access external and private corpora for factual, domain-specific responses. Modern RAG pipelines use hierarchical navigable small world (HNSW) vector databases for efficient similarity search. When a user requests data deletion, the systems typically only mark the record as deleted, leaving the embedding on disk physically unchanged. This soft-delete operation raises compliance concerns under data-erasure and retention requirements such as GDPR Article 17 and HIPAA. Analysis on three HNSW implementations confirms that deleted vectors remain physically recoverable by accessing the raw index files at the storage layer, bypassing API access. Using the Vec2Text inversion model without domain-specific fine-tuning, we show this vulnerability on multiple real-world datasets and data modalities. On Wikipedia biographical living persons dataset (BLP), we successfully recover 25.5% of exact person names and 46.4% of geographic locations (ROUGE-L 0.185). Recovery reaches 100% for both patient age and gender markers (ROUGE-L 0.290) on highly structured, sensitive data (NIH Synthea dataset). On soft-deleted image embeddings, we show 100% tissue classification on histopathology patches (p=1.02e-07) and top-1 identity recovery reaches 99% on facial embeddings (p<0.01). This work introduces Epoch Key Rotation, which encrypts vectors and discards the key upon deletion. Epoch key rotation reduces observed PII recovery to 0% and completes in 2.5 ms for 500 deleted vectors (approximately 0.005 ms/record). Additionally, it generates an ECDSA-signed cryptographic proof as an auditable record of the deletion event.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。