P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Knowledge store (vector store): what it is and how it is attacked

The collection of documents an AI assistant searches before it answers.

Also known as

  • vector store
  • vector database
  • embeddings store
  • RAG store
  • retrieval store
  • knowledge base
  • index

Typing any of them into the editor finds this object.

Why it matters on a security diagram

It decides what the assistant knows, which makes it both a disclosure surface and an injection surface. Anything that can write into it can change what every answer is based on, and often nobody is reviewing what goes in.

How it gets attacked, and what reduces it

How it gets attacked

  • Documents added by anyone, including from a shared mailbox or an open folder, so writing into it needs no access to the model at all
  • Contents retrieved for a person who would not be allowed to open the source document, because the permissions did not travel with the text
  • Hostile text stored once and returned in answers long afterwards

What reduces it

  • Carry the source document's permissions through to retrieval, so the assistant cannot answer from something the reader could not open
  • Control what may be written into it as carefully as what may be read out
  • Keep the source of every passage, so an answer can be traced back and a poisoned document can be found and removed
  • Re-check the store after any incident involving a system that could write to it

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
retrieval-store

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 14 of them side by side.

Knowledge store on your own diagram

Open the editor, press N, and type vector store. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker