Your RAG Access Control Stops the Wrong Threat: Geometric Isolation Works, but Confidentiality Doesn't

Geometric access control in vector DBs isolates policy groups but leaks embeddings, enables query forgery, and reveals policy membership. Isolation ≠ confidentiality.

Imagine you live in an apartment building with excellent locks — nobody can enter your unit without a key. But the hallways have glass walls. Anyone walking past can see your furniture, count your rooms, and figure out which floor you're on. The locks work. The privacy doesn't. That's the core finding here: geometric access-control transformations in RAG vector databases do exactly one thing well (policy isolation) and fail at three other things the field assumed came bundled with it. The committed claim: geometric transformation mechanisms used to enforce access control in RAG systems — where embeddings are mathematically transformed so that cross-policy retrieval fails — provide strong retrieval isolation but do NOT provide representation confidentiality, query forgery resistance, or policy-membership hiding. These are four distinct security objectives, not one. The paper names and formalizes the gap between them. The attack surface is concrete. A curious user who holds a few hundred aligned pairs of original embeddings and their protected representations can recover the original embeddings — effectively inverting the transformation. Query forgery — crafting fake queries that pass policy checks — is harder, with cost growing with encoder dimension for secret per-policy transformations, but still achievable. And the geometry itself leaks policy membership: even when unauthorized retrieval is blocked, the shape of the protected embedding space reveals which policy group a document belongs to. The evaluation is methodical: three different encoders, implementations from the original papers proposing these geometric mechanisms, and a two-tier threat model (curious cloud provider observing stored representations vs. curious user with embedding pairs). The curious-provider threat alone reveals policy membership from geometric structure. The curious-user threat escalates to full embedding recovery and forgery. Retrieval utility is preserved throughout — the transforms don't break search, they just don't protect what people think they protect. This matters because the geometric access-control paradigm is gaining traction as enterprises shove multi-tenant documents into shared vector databases. The assumption has been that mathematical transformation of embeddings simultaneously achieves isolation AND confidentiality — a tidy story for compliance. This paper breaks that story cleanly. You can have isolation. Confidentiality requires something else entirely. The architectural insight is that nearest-neighbor-preserving transformations are, by construction, structure-preserving — and structure is information. Any transformation that keeps retrieval working necessarily preserves enough geometric relationships to leak data. This isn't a bug in specific implementations; it's a fundamental tension in the design paradigm. The more you preserve for utility, the more you expose for attack. The practical upshot for anyone building RAG systems with access control: geometric transforms are fine for preventing cross-policy retrieval, but if your threat model includes a curious provider or a user with sample pairs, you need additional cryptographic mechanisms for confidentiality. The paper doesn't prescribe specific fixes — it's a security analysis, not a construction — but it draws the boundary lines clearly enough that engineers can stop conflating isolation with confidentiality in their threat models.