Skip to content
VecShield

Threat model

What are we trying to defend?

VecShield examines privacy and security risks in vector stores and the retrieval layer, including sensitive personal data, regulatory obligations and attacks on stored knowledge.

Privacy: personal data in vector stores

Personal data can remain in stored chunks and metadata after source documents are embedded, making it available to retrieval even when teams do not know it is there. VecShield detects personally identifiable information (PII) in vector-store content and maps observations to applicable regulatory frameworks, including GDPR and CCPA / CPRA. It also detects protected health information (PHI) and cardholder data, with mappings to HIPAA and PCI-DSS respectively.

Findings identify the sensitive-data categories observed, the obligations that may apply and the evidence needed for review. Values are masked by default, and coverage distinguishes scanned, sampled and unscanned content. Detection and framework mapping support privacy and compliance decisions; they are not legal determinations or guarantees of compliance.

Poisoning

Anyone who can influence a document that gets ingested can influence what the model later reads. The instruction or false claim is stored with the content, so it does not need to be typed into the application. VecShield looks for prompt-injection text in stored chunks, chunks with no recorded provenance, and embeddings that are anomalous for their collection. A match is an indicator for a reviewer, not proof that content is malicious.

  1. Attacker-controlled content

  2. RAG ingestion

  3. Poisoned knowledge base

  4. Malicious / incorrect retrieval

  5. LLM

Data leakage

Permissions on source documents often do not follow chunks into the vector store, and an application usually queries with one service credential. VecShield probes whether one tenant or namespace can retrieve another's data, scans stored chunks and metadata for personal, health, payment and credential data, and audits API keys for excess or stale privileges.

  1. Tenant A query

    One tenant's request

  2. Vector store

    Shared collection

  3. Tenant B chunk

    Cross-tenant data exposure

Collection extraction

A client that can query the store can often recover much of its content by asking many related questions. With query monitoring enabled, VecShield flags bulk reads, enumeration attempts and collection-wide retrieval patterns. It does not sit between your application and the store.

  1. Repeated semantic queries

  2. Progressive recovery

    Content collected across queries

  3. Stored knowledge

    Collection contents extracted

Scope

VecShield covers privacy and security at the retrieval and vector-store layer, including regulation-based sensitive-data detection. It is not a generic LLM jailbreak detector.

Not covered

  • Generic LLM jailbreak detection or prompt filtering at the chat interface.
  • Model training-data extraction, model theft or weights security.
  • Vulnerabilities in your application code outside the retrieval path.
  • Legal determinations. Findings are evidence for a human reviewer.

References