Can You Trust the Vectors in Your Vector Database? Black-Hole Attack from Embedding Space Defects

2026-04-07

AI Summary

Vector databases are widely employed in AI systems, yet their high-dimensional embedding spaces harbor geometric vulnerabilities that can be exploited maliciously. This work uncovers, for the first time, a “centrality-driven hub” phenomenon in the central region of high-dimensional space that can be weaponized. Building on this insight, the authors propose the “blackhole attack,” wherein injecting a small number of adversarial vectors into this central region causes them to appear in up to 99.85% of top-10 retrieval results, severely compromising retrieval reliability. The attack is both highly effective and stealthy, while existing defenses either incur significant accuracy degradation or offer insufficient protection, underscoring the urgent need for novel defense mechanisms.

Abstract

Vector databases serve as the retrieval backbone of modern AI applications, yet their security remains largely unexplored. We propose the Black-Hole Attack, a poisoning attack that injects a small number of malicious vectors near the geometric center of the stored vectors. These injected vectors attract queries like a black hole and frequently appear in the top-k retrieval results for most queries. This attack is enabled by a phenomenon we term centrality-driven hubness: in high-dimensional embedding spaces, vectors near the centroid become nearest neighbors of a disproportionately large number of other vectors, while this centroid region is nearly empty in practice. The attack shows that vectors in a vector database cannot be blindly trusted: geometric defects in high-dimensional embeddings make retrieval inherently vulnerable. Our experiments show that malicious vectors appear in up to 99.85% of top-10 results. Additionally, we evaluate existing hubness mitigation methods as potential defenses against the Black-Hole Attack. The results show that these methods either significantly reduce retrieval accuracy or provide limited protection, which indicates the need for more robust defenses against the Black-Hole Attack.

Problem

• vector database
• Black-Hole Attack
• embedding space
• hubness
• security

Innovation

• Black-Hole Attack
• vector database security
• centrality-driven hubness
• embedding space defects
• poisoning attack