Ghost Vectors: Soft-Deleted Embeddings Remain Reconstructible in HNSW Vector Databases

2026-06-16

AI Summary

This study addresses a critical compliance gap in HNSW-based vector databases: their soft deletion mechanisms fail to meet stringent data erasure requirements under regulations such as GDPR and HIPAA, as sensitive information—including personally identifiable information (PII)—can be reconstructed with near-perfect accuracy (empirically achieving 100% PII recovery) from residual embeddings. To mitigate this risk, the authors propose Epoch Key Rotation, a novel approach that encrypts embeddings upon deletion and immediately discards the encryption key, thereby rendering the data irrecoverable. The method further incorporates ECDSA signatures to generate cryptographically verifiable proofs of deletion. Experimental results demonstrate that this technique reduces PII recovery rates to 0% while maintaining high efficiency, with per-record deletion latency of approximately 0.005 milliseconds, thus simultaneously ensuring regulatory compliance, performance, and auditability.

Abstract

Retrieval-augmented generation (RAG) allows large language models to access external and private corpora for factual, domain-specific responses. Modern RAG pipelines use hierarchical navigable small world (HNSW) vector databases for efficient similarity search. When a user requests data deletion, the systems typically only mark the record as deleted, leaving the embedding on disk physically unchanged. This soft-delete operation raises compliance concerns under data-erasure and retention requirements such as GDPR Article 17 and HIPAA. Analysis on three HNSW implementations confirms that deleted vectors remain physically recoverable by accessing the raw index files at the storage layer, bypassing API access. Using the Vec2Text inversion model without domain-specific fine-tuning, we show this vulnerability on multiple real-world datasets and data modalities. On Wikipedia biographical living persons dataset (BLP), we successfully recover 25.5% of exact person names and 46.4% of geographic locations (ROUGE-L 0.185). Recovery reaches 100% for both patient age and gender markers (ROUGE-L 0.290) on highly structured, sensitive data (NIH Synthea dataset). On soft-deleted image embeddings, we show 100% tissue classification on histopathology patches (p=1.02e-07) and top-1 identity recovery reaches 99% on facial embeddings (p<0.01). This work introduces Epoch Key Rotation, which encrypts vectors and discards the key upon deletion. Epoch key rotation reduces observed PII recovery to 0% and completes in 2.5 ms for 500 deleted vectors (approximately 0.005 ms/record). Additionally, it generates an ECDSA-signed cryptographic proof as an auditable record of the deletion event.

Problem

• soft-deletion
• vector databases
• data erasure
• privacy compliance
• embedding recovery

Innovation

• Ghost Vectors
• HNSW
• Soft Deletion
• Epoch Key Rotation
• Vector Inversion