Vector Sanitizer：针对 AI 系统中基于 embedding 攻击的数学防御

As Large Language Models (LLMs) and vector search engines become core components of modern software architecture, a new class of security vulnerabilities has emerged: embedding-based attacks. Traditional Web Application Firewalls (WAFs) and input sanitizers are built for text—they look for SQL injections, XSS payloads, or malicious system prompts in strings. However, when text is converted into dense vector representations (embeddings) via models like OpenAI's text-embedding-3 or open-source alternatives, traditional text-based filters are completely bypassed. An attacker can craft malicious semantic payloads, obfuscated instructions, or out-of-distribution high-magnitude vectors designed to manipulate retrieval-augmented generation (RAG) systems or vector classifiers. In this article, we will explore Vector Sanitization: a mathematical defense mechanism that inspects, normalizes, and bounds embedding vectors before they hit your vector database or downstream machine learning pipelines. The Threat Model: Why Vector Spaces are Vulnerable When text is embedded into a high-dimensional vector space (e.g., 1536 dimensions), semantic meaning is represented by the geometric position and direction of the vector. Embedding-Space Jailbreaks: Adversaries can find adversarial perturbations in the continuous embedding space that bypass string filters entirely while still triggering harmful behaviors in downstream models. Magnitude Manipulation (Out-of-Distribution Attacks): Some similarity metrics (like Cosine Similarity) are insensitive to vector magnitude if normalized, but Euclidean distance or dot-product metrics can be heavily skewed if an attacker injects vectors with abnormally high norms, causing denial-of-service or priority-hijacking in retrieval systems. To mitigate this, we need a runtime guardrail that acts as a "WAF for vectors." graph TD A["Raw Text Input"] -- "Embedding Model" --> B["Raw Vector (d-dimensions)"] B --> C["Vector Sanitizer (Norm & Outlier Check)"] C -- "Passes Validation" --> D["Vector Database / RAG Pipeline"] C -- "Fails Validation" --> E["Security Exception / Fallback"] subgraph Vector Sanitizer Pipeline C1["1. NaN / Inf Check"] --> C2["2. Norm Bounds Validation"] C2 --> C3["3. Geometric Projection (Clipping/Rescaling)"] end style C fill:#f9f,stroke:#333,stroke-width:2px Designing a Vector Sanitizer in Python Below is a production-ready Python implementation of a VectorSanitizer. It performs three critical operations: Sanity Checking: Detects NaN, Inf, or zero-vectors. Norm Bounding: Ensures the vector's L2 norm falls within an acceptable statistical range (preventing magnitude-based exploits). Geometric Projection: Instead of hard-rejecting out-of-bounds vectors (which can cause availability issues), it safely projects them back onto the valid spherical boundary or scales them appropriately. import numpy as np from typing import Union, List class VectorSanitizer: def __init__( self, expected_dim: int = 1536, min_norm: float = 0.1, max_norm: float = 10.0, strict_mode: bool = True ): """ Initializes the Vector Sanitizer with security boundaries. :param expected_dim: Expected dimensionality of the embedding vector. :param min_norm: Minimum allowable L2 norm to prevent null-vector injection. :param max_norm: Maximum allowable L2 norm to prevent magnitude manipulation. :param strict_mode: If True, raises an exception on violation. If False, auto-corrects. """ self.expected_dim = expected_dim self.min_norm = min_norm self.max_norm = max_norm self.strict_mode = strict_mode def sanitize(self, vector: Union[List[float], np.ndarray]) -> np.ndarray: """ Validates and sanitizes an incoming embedding vector. """ # Convert input to numpy array v = np.asarray(vector, dtype=np.float32) # 1. Dimensionality Check if v.ndim != 1 or v.shape[0] != self.expected_dim: raise ValueError( f"Dimension mismatch: expected {self.expected_dim}, got {v.shape}" ) # 2. Numerical Stability Check (NaN / Inf) if not np.isfinite(v).all(): raise SecurityError("Vector contains NaN or Infinite values.") # 3. Zero Vector Check norm = np.linalg.norm(v) if norm == 0.0: raise SecurityError("Zero-vector detected. Potential null-injection attack.") # 4. Norm Boundary Validation & Correction if norm self.max_norm: if self.strict_mode: raise SecurityError( f"Vector L2 norm ({norm:.4f}) outside allowed range " f"[{self.min_norm}, {self.max_norm}]" ) else: # Geometric projection / scaling back to boundary target_norm = np.clip(norm, self.min_norm, self.max_norm) v = v * (target_norm / norm) return v class SecurityError(Exception): """Custom exception raised when an embedding violates security policies.""" pass # --- Example Usage --- if __name__ == "__main__": sanitizer = VectorSanitizer(expected_dim=4, min_norm=0.5, max_norm=5.0, strict_mode=False) # Normal vector valid_vector = [0.1, 0.2, 0.3, 0.4] print("Original:", valid_vector) print("Sanitized:", sanitizer.sanitize(valid_vector)) # Out-of-bounds high magnitude vector (attack simulation) malicious_vector = [10.0, 20.0, 30.0, 40.0] try: # With strict_mode=True this would raise SecurityError. # With strict_mode=False, it safely projects it back. sanitizer_strict = VectorSanitizer(expected_dim=4, strict_mode=True) sanitizer_strict.sanitize(malicious_vector) except SecurityError as e: print(f"Blocked malicious vector: {e}") Enter fullscreen mode Exit fullscreen mode 💡 For immediate deployment: The complete source code suite (ZIP) for this architecture is available on Gumroad for $0+ (Pay What You Want). Why Geometric Projection over Simple Clipping? When dealing with out-of-bounds vectors, naive element-wise clipping (e.g., np.clip(v, -1, 1)) alters the direction of the vector in high-dimensional space. Changing the direction changes the semantic meaning, which can degrade the performance of your search or classification pipeline. Instead, scaling the entire vector by its L2 norm preserves its precise angular orientation (and thus its semantic cosine similarity) while strictly bounding its magnitude. This ensures that safety mechanisms do not inadvertently corrupt legitimate user intent. Best Practices for Production AI Security Layered Defense: Do not rely solely on vector sanitization. Combine text-level guardrails (prompt injection filters) with vector-level sanitization. Monitor Norm Distributions: Log the distribution of L2 norms coming out of your embedding generation pipeline. Sudden shifts in average norm often indicate automated probing or adversarial attacks. Fail Secure: Ensure that if your sanitizer encounters an unhandled exception or parsing error, the system defaults to rejecting the vector rather than letting it pass through. Conclusion As AI architecture matures, securing the pipeline must extend beyond the text prompt layer and into the latent vector space. Implementing a lightweight Vector Sanitizer gives engineering teams deterministic control over incoming embeddings, protecting vector databases and RAG workflows from geometric and magnitude-based exploits. If this engineering log saved your production server (and your sanity), consider supporting our architecture on GitHub Sponsors.