AI threat cataloguePrivacy and Data LeakageProduction
Cross-Tenant Leakage (Multi-Tenant Vector DB)
On AI platforms that serve several customers on shared infrastructure, one customer's data can surface in another customer's answers when tenant isolation in the shared knowledge store is incomplete.
Description
Many AI applications look up knowledge via RAG (retrieval augmented generation, the practice of consulting a connected knowledge base) and store text for this purpose as numerical sequences (embeddings) in a vector database. When a platform serves several tenants, meaning customers or departments on the same infrastructure, filters and permissions must cleanly separate whose documents each query searches. If those filters are missing or storage areas are misconfigured, one tenant's search returns text passages belonging to another, and the model weaves them into its answer. This can happen in normal operation; attackers can additionally provoke it with targeted queries. The embeddings themselves offer no protection either, because the original text can largely be reconstructed from them.
Possible impact
One customer's confidential documents are disclosed to another, breaching contractual confidentiality commitments and, where personal data is involved, the GDPR, including notification duties and the risk of fines. For the data subjects concerned, this means their data ends up with unauthorised third parties. For the operator, customer trust in the entire platform is at stake.
Example
A software vendor runs an AI assistant for many corporate customers on a shared vector database. A missing tenant filter means that one customer's question about contract terms pulls passages from another customer's uploaded contract into the answer.
Recommended mitigations (6)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Strict tenant isolation in vector DBTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Data, Infrastructure
- Reason for the classification
- “Strict tenant isolation in vector DB” is primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.
Per-tenant namespaces / partitionsTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Data, Infrastructure
- Reason for the classification
- “Per-tenant namespaces / partitions” is primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.
Query scoping at retrieval timeTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Reason for the classification
- “Query scoping at retrieval time” is primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions.
Encryption at rest per tenantTechnical
- Effect
- Preventive, Impact-limiting
- Implementation level
- Data, Infrastructure
- Reason for the classification
- “Encryption at rest per tenant” is primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance.
Access control testing across tenantsTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents, Infrastructure, Use & operations
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Access control testing across tenants” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.
Audit logs for retrieval operationsTechnical
- Effect
- Detective
- Implementation level
- Data, Application, API & agents, Use & operations
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Audit logs for retrieval operations” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (10)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM02:2025 Sensitive Information DisclosureLLM02:2025 Sensitive Information Disclosure, official category page OWASP FoundationOriginal
- OWASP LLM Top 10 LLM08:2025 Vector and Embedding WeaknessesLLM08:2025 Vector and Embedding Weaknesses, official category page OWASP FoundationOriginal
- NIST AI RMF MEASURE 2.10 MEASURE 2.10MEASURE 2.10, p. 30 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.015 Indirect Prompt InjectionTaxonomy Index, pp. x–xi; Section 3.4, pp. 50–53; Glossary, p. 110 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.036 Leaking information from user interactionsTaxonomy Index, p. xi; Section 3.4.3, pp. 52–53 National Institute of Standards and Technology (NIST)Original
- MITRE ATLAS AML.T0025 Exfiltration via Cyber MeansATLAS.yaml technique object with id AML.T0025 (pinned release v5.6.0) MITREOriginal
- MITRE ATLAS AML.T0057 LLM Data LeakageATLAS.yaml technique object with id AML.T0057 (pinned release v5.6.0) MITREOriginal
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- GDPR Article 25(1)–(2) Data protection by design and by defaultArticle 25(1) and 25(2) European Union (EUR-Lex)Original
- BSI R23 Embedding Inversion (Text, Bild, Video)Kap. 4, R23, p. 28 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- RAG (retrieval augmented generation) The model pulls matching documents from your own knowledge base before answering.
Related threats
More entries from the topic group Privacy and Data Leakage.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Cross-Tenant Leakage (Multi-Tenant Vector DB)”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/cross-tenant-leakage/