Versatile AI Risk Assessment

AI threat catalogue Privacy and Data Leakage Production

Cross-Tenant Leakage (Multi-Tenant Vector DB)

On AI platforms that serve several customers on shared infrastructure, one customer's data can surface in another customer's answers when tenant isolation in the shared knowledge store is incomplete.

As of: October 2026 · Catalogue version 2026.10.24.2 · 6 mitigations · 10 verified sources

Description

Many AI applications look up knowledge via RAG (retrieval augmented generation, the practice of consulting a connected knowledge base) and store text for this purpose as numerical sequences (embeddings) in a vector database. When a platform serves several tenants, meaning customers or departments on the same infrastructure, filters and permissions must cleanly separate whose documents each query searches. If those filters are missing or storage areas are misconfigured, one tenant's search returns text passages belonging to another, and the model weaves them into its answer. This can happen in normal operation; attackers can additionally provoke it with targeted queries. The embeddings themselves offer no protection either, because the original text can largely be reconstructed from them.

Possible impact

One customer's confidential documents are disclosed to another, breaching contractual confidentiality commitments and, where personal data is involved, the GDPR, including notification duties and the risk of fines. For the data subjects concerned, this means their data ends up with unauthorised third parties. For the operator, customer trust in the entire platform is at stake.

Example

A software vendor runs an AI assistant for many corporate customers on a shared vector database. A missing tenant filter means that one customer's question about contract terms pulls passages from another customer's uploaded contract into the answer.

Recommended mitigations (6)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Strict tenant isolation in vector DB

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Data, Infrastructure
    Classification and rationale

    Primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.

  • Per-tenant namespaces / partitions

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Data, Infrastructure
    Classification and rationale

    Primarily technical: Architectural and runtime boundaries separate data, execution, or tenants and limit the spread of failures.

  • Query scoping at retrieval time

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions.

  • Encryption at rest per tenant

    Technical
    Effect
    Preventive, Impact-limiting
    Implementation level
    Data, Infrastructure
    Classification and rationale

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance.

  • Access control testing across tenants

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents, Infrastructure, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

  • Audit logs for retrieval operations

    Technical
    Effect
    Detective
    Implementation level
    Data, Application, API & agents, Use & operations
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators; complemented by binding workflows.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM02:2026 · LLM09:2026NIST AI RMF MEASURE 2.10 · NISTAML.015 · NISTAML.036MITRE ATLAS AML.T0025 · AML.T0057EU AI Act Article 9(1), 9(2)(a), 9(2)(d)GDPR Article 25(1)–(2)BSI R23

Verified references (10)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Privacy and Data Leakage.

Privacy Attacks Attackers coax personal or sensitive information about the training data out of an AI model through carefully crafted queries, for example … Sensitive Information Disclosure An AI system discloses confidential information without anyone intending it: trade secrets, personal data, credentials or internal … Exfiltration from ML Application Attackers or insiders copy data, model weights or configurations straight out of a production AI application without authorisation, …

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

Particularly important for:

  • AI assistant in office applicationsFolders containing personnel or board records are accidentally shared with everyone. The assistant finds them and reveals their contents to anyone who asks.
  • Police data analysis platformsThe platform combines cases that not every investigator may access. If search or graph permissions fail, investigators see people and incidents from other cases.

For 6 further use cases, relevance depends on the system design, for example whether it holds documents from several permission groups in one search store or searches its own document collection. Show these use cases

Frequently asked questions

What is Cross-Tenant Leakage (Multi-Tenant Vector DB)?
On AI platforms that serve several customers on shared infrastructure, one customer's data can surface in another customer's answers when tenant isolation in the shared knowledge store is incomplete.
Which mitigations help against Cross-Tenant Leakage (Multi-Tenant Vector DB)?
The catalogue lists 6 mitigations, each with control type, effect and implementation level. First among them are Strict tenant isolation in vector DB, Per-tenant namespaces / partitions and Query scoping at retrieval time.
Which EU AI Act obligations does Cross-Tenant Leakage (Multi-Tenant Vector DB) touch?
The catalogue maps this threat to Art. 9 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Cross-Tenant Leakage (Multi-Tenant Vector DB)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/cross-tenant-leakage/

← Back to the full catalogue