Vector Sanitizer: Mathematical Defense Against Embedding-Based Attacks in AI Systems

As Large Language Models (LLMs) and vector search engines become core components of modern software architecture, a new class of security vulnerabilities has emerged: embedding-based attacks.

Traditional Web Application Firewalls (WAFs) and input sanitizers are built for text—they look for SQL injections, XSS payloads, or malicious system prompts in strings. However, when text is converted into dense vector representations (embeddings) via models like OpenAI's text-embedding-3 or open-source alternatives, traditional text-based filters are completely bypassed.

An attacker can craft malicious semantic payloads, obfuscated instructions, or out-of-distribution high-magnitude vectors designed to manipulate retrieval-augmented generation (RAG) systems or vector classifiers.

In this article, we will explore Vector Sanitization: a mathematical defense mechanism that inspects, normalizes, and bounds embedding vectors before they hit your vector database or downstream machine learning pipelines.

When text is embedded into a high-dimensional vector space (e.g., 1536 dimensions), semantic meaning is represented by the geometric position and direction of the vector.

To mitigate this, we need a runtime guardrail that acts as a "WAF for vectors."

graph TD
    A["Raw Text Input"] -- "Embedding Model" --> B["Raw Vector (d-dimensions)"]
    B --> C["Vector Sanitizer (Norm & Outlier Check)"]
    C -- "Passes Validation" --> D["Vector Database / RAG Pipeline"]
    C -- "Fails Validation" --> E["Security Exception / Fallback"]

    subgraph Vector Sanitizer Pipeline
    C1["1. NaN / Inf Check"] --> C2["2. Norm Bounds Validation"]
    C2 --> C3["3. Geometric Projection (Clipping/Rescaling)"]
    end

    style C fill:#f9f,stroke:#333,stroke-width:2px

Below is a production-ready Python implementation of a VectorSanitizer. It performs three critical operations:

NaN, Inf, or zero-vectors.

import numpy as np
from typing import Union, List

class VectorSanitizer:
    def __init__(
        self, 
        expected_dim: int = 1536, 
        min_norm: float = 0.1, 
        max_norm: float = 10.0,
        strict_mode: bool = True
    ):
        """
        Initializes the Vector Sanitizer with security boundaries.

        :param expected_dim: Expected dimensionality of the embedding vector.
        :param min_norm: Minimum allowable L2 norm to prevent null-vector injection.
        :param max_norm: Maximum allowable L2 norm to prevent magnitude manipulation.
        :param strict_mode: If True, raises an exception on violation. If False, auto-corrects.
        """
        self.expected_dim = expected_dim
        self.min_norm = min_norm
        self.max_norm = max_norm
        self.strict_mode = strict_mode

    def sanitize(self, vector: Union[List[float], np.ndarray]) -> np.ndarray:
        """
        Validates and sanitizes an incoming embedding vector.
        """
        v = np.asarray(vector, dtype=np.float32)

        if v.ndim != 1 or v.shape[0] != self.expected_dim:
            raise ValueError(
                f"Dimension mismatch: expected {self.expected_dim}, got {v.shape}"
            )

        if not np.isfinite(v).all():
            raise SecurityError("Vector contains NaN or Infinite values.")

        norm = np.linalg.norm(v)
        if norm == 0.0:
            raise SecurityError("Zero-vector detected. Potential null-injection attack.")

        if norm < self.min_norm or norm > self.max_norm:
            if self.strict_mode:
                raise SecurityError(
                    f"Vector L2 norm ({norm:.4f}) outside allowed range "
                    f"[{self.min_norm}, {self.max_norm}]"
                )
            else:
                target_norm = np.clip(norm, self.min_norm, self.max_norm)
                v = v * (target_norm / norm)

        return v

class SecurityError(Exception):
    """Custom exception raised when an embedding violates security policies."""
    pass

if __name__ == "__main__":
    sanitizer = VectorSanitizer(expected_dim=4, min_norm=0.5, max_norm=5.0, strict_mode=False)

    valid_vector = [0.1, 0.2, 0.3, 0.4]
    print("Original:", valid_vector)
    print("Sanitized:", sanitizer.sanitize(valid_vector))

    malicious_vector = [10.0, 20.0, 30.0, 40.0]
    try:
        sanitizer_strict = VectorSanitizer(expected_dim=4, strict_mode=True)
        sanitizer_strict.sanitize(malicious_vector)
    except SecurityError as e:
        print(f"Blocked malicious vector: {e}")

💡 For immediate deployment: The complete source code suite (ZIP) for this architecture is available on Gumroad for $0+ (Pay What You Want).

When dealing with out-of-bounds vectors, naive element-wise clipping (e.g., np.clip(v, -1, 1)) alters the direction of the vector in high-dimensional space. Changing the direction changes the semantic meaning, which can degrade the performance of your search or classification pipeline.

Instead, scaling the entire vector by its L2 norm preserves its precise angular orientation (and thus its semantic cosine similarity) while strictly bounding its magnitude. This ensures that safety mechanisms do not inadvertently corrupt legitimate user intent.

As AI architecture matures, securing the pipeline must extend beyond the text prompt layer and into the latent vector space. Implementing a lightweight Vector Sanitizer gives engineering teams deterministic control over incoming embeddings, protecting vector databases and RAG workflows from geometric and magnitude-based exploits.

If this engineering log saved your production server (and your sanity), consider supporting our architecture on GitHub Sponsors.