AI 中文总结
研究发现向量数据库API可见删除无法实现完整语义擦除，提出Ghost Echoes框架证实已删记录会扰动RAG检索上下文，ChromaDB和FAISS实验显示存在可测漂移，需开发作用于检索拓扑的擦除原语。
AI 中文摘要
尽管向量数据库正确实现了API可见的删除操作，但这并不能保证检索支持型应用能完成完整的语义擦除。我们提出了Ghost Echoes，这是一个黑盒攻击框架，表明已删除的记录会对下游检索上下文留下可测量的残余影响。我们的主要发现是RAG检索上下文漂移效应：即使目标记录被正确排除在查询结果之外，其先前的存在仍会扰动Top-K证据库的语义中心和文本构成。我们使用同簇非目标删除对照来近似不可观测的从未插入的反事实，该对照保留了局部邻域结构，同时将目标特定效应与一般局部漂移隔离开来。在ChromaDB上的评估证实，目标删除会产生0.1522的中位检索中心漂移，在54次配对比较中有53次超过同簇基线（p < 0.001），且在查询预算q=5时，该信号仍能以61.1%的准确率被检测到。我们验证了所有评估后端的API可见删除正确性，并在匹配的FAISS复现中观察到相同的定性漂移排序。在评估设置下，测试的操作缓解措施（如完整索引重建）无法消除测得的漂移。这些结果确立了接口级删除合规性与真正语义擦除之间可测量的「验证差距」，并推动了擦除原语的发展，这些原语不仅作用于存储标识符，还作用于系统的检索拓扑结构。
英文摘要
Although vector databases correctly implement API-visible deletion, this does not guarantee complete semantic erasure for retrieval-backed applications. We present Ghost Echoes, a black-box attack framework showing that deleted records can leave measurable residual influence on downstream retrieval contexts. Our primary finding is the RAG retrieval-context drift effect where even when a target record is correctly excluded from query results, its prior presence perturbs the semantic centroid and textual composition of the Top-K evidence base. We approximate the unobservable never-inserted counterfactual using a same-cluster non-target deletion control that preserves local neighborhood structure while isolating target-specific effects from generic local drift. Evaluation on ChromaDB confirms target deletion produces a median retrieval-centroid drift of 0.1522, exceeding the same-cluster baseline in 53/54 paired comparisons (p < 0.001), and the signal remains detectable with 61.1% accuracy at a query budget of q = 5. We verify API-visible deletion correctness across evaluated backends and observe the same qualitative drift ordering in matched FAISS replication. Under the evaluated settings, tested operational mitigations such as full index rebuilds fail to eliminate the measured drift. These results establish a measurable 'verification gap' between interface-level deletion compliance and true semantic erasure, and motivate erasure primitives that act not only on stored identifiers, but also on the retrieval topology of the system.
Comments17 pages, 4 figures, 2 tables. Preprint. Under submission at the SHIELD Workshop (ECML PKDD 2026)
