Implementation guide
OWASP AISVS v1.01
Memory, Embeddings & Vector Database Security · Embedding Sanitization & Validation
Quarantine unusual vectors
Verify that vectors that fall outside normal clustering patterns are flagged and quarantined before entering production indices.
OWASP AISVS v1.01, requirement 8.2.2
In plain English
Before new vectors go into a production index, compare them with what is already there. Hold back those that sit far from the normal patterns. An outlier may be a broken embedding, or it may be content crafted to be retrieved for queries it has no business matching.
What good looks like
- New vectors are checked against the distribution of the existing index at ingestion.
- Outliers are quarantined and do not reach the production index.
- Someone reviews the quarantine on a schedule, and items are released or deleted.
- Thresholds are tuned so that the queue stays small enough to review.
How teams usually do it
- Basic checks first: vector norm, dimension, not-a-number values and exact duplicates.
- Distance to the nearest cluster centre or nearest neighbours, with a threshold set from your own data.
- A standard outlier detector such as isolation forest or local outlier factor, run per collection.
Suggested evidence
- Check configuration and thresholds.
- Quarantine records and review decisions.
- A test where a deliberately odd vector is caught.
Common mistakes
- A quarantine nobody reviews.
- Thresholds copied from a blog post without testing on your own data.
- Treating this as the only poisoning defence. Well-made poisoned content can sit comfortably inside a normal cluster (see 8.2.4).
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.