Red-team lab / Fix the architecture / The shared knowledge base

The shared knowledge base

A SaaS assistant embeds every customer's documents into one shared vector index. The vector database is reachable with a single API key, and document permissions are copied once, at upload.

Attacks to bring to 10% or less

Cross-tenant retrieval: One customer's documents surface in another customer's answers.
Ranking hijack: A planted document is written to rank first for common questions.
Embedding inversion: Stored vectors leak and are turned back into readable text.
Stale permissions: Access removed in the source system still works through the index.

Budget: 6 cost points.

Your mission

Pick controls for this system within the budget of 6 cost points.
Submit the design. Until it passes you see only the remaining risk, how many attacks are still too likely, and the weakest point.
Bring every attack to 10% or less. Then the full breakdown and notes on every control you chose unlock.

Scoring: Each submission counts as an attempt: passing on the first try earns 100 points on the main leaderboard, 10 fewer for each extra submission (never below 10). The Best designs board ranks your best design: the share of risk removed (up to 1000), minus 20 per cost point.

Hints

Where to look
One index holds every customer's documents, and permissions were copied once.
Why the obvious fix falls short opens after 2 attempts
Retrieval returns what's close, not what's allowed. Stored vectors can be turned back into text, and copied permissions go stale.
What kind of control holds opens after 4 attempts
Isolation between tenants, permissions that stay current, a locked-down store, and reviewed sources.

Likelihoods are a teaching model, not measurements: they encode common judgement about how much each control helps.

How is this challenge?

Tenant-isolated indexes cost 2 · engineeringEach customer's embeddings live in a separate index or namespace that queries can't cross.Permission filter at query time cost 2 · engineeringFilter retrieved chunks by the requesting user's permissions before they reach the model.Permission sync and re-indexing cost 1 · opsChanges to access rights in the source systems are pushed to the index promptly.Locked-down vector store cost 1 · opsPrivate network, strong authentication and encryption: stored vectors are never exposed.Trusted-source ingestion cost 1 · opsThe knowledge base only ingests documents from approved, accountable sources.Untrusted-content markers cost 1 · engineeringWrap retrieved or received content in delimiters and tell the model it is data.Hardened system prompt cost 1 · UXDetailed rules in the prompt about secrets, untrusted content and tool use.Logging and anomaly alerts cost 1 · engineeringLog prompts, tool calls and outputs; alert on unusual patterns.

Cost 0 / 6

Loading…

Score = share of risk removed (up to 1000) minus 20 per cost point. Your best design counts.

Built with Llama

The shared knowledge base

What your controls do, and don't

Joseph's walkthrough

What your controls do, and don't

Joseph's walkthrough

Share how you solved it (optional)

Other players' solutions