Embedding model mismatch
ID |
embedding-model-mismatch |
Severity |
high (catalogue Medium; platform severity model has no 'medium') |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
OWASP LLM |
LLM04:2025 — Data and Model Poisoning |
OWASP ASI |
ASI06:2026 |
Family |
LLM04 — Data and Model Poisoning |
Red-team vectors |
RAG Poisoning |
Tags |
ai_security |
Description
A vector store is built (indexed) with one embedding model and queried with a different one. Embeddings from different models live in incompatible vector spaces, so the nearest-neighbour search returns meaningless results — retrieval fidelity is silently corrupted. The detector fires only when two or more distinct, resolved embedding models are observed on the store’s code path; a single embedder (match) or an unresolved one (unknown ≠ mismatch) produces no finding.
Examples
store = Chroma(embedding_function=OpenAIEmbeddings(model="text-embedding-3-small"))
# ... elsewhere on the query path ...
q = OpenAIEmbeddings(model="text-embedding-ada-002").embed_query(text) (1)| 1 | Query embedder differs from the index embedder — flagged. |
Using the same embedding model for indexing and querying produces no finding.