Data Structures for AI/ML and Vector Retrieval

Introduction and Context

Modern AI/ML systems increasingly represent text, images, audio, code, users, products, and documents as high-dimensional vectors called embeddings. Once data has been embedded, a central computational task is vector retrieval: given a query vector, return the database vectors most similar to it. This operation supports semantic search, recommender systems, anomaly detection, duplicate detection, clustering, retrieval-augmented generation (RAG), and multimodal applications.

Exact nearest-neighbor search is conceptually simple but becomes expensive at scale. If there are N vectors of dimension d, a brute-force search generally computes a distance to every vector, requiring approximately O(Nd) arithmetic operations per query. For millions or billions of vectors, this cost creates unacceptable latency or infrastructure expense. Advanced data structures reduce search time by accepting controlled approximation, compressing vectors, or organizing candidates in searchable partitions and graphs.

This chapter evaluates five important approaches: inverted indexes, locality-sensitive hashing (LSH), product quantization (PQ), inverted file with product quantization (IVF-PQ), and hierarchical navigable small-world graphs (HNSW). It also explains embeddings, similarity functions, retrieval quality, RAG architecture, and the engineering trade-offs among accuracy, latency, memory, update cost, and scale.

Learning Objectives

After completing this chapter, students should be able to:

1. Explain why exact nearest-neighbor search becomes difficult in high-dimensional spaces.
2. Distinguish lexical inverted indexes from vector-oriented partitioning structures.
3. Describe the principles, assumptions, and limitations of LSH, PQ, IVF-PQ, and HNSW.
4. Select suitable structures using accuracy, latency, memory, update, and scale requirements.
5. Design an embedding-retrieval pipeline for semantic search and RAG.
6. Evaluate retrieval systems using appropriate offline and online metrics.
7. Identify operational, ethical, and governance risks in vector retrieval.

1. Embeddings, Similarity, and Nearest Neighbors

An embedding model maps an object x to a vector z ∈ ℝᵈ. The dimension d is fixed for a particular model, although different models may use different dimensions. Similar objects should ideally have nearby vectors under a chosen similarity measure. This property is learned from training data and is not guaranteed merely because two vectors are numerically close.

1.1 Distance and similarity functions

For vectors x and y, Euclidean distance is

where xᵢ and yᵢ are corresponding coordinates. It is appropriate when magnitude and coordinate geometry are meaningful.

The squared Euclidean distance is often used computationally because it preserves ordering while avoiding a square root:

The cosine similarity is

where x · y is the dot product and ||x||₂ is the Euclidean norm. It measures orientation rather than absolute magnitude. It is defined only for nonzero vectors.

If all vectors are normalized to unit length, then

Thus maximizing dot product, maximizing cosine similarity, and minimizing Euclidean distance are equivalent for unit-normalized vectors. This equivalence does not hold for unnormalized vectors.

The choice of metric must match embedding-model training and application semantics. A model trained with cosine-based objectives may perform poorly if deployed with an unrelated metric. Distance calculations should also use the same preprocessing, normalization, and numerical precision during indexing and querying.

1.2 Exact k-nearest-neighbor search

Given a query q and a dataset X = {x₁, …, x_N}, exact k-nearest-neighbor search returns the k vectors with smallest distance to q, or largest similarity where appropriate. A simple algorithm scans all N vectors, computes each distance, and maintains a size-k heap.

For dense vectors, the arithmetic cost is approximately O(Nd), while the result-maintenance cost is commonly O(N log k). The storage cost for uncompressed 32-bit floating-point vectors is approximately 4Nd bytes, excluding identifiers and index metadata. For N = 10,000,000 and d = 768, the raw vector storage is approximately 30.72 GB because 10,000,000 × 768 × 4 bytes equals 30,720,000,000 bytes. Operational systems require additional memory for replicas, indexes, metadata, and temporary buffers.

Exact search remains valuable as a ground-truth reference and can be practical for small collections, batch processing, GPU-accelerated workloads, or high-value applications where approximation is unacceptable.

2. Lexical Inverted Indexes and Their Role

A lexical inverted index maps a term to the documents containing that term. In a simplified form:

A posting may include a document identifier, term frequency, positions, and field information. Search engines use inverted indexes with ranking models such as TF-IDF or BM25. A commonly used BM25 form is

Here f(t,D) is the frequency of term t in document D, |D| is document length, avgdl is average document length, k₁ and b are tuning parameters, and IDF(t) is inverse document frequency. Exact parameter conventions vary across implementations.

Lexical indexes are excellent for exact names, identifiers, rare terms, legal phrases, and transparent matching. They do not naturally retrieve a document that uses a synonym or paraphrase absent from the query. Vector indexes address semantic similarity, but may miss exact tokens, numbers, or newly introduced terminology. Consequently, contemporary systems often use hybrid retrieval: lexical and vector candidates are combined, followed by reranking.

An inverted index should not be confused with an inverted file index for vectors. Both use the word inverted because they map searchable keys to lists, but their keys and ranking mechanisms differ. In an IVF index, a vector is assigned to a centroid and the centroid points to a list of vector identifiers.

3. Approximate Nearest-Neighbor Search

Approximate nearest-neighbor (ANN) methods return candidates that are usually, but not always, the exact nearest neighbors. The central engineering principle is to avoid examining the entire collection. Approximation can arise from hashing, quantization, partition pruning, graph navigation, or combinations of these methods.

Important evaluation dimensions are:

If R(q,k) is the exact set of k nearest neighbors and A(q,k) is the approximate result set, a common query-level recall definition is

This assumes both sets contain k items and that exact results are available. Mean recall is calculated by averaging over a representative query set. Recall is not the same as application relevance: an embedding model can retrieve the mathematically nearest item that is still unhelpful to a user.

4. Locality-Sensitive Hashing

Locality-sensitive hashing is a family of randomized hashing methods designed so that nearby items collide more often than distant items. For a hash family H, the desirable property is that similar pairs have a higher collision probability than dissimilar pairs. Multiple hash functions and hash tables amplify this difference.

For random-hyperplane LSH, a random vector r defines a binary hash bit:

For angular similarity, the probability that two vectors receive different bits is proportional to the angle between them. If θ is the angle in radians, then

This relationship assumes r is sampled from a rotationally symmetric distribution, normally a standard Gaussian distribution, and x and y are nonzero.

Concatenating b independent bits produces a bucket key. Using L independent tables increases the probability that similar points collide in at least one table. Candidate vectors are then examined using the original distance function. Increasing b makes buckets more selective but can reduce candidate recall; increasing L improves recall but increases memory and query work.

Strengths and limitations of LSH

LSH has a strong theoretical foundation for particular metrics and can support distributed partitioning. Hash lookup is conceptually simple, and insertions can be relatively inexpensive. However, high-dimensional data may require many tables and large memory. Collision buckets can be uneven, and selecting parameters for a target recall-latency point is data-dependent. LSH is often less memory-efficient than compressed partition-based or graph indexes for modern dense embeddings.

5. Product Quantization

Product quantization compresses a vector into a short code by splitting its coordinates into subspaces and quantizing each subvector independently. Let x ∈ ℝᵈ be divided into m subvectors, each of dimension d/m, assuming m divides d. For each subspace j, a codebook Cⱼ contains K centroids. The encoder chooses the nearest centroid:

The vector is represented by m centroid indices. If each subspace has K = 2ᵇ centroids, the code uses mb bits per vector, ignoring codebook storage and identifiers. For example, m = 16 and K = 256 gives 16 bytes per vector because each of the 16 indices requires 8 bits.

The codebooks are commonly learned using k-means on training samples. Product quantization reduces memory substantially but introduces quantization error. Approximate distances can be computed using lookup tables. For asymmetric distance computation, the query remains in full precision while each database vector is represented by its code. A table stores the distance from each query subvector to every centroid, and the approximate distance is the sum of the relevant table entries:

This is an approximation to squared Euclidean distance under the product-code representation. Its quality depends on training data, subspace independence assumptions, codebook size, and distribution shift.

Memory example

For 10 million vectors of dimension 768, uncompressed float32 storage is approximately 30.72 GB. A PQ code with m = 96 and 8 bits per subvector uses 96 bytes per vector, or approximately 0.96 GB for the codes. Codebooks, identifiers, and index overhead must be added. The compression is substantial, but recall can decline if the code is too short or the data distribution is poorly represented.

Residual or optimized product quantization can improve accuracy. In residual quantization, a coarse approximation is subtracted first and the residual is encoded. Optimized product quantization may rotate or transform the space to distribute variance more favorably across subspaces.

6. Inverted File Index and IVF-PQ

An inverted file (IVF) partitions vectors into Voronoi-like regions using a coarse quantizer. A training procedure learns nlist centroids. Each database vector is assigned to its nearest centroid, and the centroid stores a posting list of assigned vectors.

At query time, the distances from q to all centroids are computed. Only the nprobe closest lists are searched. If nprobe = nlist, the system examines every list and loses the principal pruning benefit; if nprobe is too small, the true neighbors may lie in unsearched lists.

IVF-PQ combines this partitioning with product quantization. A typical pipeline is:

1. Train a coarse centroid quantizer on representative vectors.
2. Assign each database vector to a coarse list.
3. Compute a residual, often x − centroid(x).
4. Train PQ codebooks on residuals.
5. Store the list identifier and a compressed residual code.
6. At query time, select nprobe lists and scan their codes.
7. Reconstruct or refine a candidate set using higher-precision vectors when available.

A simplified candidate-work estimate is

where N is the number of database vectors and W is the expected number of scanned vectors, assuming balanced lists. This is an approximation: real lists may be imbalanced, and filtering or sharding changes the effective work.

IVF-PQ provides a powerful memory-latency trade-off. Increasing nlist makes lists shorter but makes centroid training and assignment more important. Increasing nprobe improves recall and latency cost. More PQ bytes improve distance fidelity but increase memory bandwidth and storage.

The method is especially suitable for large, mostly static collections. Deletions may be implemented with tombstones or periodic rebuilding. Frequent updates can create fragmentation, stale statistics, and uneven lists. A reranking stage using original vectors can recover accuracy for a limited candidate set, but it adds memory or I/O cost.

7. HNSW Graphs

A graph-based ANN index connects vectors to selected neighboring vectors. HNSW builds a hierarchy of proximity graphs. Each vector is assigned a random maximum level; upper levels are sparse and support long-range navigation, while the bottom level contains the full searchable graph.

Search begins at an entry point in a high layer. The algorithm greedily moves to a neighbor that is closer to the query. When no neighbor improves the current position, it descends to the next layer. At the bottom layer, a broader best-first exploration maintains a candidate queue. The search breadth is controlled by efSearch. Construction uses efConstruction and a maximum neighbor parameter often denoted M.

HNSW does not guarantee exact nearest neighbors. Its quality depends on graph connectivity, insertion order, diversity of selected neighbors, query parameters, and data distribution. A larger M generally improves connectivity and recall but increases memory and construction time. A larger efSearch generally improves recall but increases latency. efConstruction affects build quality and build cost, not directly the per-query exploration breadth.

HNSW often provides excellent latency-recall performance and supports incremental insertion better than IVF-PQ. Its disadvantages include substantial memory overhead for neighbor identifiers and level metadata, more expensive construction, and difficult deletion semantics. Lazy deletion can leave dead nodes that consume memory and interfere with navigation until repair or rebuilding occurs.

HNSW versus IVF-PQ

HNSW stores graph links and often full-precision vectors, so it may require considerably more RAM. IVF-PQ stores compact codes and scans selected lists, so it is often better for very large or memory-constrained datasets. HNSW is attractive for low-latency interactive search and changing collections; IVF-PQ is attractive for massive, compressible, relatively stable collections. Hybrid designs use IVF for coarse routing and graph search within lists, or use compressed candidates followed by graph or exact reranking.

8. Embedding and Retrieval Architecture

A production semantic retrieval system usually contains the following stages:

1. Ingestion: collect documents or records and preserve source identifiers, timestamps, permissions, and provenance.
2. Segmentation: split documents into passages or structured units. Chunks should be large enough to preserve meaning but small enough for focused retrieval.
3. Embedding: apply a versioned embedding model to each chunk.
4. Indexing: store vectors in an ANN structure and store metadata in a filterable system.
5. Query processing: normalize, expand, or classify the query where appropriate.
6. Candidate retrieval: execute vector, lexical, or hybrid retrieval.
7. Filtering: enforce tenant, authorization, time, language, and content constraints.
8. Reranking: apply a cross-encoder or another more expensive relevance model to a small candidate set.
9. Generation or presentation: pass selected evidence to a user interface or language model.
10. Monitoring: measure quality, latency, failures, drift, and access violations.

The order of filtering and ANN search is significant. Pre-filtering can preserve authorization but may leave too few candidates for an ANN structure trained on the full population. Post-filtering can produce empty or low-quality results if many retrieved candidates are ineligible. Filter-aware indexes, partitioned indexes, adaptive over-fetching, and exact checks may be necessary.

9. Retrieval-Augmented Generation

RAG combines retrieval with generative modeling. Instead of requiring a language model to memorize all information, a query retrieves external passages that are inserted into the model context. A simplified process is:

Figure: A simplified retrieval-augmented generation pipeline.

RAG quality depends on both retrieval and generation. Retrieval failure occurs when the relevant passage is absent from the candidate set. Generation failure occurs when the model misinterprets, ignores, or contradicts retrieved evidence. Useful metrics include recall of relevant evidence, context precision, answer faithfulness, citation correctness, and end-to-end task success.

Top-k selection creates a precision-context trade-off. A small k reduces prompt length and distraction but may omit evidence. A large k improves coverage but can increase latency, token cost, redundancy, and conflicting information. Maximal marginal relevance can reduce redundancy by balancing relevance and dissimilarity, but its exact behavior depends on the similarity and diversity functions used.

10. Comparative Evaluation and Design Decisions

Parameter tuning should be empirical. A valid benchmark uses a held-out query set, an exact-search ground truth where feasible, realistic concurrency, warm and cold cache conditions, production-like filters, and representative data distributions. Report p50, p95, and p99 latency rather than only averages. A system with excellent mean latency but unacceptable p99 behavior may be unsuitable for interactive service.

A useful procedure is:

1. Establish exact-search recall and application relevance baselines.
2. Select candidate indexes based on scale and update requirements.
3. Sweep parameters such as nprobe, code size, efSearch, M, hash-table count, or candidate depth.
4. Measure recall, latency, memory, build time, and cost simultaneously.
5. Test distribution shift, long-tail queries, filters, deletions, and concurrent load.
6. Choose a Pareto-efficient operating point rather than maximizing one metric.

The best index is not universally determined by dimension or corpus size. It depends on vector distribution, hardware, query mix, update rate, filtering, acceptable recall, and cost constraints.

11. Illustrative Case Study: Enterprise Policy Assistant

Background

Consider an illustrative enterprise policy assistant containing 25 million passages from internal policies, procedures, technical standards, and audit records. Users require answers within 500 ms for retrieval, and access rights vary by department. Documents change daily, but most passages remain stable.

Problem

A brute-force search over 768-dimensional float32 embeddings requires excessive memory and latency. Pure lexical retrieval misses paraphrases, while pure vector retrieval sometimes fails on policy identifiers and exact regulatory phrases. Unauthorized passages must never enter the language-model context.

Analysis

The system has three distinct requirements: semantic matching, exact-term sensitivity, and strict authorization. A single vector structure cannot solve all three optimally. The team therefore evaluates hybrid retrieval with metadata partitioning, a compressed vector index, and reranking.

Approach and solution

Documents are chunked with section and citation metadata. A versioned embedding model produces normalized vectors. An IVF-PQ index reduces memory, with nlist selected from benchmark experiments and nprobe tuned for the required recall. A lexical inverted index handles policy numbers, named standards, and rare terms. Candidate lists from both systems are fused, then filtered by tenant and authorization before a cross-encoder reranks the surviving candidates. The language model receives only cited passages and is instructed to abstain when evidence is insufficient.

Daily updates are inserted into a small fresh index and periodically merged into the main index. Deletions are represented by tombstones immediately and physically removed during rebuilds. Exact search on a stratified sample provides a recall reference. Monitoring tracks retrieval recall, answer faithfulness, unauthorized-candidate rate, p95 latency, and index freshness.

Outcome

The illustrative design reduces memory and retrieval work compared with exact scanning while preserving high recall through hybrid candidate generation and reranking. Its main operational cost is index maintenance and benchmark discipline. The case demonstrates that a robust system is an architecture, not merely a choice of ANN algorithm.

Learning points

1. Retrieval quality is jointly determined by representation, index, filters, and reranker.
2. Lexical and vector methods are complementary.
3. Authorization must be enforced as a security property, not treated as ordinary relevance metadata.
4. Compression and approximation should be evaluated against application-level outcomes.
5. Freshness and deletion handling are first-class design requirements.

12. Limitations, Governance, and Responsible Use

Embedding spaces can encode demographic, cultural, linguistic, and historical biases present in training data. Semantic similarity may cause sensitive records to be retrieved together even when such association is inappropriate. Vector databases can also create privacy risks: embeddings may reveal attributes, support membership inference, or remain recoverable after source deletion if lifecycle controls are weak.

Access control should be applied before generation and should be tested with adversarial queries. Systems should maintain provenance, model and index versions, retention policies, deletion workflows, and audit logs. Data minimization is preferable to indexing information that is not needed for the task. Encryption in transit and at rest, tenant isolation, and key management are baseline controls.

RAG does not guarantee truth. Retrieved passages can be stale, maliciously inserted, mutually inconsistent, or irrelevant despite high vector similarity. Prompt injection can occur inside retrieved documents. Applications should delimit retrieved content, separate instructions from evidence, validate citations, and define escalation or abstention behavior.

13. Contemporary Developments and Best Practices

Current systems increasingly combine dense embeddings with sparse or lexical representations, rerankers, metadata filters, and learned query routing. Multivector representations can preserve several aspects of a document rather than compressing it into one vector. Disk-oriented ANN methods reduce RAM dependence, while GPU indexes accelerate batch retrieval. Learned indexes and adaptive routing attempt to select search effort according to query difficulty.

Best practices include:

• Normalize vectors only when consistent with the embedding model and selected metric.
• Version embedding models, preprocessing, codebooks, and index parameters.
• Keep an exact or high-quality reference set for evaluation.
• Measure recall and relevance separately.
• Report tail latency under realistic concurrency.
• Test filters, deletions, updates, cold starts, and distribution shift.
• Use hybrid retrieval for exact terms and semantic paraphrases.
• Rerank only a manageable candidate set.
• Monitor index freshness, drift, failures, and access violations.
• Treat privacy, authorization, provenance, and deletion as core data-structure requirements.

Chapter Summary

Vector retrieval enables semantic search and is central to modern AI/ML systems. Exact nearest-neighbor search provides a correctness baseline but scales linearly with the number of vectors. Lexical inverted indexes remain valuable for exact terms and transparent ranking, while dense vector indexes address semantic similarity.

LSH uses similarity-sensitive collisions and offers a principled hashing approach, but can require substantial memory in high dimensions. Product quantization compresses vectors through independently quantized subspaces, trading memory savings for quantization error. IVF-PQ first partitions the space and then compresses residuals, making it suitable for large, relatively stable collections. HNSW uses hierarchical proximity graphs to achieve strong latency-recall performance, generally at higher memory and construction cost.

Index selection is a multi-objective decision involving recall, relevance, latency, throughput, memory, build time, updates, filtering, and cost. RAG systems require more than an ANN index: they need sound chunking, embedding governance, hybrid retrieval, authorization, reranking, provenance, and generation evaluation. Responsible deployment must address bias, privacy, prompt injection, stale evidence, and deletion obligations.

Key Terms

Embedding: A numerical vector representation learned to encode useful relationships among objects.

Nearest-neighbor search: Retrieval of data points closest to a query under a specified metric.

Approximate nearest neighbor: A search method that trades possible accuracy loss for lower computational cost.

Cosine similarity: Similarity based on the angle between two nonzero vectors.

Inverted index: A mapping from lexical terms to documents or postings containing those terms.

Posting list: The list of document or vector identifiers associated with an index key.

Locality-sensitive hashing: Hashing designed to increase collision probability for similar objects.

Product quantization: Compression that quantizes separate vector subspaces using learned codebooks.

Codebook: A collection of centroids used to encode vectors or subvectors.

Inverted file index: A vector index that assigns vectors to coarse centroid lists.

IVF-PQ: An inverted-file index whose vectors or residuals are stored using product quantization.

HNSW: A hierarchical proximity graph used for approximate nearest-neighbor search.

efSearch: A parameter controlling the breadth of HNSW query exploration.

nprobe: The number of IVF lists examined for a query.

Recall@k: The fraction of exact top-k neighbors recovered by an approximate result.

Reranking: Applying a more accurate, usually more expensive model to retrieved candidates.

Hybrid retrieval: Combining lexical and vector retrieval signals.

Retrieval-augmented generation: Generation that conditions a language model on externally retrieved evidence.

Quantization error: The difference introduced when continuous values are represented by discrete codes.

Tail latency: High-percentile response time, such as p95 or p99 latency.

Review Questions

Short Answer Questions

1. Why is brute-force vector search expensive for large collections?
2. Under what condition are cosine similarity and Euclidean distance equivalent for ranking?
3. What is the purpose of nprobe in an IVF index?
4. How does product quantization reduce memory usage?
5. Why are lexical inverted indexes still useful in a semantic retrieval system?

Long Answer Questions

1. Explain the construction and query process of an HNSW index, including the roles of M, efConstruction, and efSearch.
2. Compare LSH, IVF-PQ, and HNSW in terms of accuracy, latency, memory, updates, and scale.
3. Derive and interpret the approximate candidate-work relationship for IVF under balanced lists.
4. Explain how a RAG pipeline can fail at retrieval, ranking, and generation stages.
5. Discuss the governance requirements for embeddings and vector databases in a multi-tenant enterprise.

Analytical / Application Questions

1. A collection contains 50 million 768-dimensional float32 vectors. Compare the raw storage requirement with a 64-byte PQ code per vector, ignoring metadata. What engineering factors must still be added to the estimate?
2. An HNSW system has excellent recall but unacceptable p99 latency, while an IVF-PQ system meets latency targets but misses long-tail queries. Propose a benchmarking and hybrid-retrieval strategy.
3. Design an index architecture for a frequently updated customer-support corpus requiring semantic search, exact ticket-ID lookup, tenant isolation, citations, and RAG. Justify every major component.

Multiple Choice Questions with Answers

Question 1

Which operation is approximately linear in both the number of vectors N and dimension d for exact dense-vector search?

A. Computing distances to every vector

B. Traversing only the top HNSW layer

C. Looking up one lexical posting list

D. Selecting one PQ codebook centroid

Correct Answer: A. Computing distances to every vector

Question 2

For unit-normalized vectors, which relationship is correct?

A. ||x − y||₂² = x · y

B. ||x − y||₂² = 2 − 2(x · y)

C. ||x − y||₂² = 1 + x · y

D. ||x − y||₂² = 2 + 2(x · y)

Correct Answer: B. ||x − y||₂² = 2 − 2(x · y)

Question 3

In random-hyperplane LSH, what determines the hash bit for a nonzero vector x?

A. The document length only

B. Whether the dot product r · x is nonnegative

C. The nearest lexical term

D. The number of database vectors

Correct Answer: B. Whether the dot product r · x is nonnegative

Question 4

A product-quantization code uses m = 16 subspaces and 256 centroids per subspace. How many bytes are required per vector code, ignoring metadata?

A. 8 bytes

B. 16 bytes

C. 32 bytes

D. 256 bytes

Correct Answer: B. 16 bytes

Question 5

What is the principal effect of increasing nprobe in an IVF index?

A. Fewer lists are searched and recall usually decreases

B. More lists are searched and recall usually improves at higher cost

C. The vector dimension is reduced

D. The PQ codebook is retrained for every query

Correct Answer: B. More lists are searched and recall usually improves at higher cost

Question 6

Which parameter primarily controls the breadth of HNSW query exploration?

A. efSearch

B. avgdl

C. IDF

D. nlist only

Correct Answer: A. efSearch

Question 7

What is a major advantage of IVF-PQ over storing all vectors as float32 values?

A. It guarantees exact nearest neighbors

B. It substantially reduces vector storage through quantized codes

C. It eliminates the need for training data

D. It prevents all update-related problems

Correct Answer: B. It substantially reduces vector storage through quantized codes

Question 8

Which metric directly measures the fraction of true top-k neighbors recovered by an approximate index?

A. Recall@k

B. Average document length

C. Build throughput

D. Codebook entropy

Correct Answer: A. Recall@k

Question 9

Why is hybrid lexical-vector retrieval often useful?

A. Lexical and vector indexes always return identical results

B. Lexical search handles exact terms while vectors capture semantic similarity

C. Vector retrieval cannot use metadata

D. Lexical search removes the need for embeddings

Correct Answer: B. Lexical search handles exact terms while vectors capture semantic similarity

Question 10

Which practice best protects authorization in a RAG system?

A. Apply access control only after the language model generates an answer

B. Treat permissions as irrelevant to vector similarity

C. Enforce authorization during candidate selection or before evidence enters context

D. Increase efSearch without changing security controls

Correct Answer: C. Enforce authorization during candidate selection or before evidence enters context