What a Secret Rotation Buys: Exact Retrieval and Measured Leakage in Vector Databases

Vector databases require embedding geometry for similarity search, but that geometry can also support inference. We evaluate keyed orthogonal obfuscation against a snapshot adversary. The practical Walsh–Hadamard construction has no established confidentiality guarantee; its empirical evaluation covers only the tested attacks. For Haar-uniform maps, the Gram matrix exactly characterizes a reused-key corpus view, whereas it is only a leakage lower bound for the structured implementation. Across three BEIR datasets, three encoders and 2029 queries, exhaustive clear/transformed top-10 sets agree in all nine configurations. Five of six containerized engines also return identical sets; the sixth exhibits comparable re-indexing variability. Median client transform latency is 0.032–0.042 ms. Known rank-sufficient pairs recover the map. Without matched records, same-distribution auxiliary embeddings support median four-way topic accuracies of 0.833, 0.808 and 0.869 in the primary experiment. A paired evaluation over five shared-label mixtures and 30 trials per encoder shows that public-distribution shift reduces assigned-label accuracy, while evaluator-only label reassignment and normalized mutual information reveal residual topic structure. Noise-padding findings are restricted to four estimators on SciFact/MiniLM at one corpus size. These results characterize exact similarity preservation and measured leakage, not encryption or general semantic confidentiality.