A team claims their data store is privacy-safe because it only stores embeddings, not the original sensitive text. Explain why this claim is fragile, citing the inversion-attack literature.
Free · 2 AI evals / day
An **embedding** is a numeric summary of a piece of text, designed so that similar texts produce similar summaries. The same property that makes embeddings useful for semantic search (that they preserve meaning) is what makes them invertible. They are lossy but not destructive, and certainly not one-way.
The headline result is **Vec2Text**, a 2023 paper showing that you can train a model to take an embedding and reconstruct the original text. On short English sentences, Vec2Text recovers about 90% of the original tokens given only black-box query access to the embedding model.
Names, addresses, identifiers, and medical phrases tend to leak especially well because the embedding model is trained to preserve specific token information when it matters for downstream tasks.
The claim *we only store embeddings, so we are safe* misreads what embeddings are. They are closer to a slightly degraded copy of the text than to a hash. For real privacy you need actual encryption of the embeddings at rest, access control on the embedding model so attackers cannot query it freely. For the most sensitive data, redacting or anonymizing inputs before embedding.
Regulators have caught up. GDPR treats embeddings of personal data as personal data themselves when the original is reconstructable, which it usually is.
Embeddings preserve enough information to allow substantial reconstruction of the original text. That property is the whole point: semantic search works because the embedding retains *what the text means*, which is also exactly what an attacker needs to invert it.
The canonical reference is **Morris et al., Text Embeddings Reveal (Almost) As Much As Text** (2023), which introduced **Vec2Text**. The attacker trains a sequence to sequence model to map embeddings back to text. With only black-box query access to the target embedding model, Vec2Text reconstructs approximately 90% of short English texts with high fidelity.
Even without exact-model access, generic inverters trained on a public embedding model often transfer to nearby models.
Sensitive content leaks particularly well. Names, addresses, customer IDs, and medical phrases are preserved with disproportionate fidelity because the embedding model is trained to keep specific token information when it matters for downstream tasks. The inversion is not a noisy paraphrase; it often includes the literal sensitive substring.
Practical mitigations come in layers. **Encryption at rest** of both source text and embeddings is the baseline. **Access control on the embedding model** matters because the attack assumes query access. Closing that channel raises the cost substantially. For high-stakes data, content redaction before embedding (PII scrub) or differential privacy trained embeddings add structural protection rather than just defense in depth.
The regulatory framing is settling. GDPR and similar frameworks treat embeddings of personal data as personal data when reconstructable, which the Vec2Text result makes the default assumption. A team that ships embeddings of sensitive content into a third-party vector store without considering these mitigations is taking on the same liability as if they had shipped the raw text.
Quick reference
TL;DR
Embeddings are lossy, not one-way: Vec2Text-style inversion reconstructs ~90% of short English from embeddings, so storing only embeddings is closer to storing the text than to storing a hash.
Picture a photograph passed through a slight blur. You cannot read every word on a sign in it, but the shapes are still there and a determined person can sharpen the image and recover most of what was written.
Embeddings work like that blurred photograph. They are not the original text, but they hold enough trace information that someone with the right tools can reverse the process and recover the words. The research paper that proved this in 2023 showed almost ninety percent of short English texts could be rebuilt from their embeddings alone.
So a claim like 'we only store embeddings, we are safe' is mostly wishful thinking. The original is still in there, just blurred.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
Public corpora where the source text is already publicly available. Inversion does not expose anything new if the original text is public; the privacy concern only applies to sensitive or proprietary content.
Aggregated or population-level embeddings where individual records cannot be isolated. Inversion targets a specific embedding; without per-record granularity there is no single embedding to invert back to a sensitive original.
Synthetic-data benchmarks generated specifically for testing. There is no real PII to protect, so the privacy threat model does not apply even if the embeddings are technically invertible.
Quick scan · 2–4 min
Everything important, quickly.
60s: embeddings preserve meaning so they are invertible; Vec2Text 2023 reconstructs ~90% of short English with black-box access; sensitive substrings leak especially well; mitigations stack (encryption, model access control, redaction, DP); GDPR/HIPAA implications.
Real-world examples
Real products, models, and research that use this idea.
1Morris et al. Vec2Text demonstration in 2023 reconstructed sensitive substrings (names, addresses, account-style IDs) from OpenAI embeddings with high fidelity under black-box access.
2EU regulators in 2024-25 began explicitly classifying embeddings of personal data as personal data under GDPR Article 4, citing inversion-attack literature.
3Anthropic's 2026 security guidance for embeddings recommends PII redaction before embedding and access control on the embedding model as the baseline mitigations.
4Snowflake's Arctic Embed L 2.0 documentation includes a privacy section that explicitly references Vec2Text and recommends encryption at rest plus redaction for HIPAA-covered data.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QHow does a DP-trained embedding actually limit inversion, and what does it cost?
Sign in or go Pro to see the approach for this follow-up.
QWhy is access control on the embedding model itself such an effective mitigation?
Sign in or go Pro to see the approach for this follow-up.
QSuppose you must ship embeddings of medical records into a third-party vector DB. What does a compliant architecture look like?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Treating an embedding like a hash. Hashes are one-way; embeddings preserve enough information for semantic search to work, which is exactly the information an attacker needs to invert them.