Vec2Text: Reconstructing Private Text from Its Embedding
The vectors in your RAG store aren't anonymous — enough of the original text is recoverable from them.
| When | October 2023 |
|---|---|
| Target | Dense text-embedding models (GTR, OpenAI ada-002) |
| Researchers | Morris et al. (Cornell) |
| Technique | Iterative embedding inversion (Vec2Text) |
| Impact | Exact recovery of 92% of 32-token inputs; patient names from clinical notes |
- 1A system stores embeddings of sensitive text in a vector database
- 2An attacker who obtains an embedding runs iterative inversion (Vec2Text)
- 3The original text — including PII — is reconstructed from the vector alone
What happened
In 2023, Cornell researchers showed that dense text embeddings retain enough information to reconstruct their original input. Their Vec2Text method treats inversion as iterative controlled generation — generate a candidate, re-embed, correct toward the target vector, repeat — and exactly recovered 92% of 32-token inputs. Applied to clinical notes, it recovered sensitive content including patients' full names.
How it works
An embedding is a lossy but rich representation of its text. Given the vector (and query access to the embedding model), an optimiser can search for text that embeds to the same point — reconstructing the original.
Root cause
Treating embeddings as anonymised or non-sensitive, so vector stores get weaker protection than the source data deserves.
Why it matters
If a vector store leaks, or a shared/multi-tenant store is over-permissive, inversion turns “just vectors” back into the confidential documents they came from.
How to prevent it
- Classify and protect vector stores like the source data.
- Isolate embeddings per tenant; control access to the embedding model.
- Don't treat embeddings as anonymised.
Feel it yourselfThe replay lab reconstructs source text from its embedding — the inversion class.
FAQ
Aren't embeddings just anonymous numbers?
No. Vec2Text showed embeddings can be inverted back to their source text — exactly recovering 92% of 32-token inputs — so the vectors in your store are a form of the original data, not a safe abstraction of it.
Why does this matter for RAG?
RAG systems store embeddings of potentially sensitive documents. If those vectors leak (or a shared store is over-permissive), inversion can reconstruct the underlying text, including PII.
How do you defend?
Treat a vector store with the same access controls and classification as the source data; isolate per-tenant; and don't assume embeddings are non-sensitive.
Sources
- Text Embeddings Reveal (Almost) As Much As Text (arXiv:2310.06816) — arXiv
- Text Embeddings Reveal (Almost) As Much As Text — ACL Anthology (EMNLP 2023)
- vec2text (code) — GitHub