The article discusses 'Vec2text', a method that can accurately revert text embeddings back into original text. This capability raises concerns about the security of embedded data, as it implies that embeddings may not be as secure as previously thought. The article calls for a reassessment of security protocols for embedding-based systems.
SynthePulse Insight · AI deep reading
Version 1 · 1 source
Text embedding vectors may appear random, but research shows that by training a Transformer model, much of the original text can be recovered from embeddings, posing a privacy threat to RAG systems that rely on vector databases.
With the rapid development of generative AI, many companies build question-answering applications using Retrieval-Augmented Generation (RAG) systems. RAG systems store documents in databases, convert text into vectors using embedding models, retrieve relevant documents based on vector similarity, and then generate answers.
The popularity of this approach has given rise to vector databases—a new type of database specifically designed to store and search embedding vectors. Numerous startups have raised hundreds of millions of dollars in funding, claiming to simplify the RAG process. However, vector databases store embedding vectors, not original text, raising privacy concerns: if the database is hacked, can attackers recover the original text from the embedding vectors?
Text embeddings are outputs of neural networks, obtained by transforming input text through matrix multiplication and nonlinear functions (e.g., ReLU). The data processing inequality in signal processing states that a function cannot increase information; it can only maintain or reduce it. Therefore, embedding vectors contain no more information than the original input, and nonlinear layers destroy some information.
This means embedding vectors are not perfect encodings of the original text, but they still retain enough information that could potentially be used to recover the text.
In computer vision, research has demonstrated that input images can be recovered from feature outputs of deep neural networks. For example, Dosovitskiy et al. (2016) reconstructed blurry but similar images from convolutional neural network features. Subsequent work improved reconstruction accuracy, even recovering images from the 1000 class probabilities of an ImageNet classifier.
These results indicate that embedding vectors may leak original input information, and similar risks may exist in the text domain.
Researchers formalized the problem as: given a text input of 32 tokens (about 25 words) and its embedding vector of 768 floating-point numbers (about 3KB), can the original text be recovered? They defined two evaluation metrics: exact match rate and BLEU score (measuring similarity).
They collected a large number of text-embedding pairs and trained a Transformer model that takes embeddings as input and outputs text. The model achieved a BLEU score of about 30/100, roughly guessing the text topic and some words, but with disordered word order and near-zero exact match rate. This indicates that full text recovery remains difficult, but partial information is leaked.
The above experiments show that embedding vectors are not a secure storage format. If a vector database is breached, attackers could use similar models to recover sensitive text content, violating privacy policies.
However, the current method only works for short texts (32 tokens) and recovery quality is limited. For longer texts or more complex embedding models, recovery may be more difficult. Additionally, the design of the embedding model (e.g., whether ReLU is used) affects the degree of information retention. These factors add uncertainty to actual attacks.
This article is based on a research report from The Gradient, which introduced findings from the EMNLP 2023 paper 'Text Embeddings Reveal As Much as Text'. All technical details come from that report, and no external knowledge is introduced.
Text embedding vectors are not a secure privacy protection format. Users of vector databases should be aware of the risk of embedding leakage revealing original text and consider additional protections such as encryption or differential privacy.
Primary report
Primary source