How Much Do Modern Embeddings Reveal? Inversion Attacks on Commercial Embedding Models

Keeping embeddings instead of raw text does not make the text unrecoverable, and this paper measures how much can be rebuilt from two commercial embedding services. An embedding is the list of numbers a model produces to represent a passage's meaning, and search and retrieval systems often store these vectors in a database. Kareem Elaasar and Cristina Lopes of the University of California, Irvine adapted vec2text, an existing attack that trains one model to guess text from a vector and a second model to refine the guess by re-embedding it and comparing the result, to OpenAI's text-embedding-3-small and Mistral's mistral-embed, alongside the older open model GTR-base.

The full paper assumes an attacker who has obtained the vectors, for example from compromised storage, and can call the same embedding service, as any paying customer can, but has no other access to the source text. Training the attack took roughly 32 to 62 hours per embedder on five GPUs, by the reported timings. On 800 inputs of 60 to 80 characters per category, text-embedding-3-small yielded the most exact reconstructions in all five categories: 47.4% of health-related questions and 24.5% of general instructions came back word for word under a matching rule that ignores capitalization and whitespace, against 14.8% and 11.1% for GTR-base. Short code snippets were the hardest to recover. Prose reconstructions that missed an exact match still scored high on a measure of similarity in meaning, though the paper's examples show details changing, such as a question about early warning signs of diabetes that came back asking about symptoms and treatment.

The authors are careful about scope. The health category consists of keyword-filtered instruction prompts, not patient records; the results come from one attack configuration and one training seed without confidence intervals; and the study does not measure whether specific sensitive details such as names or numbers survive. Nor does it show that OpenAI's model is inherently easier to invert, because the three embedders differ in more than vector size. The conclusion the evidence supports is practical: a vector database built from sensitive text deserves the same access controls and retention rules as the text itself.