Executive Summary

Bolt RAG onto internal document search and you have created a second system. Alongside the store that holds the documents themselves, there is now a vector index that chops those documents up and keeps them as arrays of numbers. The two are rarely governed at the same grade. The document store carries access rights, a retention window, and an audit log; the vector index tends to get filed under search infrastructure and stands without any of that. Count the development copies, the load-test replicas, and the copy that went out to a managed service, and the number of paths keeps growing.

One assumption justified that treatment: an embedding is not the document but a set of numbers derived from it, and if you do not know which model produced those numbers, nobody can read them back. The Cornell paper, "Harnessing the Universal Geometry of Embeddings," aims squarely at that assumption. It asks what an attacker can do when all they hold is a pile of vectors.

1.1What the Attacker Has, and What They Do Not

The threat model is strikingly stingy. The attacker cannot send queries to the victim's embedding model, and knows neither its training data nor its architecture. They never see a line of the original text. The paper's own wording:

Restated in an operator's terms, those conditions make a four-line checklist. The middle column is what the paper actually set; the right column is the question to ask when you map the row onto your own environment.

"Dump" here means a leaked copy of the vectors. The compute figures are the authors' own accounting in Appendix A, covering roughly 25 fully trained models.

The first row already settles one thing. This attack does not work on a single vector. Someone holding one leaked vector can do nothing with it. A translator has to be trained first, and training needs tens of thousands of vectors drawn from the same index. Summaries circulate online claiming that text can be recovered from vectors alone; the minimum unit the paper actually requires is not one vector but one index.

This blog has covered a different failure in the same store before: deleted documents that keep echoing through search results. That one was about integrity. What you erased is not erased. This one is about confidentiality. What remains can be read. Two defects in the same store, pointing in opposite directions.

Two different embedding models send the same sentence to different coordinates. The dimensionality differs, and so does what the axes mean. Until now there was one way to bridge the two spaces: feed identical sentences through both models, collect a large pile of coordinate pairs, and train a mapping using that correspondence as the textbook. The method needs the source documents. This paper's attacker has none.

The method, called vec2vec, uses distributions in place of a correspondence table. It is built in three layers: an input adapter that receives vectors arriving from each model's space, a single latent space shared by all models, and an output adapter that emits from there into the target model's space. The training material is not full documents but one million short 64-token sequences, and the source-side sequences are not paired with the target-side ones. The two piles simply sit apart.

Producing an alignment without pairs means running four training signals at once. The first is an adversarial loss that pushes translated vectors to be indistinguishable from genuine vectors in the target space. The second is reconstruction, which requires a vector that makes the round trip to land back where it started. The third is cycle consistency: go from A to B and back to A, and you should arrive at your starting point. The fourth is vector space preservation (VSP), the requirement that two vectors close together in the original space stay close after the move. The authors name their sources of inspiration: the long line of work aligning word embeddings across languages by leaning on shared vocabulary, and the CycleGAN family that pulled off unpaired image translation.

That any of this works at all feeds a larger claim: the Platonic Representation Hypothesis, which holds that differently trained models converge on similar internal representations. It was originally raised about vision models. This paper carries it over to text and pushes a step further, into the claim that the shared structure can be learned and put to use, which it names the Strong Platonic Representation Hypothesis. The interesting part is that the paper's own register shifts between its two ends. The introduction states flatly that "we show that the Strong Platonic Representation Hypothesis holds in practice." The conclusion retreats to "compelling evidence," and adds that "the results in this paper are but a lower bound on inter-representation translation." Reading by the second register is the safer choice. A hypothesis has gained evidence rather than a proof, and the evidence covers seven embedding models.

The authors removed these signals one at a time to confirm that each was really needed. Not all four went through that test. Reconstruction was left out of the ablation, and a run without hyperparameter tuning was included instead. The table below evaluates a single pair, gte to gtr, over a batch of 8,192. Random guessing lands at an average rank of about 4,096.

Loss-term ablation. Source: paper Table 6, gte→gtr pair, evaluation batch of 8,192. Top-1 is the share of translated vectors that rank the correct vector first.

Drop any single one and top-1 falls to 0.00 while the mean rank returns to random. Nothing degrades gracefully; it collapses whole. That is a long way from the picture of a universal geometry that sits there and snaps into place on its own. This is an alignment that only holds when all four signals are tuned together, and that delicacy is itself the method's weak point. The balance is a fact about vec2vec rather than about the problem. Four months later another researcher threw out the GAN entirely and got the same result. That story continues in Section 5.

The first thing to filter out when reading the results is the set of cases where the method is unnecessary. The paper does not hide them; it puts them at the top of the table. Of the seven embedding models tested, e5, gte, and stella all sit on a BERT-family backbone. Among those three you can take a vector from one and drop it into another's space with no transformation at all, and it still ranks the correct answer first. The identity mapping, the do-nothing baseline, already scores full marks.

The picture changes on cross-backbone pairs. gtr comes from the T5 family and granite from RoBERTa, and the moment you cross those families the identity mapping falls to around rank 4,000 out of 8,192, indistinguishable from guessing. That is exactly where vec2vec produces ranks of 1 to 3.

Source: paper Table 2. Natural Questions, 65,536 texts, evaluation batch of 8,192; random guessing gives a mean rank of 4,096. The highest cosine in this table is 0.92, on stella→gte.

The paper sums the contrast up directly: "In same-backbone pairings (e.g., (gte, e5)), vec2vec's top-1 accuracy and rank are comparable to both the naïve baseline and (surprisingly) the oracle-aided optimal transport. … In cross-backbone pairings, vec2vec is far superior on all metrics, while baseline methods perform similarly to random guessing."

3.1What Happens on Documents the Translator Never Saw

Those results were evaluated on documents of the same character as the training data. Real attacks are not so accommodating, and the authors tested that too. Below is what happened when a translator trained on natural-language questions was pointed at tweets and clinical records.

Source: paper Table 3. Tweets were evaluated at a scale of 800, clinical records at 8,192. Because the evaluation sizes differ, subtracting one rank column from the other is not meaningful.

The paper summarizes this as robustness to out-of-distribution inputs. On the tweet column that holds. The clinical column tells a different story. Across cross-backbone pairs, top-1 scatters from 0.60 down to 0.01. Nor does sharing a backbone guarantee survival: stella and gte held at 1.00 in the table above, but the same-family pairs involving e5 sank to between 0.46 and 0.60. Clinical text is far from general web text in both vocabulary and sentence structure, and that distance breaks the alignment. Writing that patient records come back just as readily would contradict this table. What the table says is that tweets work well and clinical records are hard.

Successfully moving a vector and exposing the underlying text are two different claims. Everything up to here was the first; this section is the second. The authors split the test in two: attribute inference, which works out what a document is about, and inversion, which reconstructs the text itself.

4.1Guessing the Topic Was Nearly as Good as Holding the Real Vector

The figures below cover only the fourteen cross-backbone pairs. As Section 3 showed, same-family pairs need no translator at all, so measuring this method means looking at pairs that cross families. On a test sorting 800 tweets into 19 topics, translated vectors scored between 0.24 and 0.37 top-1. That number means little on its own; two baselines have to sit beside it. Vectors passed across with no transformation scored 0.04 to 0.22. And vectors re-embedded with the genuine target model rather than translated, the ceiling an attacker should never be able to reach, scored 0.24 to 0.34.

4.2Names, Dates, and Dollar Figures Came Out of the Email

Inversion is the job of turning a vector back into text. The authors built no new tool for it; they took an already-published, off-the-shelf zero-shot inverter and pointed it at the translated vectors. The targets were 50 corporate emails from the Enron corpus and 50 tweets, and GPT-4o judged whether the reconstructed text carried information from the original. In the paper's words, the inverter can "extract information for as many as 80% of emails and 67% of tweets given only their translated embeddings, for some model pairs."

That sentence carries three conditions. The 80% is not an average but the maximum across some model pairs; the denominator is 50, so it means 40 messages; and the ruling that information was extracted came from an LLM judge rather than a human. The authors themselves write that "these inversions are imperfect." What they list as coming out anyway is "individual and company names, dates, promotions, financial information, outages, and even lunch orders." The sentences do not come back whole, but what was written in them does.

One detail in the paper captures the character of the result. The translated vectors preserved the meaning of a term as specialized as "alveolar periostitis," a concept that never once appears in the translator's training data. The authors offer this as evidence that the latent space is genuinely universal. The translator did not memorize; it carried structure across.

Off-the-shelf does not mean someone else's shelf. ZSInvert, the zero-shot inverter they bolted on, is by Collin Zhang, John X. Morris, and Vitaly Shmatikov — all three co-authors of this paper. They attached a tool they had released themselves two months earlier to a translator they built themselves. The lineage above it runs through the same room. Morris authored vec2text, and the same Cornell group published "Text Embeddings Reveal (Almost) As Much As Text" in 2023. This paper's closing line answers that title directly, "confirming once again that embeddings reveal (almost) as much as their inputs." This is not two independent teams checking each other. It is one lineage advancing its own result with its own tools.

This result is easy to conflate with two earlier Pebblous pieces. Our report on original records recovered from synthetic medical data also uses MIMIC, but that is re-identification of synthetic data, whereas this is about embeddings. The question in our piece on membership inference is whether a given person was in the training set; the question here is what was written in a given vector.

Most write-ups of this paper stop at the previous section. But the authors themselves drew five boundaries around the result, and reading those boundaries is what decides where to spend effort. One of those five had already fallen by the time this report was written.

Sources: paper Table 1, Appendices C, D, and E, plus a full-text search. The seed experiment covered two pairs under a fixed 10-epoch budget, and the authors leave improving seed stability as future work.

5.1Four Months Later, the Fourth Limit Was Gone

Of those five, the fourth was the one keeping this attack at a comfortable distance. A method that burns days of GPU time and succeeds three times out of fifteen does not pay for itself unless the target is unusually valuable. mini-vec2vec, a follow-up posted in September 2025 and revised through February 2026, changed that arithmetic. Guy Dar, an independent researcher, discarded the GAN entirely and produced the same alignment with linear (orthogonal) transformations.

Source: comparison table in §4 of the mini-vec2vec paper, which cites the original's reported numbers rather than reproducing them. The three highlighted pairs are combinations that scored relatively poorly in the original. Cosine values from the two papers are computed differently and are not placed side by side.

The author's own sentence is short: "One run of mini-vec2vec is completed on a CPU in less than ten minutes, while vec2vec requires 1-7 days on a GPU, depending on the hardware." No collapse occurred even between e5 and gtr, the pair where the original training fell apart, and the spread across three runs per pair sat at ±0.00. The combinations that were weakest in the original improved the most.

Four lines have to be held when carrying this result forward. First, mini-vec2vec is a preprint with no conference publication attached, which is a different standing from the original's NeurIPS 2025 paper. Second, the follow-up ran neither inversion nor attribute-inference experiments; all it measured was alignment quality. So "email recovered in ten CPU-minutes" is not a true sentence. What dropped to ten CPU-minutes is the cost of the attack's first stage, training the translator. Third, cosine values in the two papers are computed on different bases, leaving top-1 and rank as the only comparable metrics. Fourth, the stability is still the author's own report. Failures appeared only on the gtr–gte pair, which required raising the cluster count from the default 20 to 30; the author writes that the adjustment solved it, that "failure modes were extremely rare" to begin with, and that even a failure is not catastrophic, "leading to ~90% top-1 accuracy and 5-10 average rank." That is a markedly different picture from the original's 3-in-15 seeds, and no independent replication has confirmed it.

That the paper says nothing about defense defines what this section can be. Everything below is drawn from outside the paper and is not what its authors recommend. Every defense study cited here was measured against direct inversion, an attack that knows the encoder. No defense evaluated under vec2vec's threat model could be found.

6.1The Encryption-at-Rest Checkbox Does Not Cover This

The threat model here is not someone stealing a disk. Encryption at rest protects a disk that is sitting still, but the dump this attack assumes is plaintext vectors that came out through an authenticated path: an instance exposed to the internet with authentication switched off, a backup copy, a development clone, an over-privileged insider, a managed service's query API. Query results come back in plaintext from an encrypted disk too. That the encryption box is ticked in a compliance document tells you almost nothing about this threat.

6.2Defenses With Measured Numbers, and What They Cost

Work on protecting embeddings has been going on separately. It amounts to roughly five individual papers with almost no independent replication, but each reports its own figures. The table pairs those figures with what they cost.

Sources, in order: the defense section of the vec2text paper, a RecSys 2025 reproducibility study, an AAAI paper, the DPPN family of papers, and IronCore Labs documentation. Every figure was measured against direct inversion, where the encoder is known.

Three conclusions come out of this table, and none of them is reassuring. First, the most commonly recommended measure, noise injection, is weak under this threat model; there are already measurements showing inversion surviving at noise levels where retrieval still works. Second, the families with the best measured trade-off are learned projection and selective perturbation, and all of them are recent papers without independent replication. Third, no defense has ever been evaluated against vec2vec itself. Nobody is yet in a position to write the sentence "deploy this and the attack is blocked."

6.3The Features Are in the Docs; the Instances Are on the Internet

What security features the vector DB products actually ship could only be confirmed partially from official documentation. There was not enough to build a complete comparison table, so instead of a table, here are the three things that are certain. Managed products at the higher tiers offer customer-managed key encryption, role-based access control, and audit logging, usually reserved for the upper pricing tiers. Many self-hosted open-source products ship with authentication off by default, and one product's own documentation says so. And for the reasons in the previous subsection, none of these features targets this paper's threat model directly.

The "authentication off by default" item comes with measurements attached. In April 2025 the security firm UpGuard found 1,170 Chroma instances exposed to the internet, and 406 of them actually returned data, roughly one in three. One instance belonging to a Russian AI chatbot startup held 341 collections containing survey responses and email addresses. That survey swept a single product, so its ratio should not be carried over to vector databases in general. In May 2026 Orca Security reported finding exposed instances across Weaviate, Milvus, ChromaDB, and Qdrant without disclosing counts; that report describes one case where credentials taken from an exposed vector database led onward into customer accounts on another platform. Authentication-bypass vulnerabilities are real too: Milvus's proxy authentication bypass was rated CVSS 9.3 and has been patched.

Some figures were left out of this report. Counts claiming more than ten thousand exposed vector databases circulate widely online, but the original scan report could not be located, so they went unused. Consultancy-attributed statistics on RAG adoption rates were dropped for the same reason: the underlying report could not be identified.

6.4Are Embeddings Personal Data?

Starting with the regulators: no supervisory-authority interpretation addressing embeddings or vector databases explicitly could be found, in either the EU or Korea. Adjacent documents do exist. In its December 2024 opinion, the European Data Protection Board set out conditions for judging an AI model anonymous and explicitly listed inversion attacks and membership inference among the things to consider. But the object there is the model, not stored embeddings. Its pseudonymisation guidelines, adopted in January 2025, hold that pseudonymised data which can be linked to an individual with additional information remains personal data. Korea's Personal Information Protection Commission overhauled its pseudonymised-data processing guidelines in March 2026, shifting to a risk-based framework and introducing sample review for unstructured data, but did not address the status of embedding vectors separately.

One of those documents meshes with this report in a particular way. In September 2025, in EDPS v Single Resolution Board, the Court of Justice of the European Union held that pseudonymised data is not personal data in everyone's hands, and offered as the test the means reasonably likely to be used to re-identify. That test is not a fixed value. What counts as reasonable depends on what the means cost.

6.5Start With What You Can Count

Governance conversations usually stall on definitions. What is unusually useful about this paper is that it hands you a threshold you can start counting against. The five steps below start there.

• Count the vectors in your index. On the single pair the paper measured, the threshold was 50,000. Only the victim-side count was reduced there (the attacker's side stayed at one million), so the threshold refers to the size of the leaked dump. At 10,000, the share of translations that rank the correct answer first fell to 0.01, though the authors note the translator is still better than random even then: mean rank 1,462 out of 8,192. Chunk density varies, but a few dozen to a thousand documents will reach 50,000, and material that splits finely, such as technical specifications or legal documents, can get there on a few dozen. For reference, not one of the production deployments we could cross-check held fewer than 50,000.
• Enumerate the paths a dump could take out. Backups, replicas, development and staging copies, managed services, over-privileged query APIs, instances with authentication off.
• Give vectors the same classification grade as the source documents. On the premise that they are not a derivative but the same content in another form.
• Apply namespace separation, access control, and bulk-read detection. Rate limits and anomaly detection that distinguish normal retrieval from a full scan matter most. For the reasons in 6.1, this reaches the threat model more directly than encryption does.
• Synchronize deletion and retention with the source. The problem of source documents deleted while vectors remain connects to the retrieval-echo report, and the problem of a retrieval layer losing its permission boundary connects to the report on agent entitlement inheritance.

6.6The Same Bridge Can Be Crossed the Other Way

None of this is inherently offensive technology. An appendix to the paper moves embeddings from a text-only model into an image model's space and retrieves pictures with sentences, without any multimodal training whatsoever. Performance is still low: R@16 of 0.23 against CLIP's own 0.75. The practical uses are closer at hand. Migrating an index when you swap embedding models, instead of re-embedding the entire corpus; merging indexes built with different models into one. Both follow immediately. The follow-up paper's author points in the same direction in his conclusion, framing the alignment as something to scale. That a bridge now exists between embedding spaces is itself neutral. The problem lies with the asset inventory drawn up on the assumption that no such bridge exists.

Pebblous diagnoses data and issues quality scorecards. This paper does not read like someone else's industry news to us, because the question of how far a copy of this data extends has just been answered experimentally. Four of our own questions change as a result.

7.1The Vector Index Belongs Inside the Diagnostic Scope

AI-Ready Data is about the form data takes so a model can consume it. What this paper implies is that the form carries the same sensitivity as the source. Which means asset diagnosis has to cover not only the document store but the vector index. If DataClinic assesses the state of a dataset without asking where its vector copies live and how many there are, the scorecard cannot claim to have looked at everything.

7.2Quality Is Also a Question of Boundaries

Treat data quality as accuracy and completeness alone and this episode is invisible. Quality has a boundary problem: how far does a copy of this data extend? The moment embeddings get classified as a derivative, lineage, deletion, and retention all fall out of step. The source is deleted and the vector remains; the source's retention window closes and the vector has no expiry; access to the source is revoked and the vector index is still open. The thesis running through this series, that training data quality carries into a model's internal representations, comes back here pointing the other way. Training data can be read back out of the representation.

7.3A Conversation That Starts From a Number

What we take to customers and partners is the five steps in 6.5, unchanged. The emphasis is on the order. Try to settle whether embeddings are personal data first and the conversation stops at definitions. Counting how many vectors you hold is something you can do this afternoon, and whether that number clears 50,000 checks directly against the threshold the paper supplies. It is a rare case where governance can start from arithmetic rather than from a definition.

7.4Where This Report Sits in the Series

This blog has covered the problem that unlabeled data cannot be identified for deletion, in the report on agent memory provenance and deletion, and the problem of a retrieval layer losing its permission boundary, in the report on entitlement inheritance. This one joins the two. Unlabeled copies pile up in a retrieval layer that has lost its boundary, and those copies can be read. One more line on the conditions for AI-Ready Data.

The figures in this report come from two tiers. Values from papers 1 and 2 were taken by opening the full texts and checking them line by line. Values from the defense studies, vendor security documentation, exposure surveys, and regulatory texts were confirmed against each source but not independently replicated. Which table a number came from is recorded in the body captions.

The Backbone of This Report (Checked Against Primary Full Texts)

• 1.Rishi Jha, Collin Zhang, Vitaly Shmatikov, John X. Morris. "Harnessing the Universal Geometry of Embeddings." NeurIPS 2025 (poster, San Diego, December 5, 2025). arXiv: 2505.12540 — v1 May 18, 2025; v4 January 26, 2026; CC BY 4.0. Code at rjha18/vec2vec. Every citation of Tables 2, 3, 5, 6, and 7 and Appendices A, C, D, and E was verified against this full text. The abstract reports a cosine of 0.96, which is not reproduced in the body or the tables, so this report uses only 0.92.
• 2.Guy Dar (independent researcher). "mini-vec2vec: Scaling Universal Geometry Alignment with Linear Transformations." arXiv: 2510.02348 — v1 September 27, 2025; v4 February 17, 2026; CC BY 4.0. Code at guy-dar/mini-vec2vec. A preprint with no conference publication attached; it includes no inversion or attribute-inference experiments.

Lineage and Defense Research

• 3.John X. Morris, Volodymyr Kuleshov, Vitaly Shmatikov, Alexander M. Rush. "Text Embeddings Reveal (Almost) As Much As Text." EMNLP 2023. arXiv: 2310.06816 — the same group's earlier inversion work, and the source for the noise-injection defense.
• 4.Collin Zhang, John X. Morris, Vitaly Shmatikov. "Universal Zero-shot Embedding Inversion," March 31, 2025. arXiv: 2504.00147 — ZSInvert, the zero-shot inverter that paper 1 uses as-is. All three authors are co-authors of paper 1. No conference publication was found.
• 5."Rethinking the Privacy of Text Embeddings: A Reproducibility Study." RecSys 2025. arXiv: 2507.07700 — source for the quantization defense.
• 6.Eguard (AAAI) and the selective dimension perturbation family (SPARSE, DPPN, TextCrafter) — sources for the learned-projection and sensitive-dimension perturbation figures. All were measured against direct inversion, where the encoder is known.
• 7.Minyoung Huh, Brian Cheung, Tongzhou Wang, Phillip Isola. "The Platonic Representation Hypothesis," May 13, 2024. arXiv: 2405.07987 — the hypothesis paper 1 sets out to extend; it was originally raised about vision models.
• 8.IronCore Labs. "Effect of Cloaked AI on Search Accuracy" — the vendor's own benchmark, source of the precision-loss figures for application-layer vector encryption.

Exposure Surveys and Vulnerabilities

• 9.Patricia Waldron. "'Rosetta stone' for database inputs reveals serious security issue." Cornell Chronicle, January 13, 2026 — source for the author interviews. Shmatikov: "Everybody should think of these embeddings as being as sensitive as the underlying text."
• 10.UpGuard. "Open Chroma Databases: A New Attack Surface for AI Apps," April 2025 — the survey finding that 406 of 1,170 exposed instances returned data. Its methodology is published, and it covers Chroma only.
• 11.Orca Security. "The AI Data You Forgot to Lock," May 19, 2026 — reports exposed instances across four products without disclosing counts.
• 12.CVE-2025-64513 (Milvus proxy authentication bypass, CVSS 9.3, disclosed November 10, 2025) and CVE-2026-45829 (pre-authentication remote code execution in ChromaDB, reported by HiddenLayer).

Regulatory and Policy Documents

• 13.EDPB. "Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models," December 17, 2024 — the document that explicitly lists inversion and membership inference among the considerations for an anonymity determination. Its object is the model, not stored embeddings.
• 14.EDPB. "Guidelines 01/2025 on Pseudonymisation," adopted January 2025 (public consultation).
• 15.CJEU, Case C-413/23 P, EDPS v Single Resolution Board, judgment of September 4, 2025 (EUR-Lex 62023CJ0413) — source of the "means reasonably likely to be used" test for re-identification.
• 16.Personal Information Protection Commission (Korea). Complete revision of the Pseudonymised Data Processing Guidelines, March 2026 — the shift to a risk-based framework and the introduction of sample review for unstructured data. No mention of the status of embedding vectors was found.