LLMs, GenAI, RAG, agents, evaluation · insight-1544
Treat stored embeddings as sensitive data, not as an anonymised derivative of the text
- Evidence type
- empirical finding
- Difficulty
- medium
- Roles
- ML engineer, Applied AI, Data scientist
- Industries
- healthcare, banking
Summary: situation, action, reason, boundary
Situation
A team keeps embeddings of customer messages in a shared vector service, reasoning that vectors of numbers are not readable text.
Action
Classify vectors with the sensitivity of their source, apply the same access, encryption, retention and deletion rules, avoid exporting them to third parties without review, and drop or hash fields that should never be embedded.
Reason
Published inversion work recovers 92% of 32-token inputs exactly from their embeddings under its setup, and OWASP lists embedding inversion as a vector-store risk.
Boundary
Embeddings of personal, contractual, health or internal-only text.
Symptom or risk
Someone with read access to the vectors, or a leak of the store, can reconstruct much of the original text, and the vectors escape the retention and access rules applied to the source.
Exceptions
Embeddings of text that is already public.
Trade-offs
Stricter handling complicates sharing vectors across teams and vendors.
Pitfalls
Assuming that a longer text or a different model makes reconstruction impossible; the cited result covers specific models and short inputs.
Lessons and concepts
Claims and their sources
Morris et al. report that their iterative correct-and-re-embed method recovers 92% of 32-token text inputs exactly from their embeddings and can recover full names from a clinical-notes dataset.
OWASP's LLM08:2025 page names embedding inversion, which can recover much of the source text, among vector-store risks.