Embedding Inversion Attacks: How Attackers Reconstruct Private Text From an Agent's Vector-Store Memory

Embedding inversion is SSA descriptive wording for a confidentiality attack that reconstructs the original text behind a dense vector embedding, the numeric representation an agent's retrieval-augmented generation (RAG) corpus or long-term vector-store memory is actually built from. The defining mechanism is reversal, not injection: nothing is written to the agent's memory and no prompt is submitted to the model it serves. An attacker who obtains embedding vectors, whether through a leaked export, an intercepted query response, or ordinary query access to the encoder that produced them, runs an inversion method against those vectors alone and recovers the sentences, names, or other identifying content they were generated from. Documented research reports recovering 50 to 70 percent of the input words from popular sentence embeddings, reconstructing 92 percent of short text inputs exactly, and extracting full names from a dataset of clinical-note embeddings, all without ever seeing the underlying document.

What it is

The defining object is the embedding vector itself: a fixed-length array of numbers an encoder model produces from a piece of text, stored in a vector database so that later queries can be matched against it by similarity rather than by exact text search. Agent systems rely on this representation constantly, as the storage format behind a RAG corpus, as the index behind a long-term memory tool, and as the payload exchanged between an agent and an embedding-API provider on every write and every query.

The defining cause is that an embedding is not an anonymized summary of its source text; it is a lossy but information-dense encoding of it. Documented inversion methods treat recovering that text as a tractable machine-learning problem: given a target vector and either an exact copy of it or repeated query access to the encoder that produced it, a trained or iteratively corrected decoder can reconstruct much of the original input, sometimes exactly. The defining consequence is disclosure of a vector store's actual plaintext contents through a channel that sits below retrieval, below any document-level permission check, and below the model's own context window, because none of those layers were ever asked to authorize this read.

What it is not

RAG poisoning, a write-side integrity attack on the same general storage layer, where an attacker plants adversarial content so retrieval later serves it as trusted context. This entry is the read-side counterpart: the attacker writes nothing and the stored embeddings are never altered, only mathematically reversed.
RAG permission bypass, where a retrieval pipeline serves a document's plaintext to a caller it was never authorized to see, through a retrieval path that should have enforced document-level access control and did not. Embedding inversion needs no retrieval call and no access-control failure at the application layer at all; it operates directly on the vector representation, which may never pass through a document-permission check in the first place.
Persistent memory injection, a write to an agent's durable memory store that inserts adversarial instructions for a later session to read as fact. Embedding inversion is the opposite direction: nothing is inserted into memory, and the goal is recovering what memory already durably contains.
KV-cache prompt leakage, a confidentiality attack that infers content indirectly by timing a shared serving-layer cache. Embedding inversion needs no timing measurement and no shared cache; it is a direct reconstruction computed from the embedding vector's own numeric values.
A claim that any embedding model trained or hosted anywhere is proven invertible at the same success rate. Reported success rates vary by encoder, embedding dimensionality, attacker query budget, and whether the attacker trains against the exact target encoder or transfers a method across encoders; the research below documents specific, reproducible conditions rather than a universal guarantee.
Reproducible inversion code, a trained decoder model, or a step-by-step reconstruction recipe against any named production provider.

In scope

Attacks that reconstruct original text, in whole or in part, from an embedding vector alone, given either possession of the vector or query access to the encoder that produced it.
Attribute-inference attacks that extract a narrower sensitive property, such as authorship, from an embedding without reconstructing the full source text.
Threat scenarios covering direct data leakage of stored vectors (an exported or stolen vector-database snapshot), interception of embeddings in transit between an agent and a vector store, and encoder-API query access without any leaked data.
Vector stores and embedding pipelines backing an agent's RAG corpus, long-term memory tool, semantic search index, or any other agent-state surface built on dense embeddings.
Defensive controls for embedding-store access control, encoder-query monitoring, and pre-storage data minimization.

Target state, trust boundary, and persistence

The target state is the plaintext content a vector-store embedding was generated from, surfaced through the stored representation itself rather than through the model's generated output or a retrieval-layer disclosure. The trust boundary that fails is the assumption, common in systems that treat embeddings as an opaque numeric artifact, that a vector carries no recoverable information about the text that produced it once that text has been encoded. Documented research treats that assumption as false under a range of attacker capabilities, from full possession of the vector down to ordinary, rate-limited query access to the encoder.

Persistence runs from cross-session to shared-system. A vector store is durable by design, built specifically so an agent's memory or retrieval corpus survives past the session that created it; every embedding written into it remains inversion-exposed for as long as it sits in storage, is replicated into a backup, or is reachable through an encoder-query interface, regardless of which session or caller originally produced it.

What the research establishes

Song and Raghunathan, "Information Leakage in Embedding Models," presented at the 2020 ACM SIGSAC Conference on Computer and Communications Security, first formalized embedding inversion as an attack class covering, in the authors' framing, functions that "map raw input data to low-dimensional vector representations." Their input-inversion attack is reported to "recover between 50% and 70% of the input words" from popular sentence embeddings, with F1 scores of 0.5 to 0.7, and the paper separately shows that "attributes such as authorship of text can be easily extracted by training an inference model on just a handful of labeled embedding vectors," a narrower attribute-inference variant that needs no full-text reconstruction at all (arXiv 2004.00053, Information Leakage in Embedding Models).

Morris, Kuleshov, Shmatikov, and Rush, "Text Embeddings Reveal (Almost) As Much As Text," presented at EMNLP 2023, pushed reconstruction accuracy substantially further with Vec2Text, a method the authors frame around the question "how much private information do text embeddings reveal about the original text." Trained to "decode text embeddings from two state-of-the-art embedding models," their iterative method, which the authors describe as one that "iteratively corrects and re-embeds text," recovers roughly 92 percent of 32-token inputs exactly, a sharp improvement over a naive single-step decoder. The paper reports the same method can "recover important personal information (full names) from a dataset of clinical notes," demonstrating the attack against embeddings of genuinely sensitive source text rather than only benchmark sentences (arXiv 2310.06816, Text Embeddings Reveal (Almost) As Much As Text).

Two 2025 papers lowered the attacker's required access further. Chen, Xu, and Bjerva, "ALGEN: Few-shot Inversion Attacks on Textual Embeddings using Alignment and Generation," note that "with the growing popularity of Large Language Models (LLMs) and vector databases, private textual data is increasingly processed and stored as numerical embeddings," and depart from prior work's assumption of access to millions of training sentences: the authors report "a single data point is sufficient for a partially successful inversion attack," with performance reaching "an optimum across a range of black-box encoders" using "as little as 1k data samples." The same paper examined defenses against its own attack and reports finding that "none are effective" (arXiv 2502.11308, ALGEN: Few-shot Inversion Attacks on Textual Embeddings using Alignment and Generation). Zhang, Morris, and Shmatikov, "Universal Zero-shot Embedding Inversion," introduce ZSInvert, built on an adversarial-decoding technique, as a method that "can be used for any text embedding without training an embedding-specific inversion model," removing Vec2Text's requirement to train a separate decoder per target encoder. The authors frame the result explicitly as a measurement of exposure: the method "measures how much information is leaked by vector databases and embedding-based retrieval systems" (arXiv 2504.00147, Universal Zero-shot Embedding Inversion).

Taken together, these four results trace a single trend across five years: from an attack needing a trained inference model and labeled data, toward attacks needing as little as a single data point or no encoder-specific training at all. None of the four requires compromising the agent that queries the vector store, injecting content into its context, or defeating an application-layer access-control check; the target is the stored or transmitted vector itself.

Detection: observable signs

A caller or service account retrieves raw embedding vectors through an API or export path, rather than retrieval results or generated text, with no corresponding downstream generation call that would explain wanting the vectors themselves.
Repeated, systematically varied queries against an embedding-encoder endpoint from a single caller, consistent with building the query budget an inversion method needs rather than ordinary indexing or search traffic.
A vector-store backup, snapshot, or replication job moves embedding data into an environment, role, or third-party service with no documented need for the plaintext it represents.
A vector database or embedding pipeline has no access-control or encryption decision recorded for the embedding store itself, distinct from whatever controls exist on the source documents it was built from.
Encoder-query volume or variety from one caller is anomalously high relative to any plausible single-task use of the embedding API.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders. It is neither a standard requirement nor a measured effectiveness ranking.

Control	Transition it interrupts	Applicability	Residual risk and verification
Classify and protect stored embeddings at the same sensitivity level as the source text that produced them, rather than treating vectors as already anonymized	Unauthorized access to an embedding export or backup being treated as a lower-sensitivity event than access to the source documents	Any vector store, RAG corpus, or long-term memory index built from text with confidentiality requirements	This governs access to the stored vector, not query-time inversion by a caller who already has legitimate encoder access; pair with encoder-query monitoring below.
Restrict application and API surfaces so callers receive retrieval results or generated answers, not raw embedding vectors, wherever the vectors themselves serve no caller-facing purpose	A caller obtaining the exact numeric artifact every documented inversion method operates on	Any agent-facing API layered on top of a vector store	Internal services and pipeline components still need vector access to function; this narrows exposure to external or lower-trust callers, not every caller.
Rate-limit and monitor embedding-encoder query volume and pattern per caller, watching for the systematic, budget-building query behavior the 2025 few-shot and zero-shot attacks depend on	The repeated encoder access ALGEN and ZSInvert both require when the attacker does not already possess the target vectors	Any embedding-encoder API, whether self-hosted or a managed provider endpoint	ALGEN reports useful results from as few as roughly 1,000 samples and partial results from a single one, so a low, patient query rate can still succeed; treat this as raising attacker cost, not eliminating the risk.
Minimize what gets embedded and stored in the first place: redact, truncate, or avoid storing highly sensitive raw text such as clinical notes, credentials, or personal identifiers as unmodified embedding inputs	The specific harm realized when an inverted embedding recovers personal information, as the Vec2Text clinical-note result demonstrates	Any pipeline embedding user-generated or otherwise sensitive source text for retrieval or memory	Minimization reduces what a successful inversion yields; it does not stop inversion of whatever sensitive content remains in scope for the agent's task.
Do not treat embedding-space defenses such as added noise or transformation as a substitute for access control, since the ALGEN authors report testing multiple defenses against their own attack and finding none effective	A false sense that an embedding-level mitigation alone closes the exposure	Any deployment considering embedding perturbation or differential-privacy-style noise as its primary control	This is a documented negative result from one 2025 paper against one attack method, not a claim that no defense will ever work against any inversion method; verify independently against the specific attack and encoder in scope before relying on it.

Prevention should start from treating a vector store's embeddings as carrying the same confidentiality weight as the text they were built from, since every documented attack above succeeds precisely when that assumption is not made. Detection should watch encoder-query patterns and embedding-export paths as first-class signals, because none of these attacks touch the agent's context window, trigger a content filter, or produce an access-control error. Containment should assume that an anomalous, systematic query pattern against an encoder may already have recovered part of the underlying corpus, and should treat the exposed text, not only the querying account, as compromised. Recovery should audit whether the vector store's access-control and retention boundary actually matches the sensitivity of what was embedded into it, since the documented research above shows that assumption failing against real clinical-note and sentence-embedding datasets, not only synthetic benchmarks.

Boundaries with similar concepts

This differs from RAG poisoning in which direction the compromise runs through the same storage layer. RAG poisoning is a write: an attacker plants content so a later retrieval call serves it as trusted context. Embedding inversion is a read: the attacker writes nothing, and the stored embedding is never altered, only mathematically reversed to recover what was already there.

This differs from RAG permission bypass in where the failure sits. RAG permission bypass is an application-layer access-control failure: a retrieval pipeline serves plaintext to a caller through a normal retrieval call that should have checked document-level permissions and did not. Embedding inversion needs no retrieval call at all; a caller who never goes through the application's retrieval path, but who obtains or queries against the raw vectors directly, can still recover the underlying text.

This also differs from KV-cache prompt leakage in mechanism, not just in which storage layer is targeted. KV-cache prompt leakage is an inference problem solved by measuring response-time differences in a shared cache; it needs no access to any raw cached value. Embedding inversion needs the embedding vector's actual numeric values, or encoder-query access that lets an attacker approximate them, and reconstructs text through a trained or search-based decoding process rather than through timing.

Mapping to standards and research

Source	Source-owned term or item	Relationship to this article
ACM CCS 2020 (Song, Raghunathan)	input inversion and attribute inference in embedding models	Primary-source attack first formalizing embedding inversion and attribute inference against popular sentence embeddings.
EMNLP 2023 (Morris, Kuleshov, Shmatikov, Rush)	Vec2Text	Primary-source attack substantially improving exact-reconstruction accuracy, including recovery of personal information from clinical-note embeddings.
arXiv 2502.11308 (Chen, Xu, Bjerva), 2025	ALGEN	Primary-source few-shot inversion attack reducing required training data to as little as a single data point, with a negative result on tested defenses.
arXiv 2504.00147 (Zhang, Morris, Shmatikov), 2025	ZSInvert	Primary-source zero-shot inversion attack requiring no encoder-specific training, framed explicitly as measuring vector-database information leakage.
OWASP GenAI Security Project	Top 10 for LLM Applications 2025, `LLM08:2025 Vector and Embedding Weaknesses`	Standard risk category naming embedding inversion as one of its listed example risks against RAG vector stores and embedding pipelines.
Agent State Attack	Embedding inversion	SSA descriptive framing bundling the research above under one Durable Memory target-state entry.

Related terms

Agent state attack: the umbrella definition, including Durable Memory among the listed target states.
RAG poisoning: the adjacent write-side entry on the same storage layer, contrasted above by direction of compromise, a plant there, a reconstruction here.
RAG permission bypass: the adjacent application-layer access-control failure, contrasted above against an attack that bypasses the retrieval path entirely.
Persistent memory injection: the adjacent write-side entry on durable memory, contrasted above with a read-only attack that inserts nothing.

FAQ

Does an attacker need to compromise the agent or the model itself to invert an embedding?

No. Every documented result above operates on the embedding vector or the encoder that produced it, not on the agent's prompt, context window, or model weights. An attacker needs either the vector itself, through a leak, export, or interception, or query access to the encoder, not any foothold inside the agent or the application built on top of it.

Is storing embeddings instead of raw text a safe way to anonymize sensitive data?

No. The Song and Raghunathan paper and the Vec2Text paper both demonstrate recovering substantial source content, including personal names, from embeddings alone; an embedding is a lossy but information-dense encoding of its input, not an anonymization technique, and should be protected with the same access controls as the text it was generated from.

Does switching to a newer or larger embedding model make this attack moot?

Not reliably. The 2025 ALGEN and ZSInvert papers specifically target the harder case of attacks that generalize across encoders with little or no encoder-specific training, which is the direction research has moved as a response to exactly this question; reported success varies by encoder and attacker budget, but no documented defense in this body of research eliminates the risk outright.

Is disabling embeddings and RAG the simple fix?

It removes the attack surface at the cost of the retrieval or long-term-memory capability embeddings exist to provide. For most deployments, applying access control, export restriction, and encoder-query monitoring to the embedding store, and minimizing what sensitive content gets embedded in the first place, addresses the attack without giving up retrieval; disabling embeddings outright is a defensible choice only where that capability is not required and the underlying text's confidentiality is a hard requirement.

Sources

Verification and change history

Standards and versions referenced: OWASP Top 10 for LLM Applications, 2025 edition.

Last verified: 2026-10-27. The Song and Raghunathan quotations, F1 scores, and venue were read from the arXiv abstract page. The Vec2Text quotations, reconstruction rate, and clinical-note finding were read from the arXiv abstract page. The ALGEN quotations, data-requirement figures, and defense-evaluation finding were read from the arXiv abstract page. The ZSInvert quotations and framing were read from the arXiv abstract page. The OWASP LLM08:2025 scope and its listing of embedding inversion as an example risk were read from the official OWASP GenAI Security Project page.

Change history: 2026-10-27, first version.

Working-term label: Mixed provenance. "Vec2Text," "ALGEN," and "ZSInvert" are Research Terms owned by their respective papers' authors. LLM08:2025 Vector and Embedding Weaknesses is an OWASP Standard Term. "Embedding inversion" as a general attack-class name is used across the cited research itself rather than coined by this site; "embedding inversion attacks" as the umbrella title for this entry, bundling the sources above under one Durable Memory target-state entry, is SSA editorial organization.