Noise in Embeddings Doesn't Protect Data: 100 Known Pairs Reveal ~90% of Documents

If you store noised embeddings in a vector database, reconstructing the original text from them is indeed hard, but that does not mean the data is protected. The author of the study, writing on Habr, built a test bench that measures recognition: given a protected record and a set of known documents, it determines which document the record belongs to. The bench tested 8 protection schemes.

In the main comparison, the attacker knows 1000 "document — record" pairs out of the 5183 documents in the SciFact collection (about 19%). Even 100 known pairs, or 2% of the corpus, are enough to identify about 90% of the documents. Gaussian noise leaves 99.

9% of records identifiable, even when retrieval quality has dropped by half.

What exactly was tested, and under what conditions

The vec2text paper (an attack that reconstructs text from its embedding) proposed three defenses: noise, product quantization (PQ) compression, and a secret linear transformation. According to its data, noise reduces exact text reconstruction to zero while retrieval quality barely suffers: 0.748 versus 0.730 on top-10. The author noticed that reconstructing text and recognizing a record among known documents are different tasks. A defense can pass the first test and fail the second. For public documentation, scientific papers and previously leaked databases, the second task is realistic: the attacker does not need unknown texts, only a way to match records to documents they already have.

The bench covers eight schemes: Gaussian noise, noise after a secret rotation, SAP/DCPE (noise uniform in a ball; implemented following Algorithm 2 from the paper by Fuchsbauer et al., SCN 2022), binary LSH, random projection, PQ, secret nonlinearity, and k-anonymous quantization. The tests ran on two BEIR collections (SciFact with 5183 documents and NFCorpus with 3633) and two models: all-MiniLM-L6-v2 and bge-small-en-v1.5. The attacker fits a linear mapping from protected records back into the embedding space using least squares. Sanity checks with zero protection caught two bugs: k-means changed its partition when the data was scaled, and 2.2% of NFCorpus turned out to be duplicates, which were excluded from the count.

The numbers: noise fails, information loss works

At the point where retrieval quality has dropped by half, 99.9% of records are identifiable under Gaussian noise, 99.2% under rotation with noise, and 98.7% under SAP/DCPE. Binary LSH gives 81.1%, random projection 60.8%, and PQ 27.0%. The secret nonlinearity tanh(gain · Qv) did not help: 100% across the entire parameter range, with retrieval quality above 90%. The shape of the noise does not matter: ball-uniform noise, plain Gaussian noise and Gaussian noise after rotation produce almost identical curves.

A secret rotation breaks only the naive attack: cosine matching falls from 100% to 0.0%, while linear alignment still yields 100%. The attacker needs little. At a setting with ~80% retrieval quality, 100 known pairs (2% of the corpus) identify 91% of records for SAP, 89% for Gaussian noise, 88% for rotation, 72% for projection, 61% for LSH and 37% for PQ. With 200 pairs, the noise-based schemes reach 98–100%.

PQ turned out to be the best of the schemes tested, but it is not free. In the high-fidelity modes cited in the vec2text paper, identifiability is nearly total: 192 subvectors give 100%, 48 give 100%, and 32 give 99.8%.

It drops below 50% only when compressing to 4 bytes per vector (9.7% at 41% quality); at 8 bytes, 44.5% of records are identifiable and quality falls to 59%.

The result also depends on the corpus: at 50% quality, 27.0% and 25.4% are identifiable on SciFact, versus 1.

6% and 1.7% on NFCorpus. The author suggests that a topically homogeneous corpus (nutrition and medicine) merges similar documents into identical codes.

In that case, the protection is a side effect of the data, not a property of the scheme.

To get a provable bound, the author built k-anonymous quantization: documents are grouped into clusters of at least k, and each cluster is stored as one shared vector. At k=2 the identifiability bound is 29.8% and the measured figure is 8.3%; at k=3 the bound is 16.5% and the measured figure is 0.5%. But in terms of quality cost, this implementation loses to PQ: at 8.3% identifiability it keeps 34% of retrieval quality, while PQ with m=4 keeps 41% at 9.7%. The cause is skewed groups (minimum 2, median 3, mean 6.2): the smallest group sets the bound, while the long tail of large groups eats the quality. The author did not test balanced assignment.

Limits of the result and practical takeaway

The bench measures only recognition among known candidates, not reconstruction of unknown text. All 8 schemes are geometric, so a mapping back exists. The bench cannot attack homomorphic encryption, PIR, multi-party computation or ORAM, so the conclusion "nothing works" would be wrong. The sample is small: two collections, two models, everything in English, and a single dump with no observation of queries. The vec2text experiment on full text was inconclusive: 45.9% token-F1 and 0% exact matches even on clean embeddings.

In practice, this means the following. Evaluate embedding protection by recognition on a corpus similar to yours, not only by text reconstruction. A secret transformation without other measures is useless if the attacker may end up with a couple of hundred known pairs. If you need protection, you will have to pay with retrieval quality, for example through PQ with heavy compression. Data that must not be handed over is easier not to hand over at all: keep the model and the database in-house.

One side observation: bge-small-en-v1.5 (nDCG@10 = 72.0 on SciFact) loses half its quality at 100% relative noise, while the weaker all-MiniLM-L6-v2 (64.5) withstands 150%. The computations run on an ordinary CPU, vectorizing the collection takes about 5 minutes on two cores, and the code is on GitHub in the semantic-cryptography repository.