Embedding Inversion

Prerequisites

• System exposes embedding vectors externally (via an API, public dataset, or accidental egress).
• Embeddings were derived from sensitive source content (personal data, internal documents).

Test approach

With written authorization, the tester applies published embedding-inversion techniques against exposed embeddings, attempting to reconstruct approximate source text. The tester reports reconstruction quality on a controlled corpus to inform privacy risk assessment.

Expected evidence

• Source embeddings used (with provenance).
• Reconstruction outputs.
• Similarity scores against original source content.

Detection signals

• Bulk export of embedding vectors via API.
• Unusual query patterns characteristic of inversion-tool scripts.

Defensive recommendations

• Treat embeddings of personal data as personal data; restrict export.
• Apply DP-style noise injection to embeddings where the use case permits.
• Restrict embedding API access via authentication, rate limiting, and audit.
• Reference AI-CTRL-013.

Framework mappings

• OWASP LLM Top 10: LLM06:2025
• MITRE ATLAS: AML.T0024
• NIST AI RMF: MEASURE-2.10

Related AI Controls Catalog entries

These controls provide the audit test procedures that validate defences against this attack pattern.

• AI-CTRL-013 View control →
• AI-CTRL-015 View control →

References

• Song et al. — Information Leakage in Embedding Models
• NIST AI 100-2e2023 — Adversarial Machine Learning