Embedding inversion
Embedding inversion is reconstructing text from its vector. It is why a vector database must be classified at the same level as the documents it indexes.
Embedding inversion is the recovery of the original text — or a close paraphrase of it — from the vector that represents it. It matters because it demolishes the intuition, which is extremely common, that embeddings are a form of anonymisation.
The mistaken intuition
A vector looks like nothing. It is a list of floating-point numbers with no readable structure, so teams routinely conclude that a vector store is less sensitive than the document store it was built from, and secure it accordingly — fewer controls, broader access, a different jurisdiction, a longer retention.
But an embedding is a lossy, dense encoding of meaning, and published research has repeatedly shown that meaning can be decoded back into text with high fidelity, particularly for short passages. Where exact reconstruction fails, attribute inference usually does not: the presence of a name, a condition, a company or a topic can often be read out of the vector even when the sentence cannot.
The consequence
A vector store inherits the classification of the documents it was built from. If a corpus contains personal data, so does its index — which means the index is in scope for the same access controls, the same retention schedule, the same residency decision and the same deletion request.
That last point catches people out. A deletion request against the source document store does not delete the embedding, and an index rebuilt on a schedule will not necessarily drop it either. Deletion has to reach the vector store explicitly, and someone has to be able to prove it did.
What to do
- Classify and control the vector store as a production data store, not as a cache.
- Store embeddings in the same jurisdiction as the source data, and say so in your records of processing.
- Enforce the asking user's permissions at query time rather than trusting the index to be a safe aggregate — see OWASP LLM08:2025 Vector and Embedding Weaknesses.
- Include the index in the deletion path, and test that path.