Skip to main content
LLM Security Database
Skip to research details
Back to research findings

Document reconstruction from exposed retrieval embeddings

Exposed retrieval embeddings can reveal source text. SHAQ evaluates indexing generated queries instead of direct document embeddings to reduce that leakage.

Published
Analyzed
Paper-reported evidence
Primary source linked
Read primary paper
Cite & share
Source BibTeX

Citation metadata is maintained by the primary source and may reflect a later revision.

Paper-evaluated models(1)

  • QwQ 32B
On this page

Description

Exposed retrieval embeddings can reveal source text. SHAQ evaluates indexing generated queries instead of direct document embeddings to reduce that leakage.

Examples

See the primary study (opens in a new tab).

Impact

Across ten sampled BEIR datasets, the authors report defended mean reconstruction ROUGE-1 of 0.2710 under the standard evaluation and 0.3376 under its adaptive variant. Residual overlap remains. Documents were truncated to 32 tokens; full-length reconstruction privacy and downstream question answering were not evaluated.

Affected Systems

  • The FAISS retrieval setup with GTR-T5 embeddings and T5-based vec2text evaluation; exact encoder checkpoints are unspecified. DPR appears only in a retrieval-utility ablation. QwQ-32B generates the defensive queries.

Mitigation Steps

  • Restrict and audit embedding access.
  • Measure privacy and retrieval quality together.
  • Validate full-length document privacy before deploying this defense.

Evidence

Research context and provenance

Research topics
Application layer
Extraction
RAG
Embedding
Data privacy
Black-box
Catalog identifier
LMVD-2021f881
Internal research identifier, not an official CVE identifier.
Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Black-box model, service, or application access.
Related deployment categories
Retrieval-augmented generation
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
The FAISS retrieval setup with GTR-T5 embeddings and T5-based vec2text evaluation; exact encoder checkpoints are unspecified. DPR appears only in a retrieval-utility ablation. QwQ-32B generates the defensive queries.

Research Paper

Shadow Queries for Private Retrieval in Vector Databases

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research