@inproceedings{elaasar-lopes-2026-much,
title = "How Much Do Modern Embeddings Reveal? Inversion Attacks on Commercial Embedding Models",
author = "Elaasar, Kareem and
Lopes, Cristina",
editor = "Arad, Dana and
Belinkov, Yonatan and
Chen, Hanjie and
Feldhus, Nils and
Mueller, Aaron and
Mohebbi, Hosein and
Sarti, Gabriele and
Tutek, Martin",
booktitle = "Proceedings of the 9th {B}lackbox{NLP} Workshop: Analyzing and Interpreting Neural Networks for {NLP}",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.blackboxnlp-1.6/",
pages = "76--89",
ISBN = "979-8-89176-476-7",
abstract = "Text embedding inversion reconstructs source text from fixed-dimensional vectors, posing a privacy risk to systems that store embeddings instead of raw text. We adapt the vec2text framework (Morris et al., 2023) to support text-embedding-3-small and mistral-embed alongside GTR-base. We evaluate 800 samples per category across general instructions, Wikipedia passages, paraphrased instructions, health-related instructions, and short literal code snippets, using a common 60{--}80-character range and paired original and paraphrased instructions. Under the evaluated vec2text configuration, text-embedding-3-small achieves the highest exact-match rate in all five categories, including 47.4{\%} on health-related instructions and 24.5{\%} on general instructions under the evaluation{'}s case-insensitive, whitespace-stripped matching rule. BERTScore F1 exceeds 87 on the 0{--}100 scale for every prose category and embedder, indicating high contextual similarity to the references. Short code snippets yield lower reconstruction scores. These findings characterize one attack configuration and the selected datasets; they do not establish attack-independent rankings or sensitive-attribute recovery rates. They nevertheless motivate explicit assessment of inversion risk and access controls for stored embeddings."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="elaasar-lopes-2026-much">
<titleInfo>
<title>How Much Do Modern Embeddings Reveal? Inversion Attacks on Commercial Embedding Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Kareem</namePart>
<namePart type="family">Elaasar</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Cristina</namePart>
<namePart type="family">Lopes</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 9th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP</title>
</titleInfo>
<name type="personal">
<namePart type="given">Dana</namePart>
<namePart type="family">Arad</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yonatan</namePart>
<namePart type="family">Belinkov</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hanjie</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Nils</namePart>
<namePart type="family">Feldhus</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Aaron</namePart>
<namePart type="family">Mueller</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Hosein</namePart>
<namePart type="family">Mohebbi</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Gabriele</namePart>
<namePart type="family">Sarti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Martin</namePart>
<namePart type="family">Tutek</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-476-7</identifier>
</relatedItem>
<abstract>Text embedding inversion reconstructs source text from fixed-dimensional vectors, posing a privacy risk to systems that store embeddings instead of raw text. We adapt the vec2text framework (Morris et al., 2023) to support text-embedding-3-small and mistral-embed alongside GTR-base. We evaluate 800 samples per category across general instructions, Wikipedia passages, paraphrased instructions, health-related instructions, and short literal code snippets, using a common 60–80-character range and paired original and paraphrased instructions. Under the evaluated vec2text configuration, text-embedding-3-small achieves the highest exact-match rate in all five categories, including 47.4% on health-related instructions and 24.5% on general instructions under the evaluation’s case-insensitive, whitespace-stripped matching rule. BERTScore F1 exceeds 87 on the 0–100 scale for every prose category and embedder, indicating high contextual similarity to the references. Short code snippets yield lower reconstruction scores. These findings characterize one attack configuration and the selected datasets; they do not establish attack-independent rankings or sensitive-attribute recovery rates. They nevertheless motivate explicit assessment of inversion risk and access controls for stored embeddings.</abstract>
<identifier type="citekey">elaasar-lopes-2026-much</identifier>
<location>
<url>https://aclanthology.org/2026.blackboxnlp-1.6/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>76</start>
<end>89</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T How Much Do Modern Embeddings Reveal? Inversion Attacks on Commercial Embedding Models
%A Elaasar, Kareem
%A Lopes, Cristina
%Y Arad, Dana
%Y Belinkov, Yonatan
%Y Chen, Hanjie
%Y Feldhus, Nils
%Y Mueller, Aaron
%Y Mohebbi, Hosein
%Y Sarti, Gabriele
%Y Tutek, Martin
%S Proceedings of the 9th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-476-7
%F elaasar-lopes-2026-much
%X Text embedding inversion reconstructs source text from fixed-dimensional vectors, posing a privacy risk to systems that store embeddings instead of raw text. We adapt the vec2text framework (Morris et al., 2023) to support text-embedding-3-small and mistral-embed alongside GTR-base. We evaluate 800 samples per category across general instructions, Wikipedia passages, paraphrased instructions, health-related instructions, and short literal code snippets, using a common 60–80-character range and paired original and paraphrased instructions. Under the evaluated vec2text configuration, text-embedding-3-small achieves the highest exact-match rate in all five categories, including 47.4% on health-related instructions and 24.5% on general instructions under the evaluation’s case-insensitive, whitespace-stripped matching rule. BERTScore F1 exceeds 87 on the 0–100 scale for every prose category and embedder, indicating high contextual similarity to the references. Short code snippets yield lower reconstruction scores. These findings characterize one attack configuration and the selected datasets; they do not establish attack-independent rankings or sensitive-attribute recovery rates. They nevertheless motivate explicit assessment of inversion risk and access controls for stored embeddings.
%U https://aclanthology.org/2026.blackboxnlp-1.6/
%P 76-89
Markdown (Informal)
[How Much Do Modern Embeddings Reveal? Inversion Attacks on Commercial Embedding Models](https://aclanthology.org/2026.blackboxnlp-1.6/) (Elaasar & Lopes, BlackboxNLP 2026)
ACL