<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zheng-etal-2026-metadata">
    <titleInfo>
        <title>When Metadata Remembers: Ordered Provenance Enables Document-Level Embedding Inversion</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Liwen</namePart>
        <namePart type="family">Zheng</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Qing</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Qingsong</namePart>
        <namePart type="family">Zou</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yong</namePart>
        <namePart type="family">Jiang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Text embeddings in RAG indexes, vector stores, and agent memories are rarely leaked as isolated vectors: they often appear with document IDs, chunk offsets, and preserved order. This paper shows that such ordered provenance is not passive metadata but an active privacy channel. We introduce MIRAGE, a public-shadow, zero-victim-pair attack that exploits ordered document-chunk leakage by turning facts recovered from earlier chunks into encoder-verified anchors for later reconstruction. MIRAGE builds public-shadow single-chunk candidates, extracts typed anchors, verifies them with counterfactual encoder-support checks, and uses verified memory to regenerate document-consistent chunks. Across five dense encoders and four decoders on ordered Enron and synthetic CanaryDocs, under a strict 512-query victim-time budget per chunk, MIRAGE outperforms strong fixed-bank reranking, improving macro privacy-unit recall by 5.65-6.10 points across encoders and 5.2-6.9 points across decoders; gains persist (+3.7-4.4 points) on two real, non-templated corpora. Its support check raises accepted-anchor precision from 43.6% to 69.4%, and 34.8% of newly recovered privacy units appear only in regenerated candidates absent from every fixed bank. These results reveal document grouping, chunk order, and offsets as sensitive attack surfaces that RAG and vector-store deployments must protect alongside embeddings themselves.</abstract>
    <identifier type="citekey">zheng-etal-2026-metadata</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.582/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>13314</start>
            <end>13333</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T When Metadata Remembers: Ordered Provenance Enables Document-Level Embedding Inversion
%A Zheng, Liwen
%A Li, Qing
%A Zou, Qingsong
%A Jiang, Yong
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zheng-etal-2026-metadata
%X Text embeddings in RAG indexes, vector stores, and agent memories are rarely leaked as isolated vectors: they often appear with document IDs, chunk offsets, and preserved order. This paper shows that such ordered provenance is not passive metadata but an active privacy channel. We introduce MIRAGE, a public-shadow, zero-victim-pair attack that exploits ordered document-chunk leakage by turning facts recovered from earlier chunks into encoder-verified anchors for later reconstruction. MIRAGE builds public-shadow single-chunk candidates, extracts typed anchors, verifies them with counterfactual encoder-support checks, and uses verified memory to regenerate document-consistent chunks. Across five dense encoders and four decoders on ordered Enron and synthetic CanaryDocs, under a strict 512-query victim-time budget per chunk, MIRAGE outperforms strong fixed-bank reranking, improving macro privacy-unit recall by 5.65-6.10 points across encoders and 5.2-6.9 points across decoders; gains persist (+3.7-4.4 points) on two real, non-templated corpora. Its support check raises accepted-anchor precision from 43.6% to 69.4%, and 34.8% of newly recovered privacy units appear only in regenerated candidates absent from every fixed bank. These results reveal document grouping, chunk order, and offsets as sensitive attack surfaces that RAG and vector-store deployments must protect alongside embeddings themselves.
%U https://aclanthology.org/2026.emnlp-main.582/
%P 13314-13333

Markdown (Informal)

[When Metadata Remembers: Ordered Provenance Enables Document-Level Embedding Inversion](https://aclanthology.org/2026.emnlp-main.582/) (Zheng et al., EMNLP 2026)

• When Metadata Remembers: Ordered Provenance Enables Document-Level Embedding Inversion (Zheng et al., EMNLP 2026)

ACL

• Liwen Zheng, Qing Li, Qingsong Zou, and Yong Jiang. 2026. When Metadata Remembers: Ordered Provenance Enables Document-Level Embedding Inversion. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 13314–13333, Budapest, Hungary. Association for Computational Linguistics.