The Embedding of Your Note Is Not Anonymous

Sending a text embedding instead of the note it came from is not anonymization. An embedding is a list of numbers that a model assigns to text, and researchers have shown those numbers can be inverted back into the text's content — approximately, but often faithfully enough to breach confidentiality. A hosted vector is recoverable content, not an anonymized derivative.

The belief sounds reasonable, and a working engineer states it out loud. Building retrieval over private notes, you reason, in Jack Morris's words, that "you only ever send embedding vectors, which look to you like random numbers."¹ The text stays home; only coordinates travel. Then, in 2023, Morris and three colleagues at Cornell Tech published a paper whose title is already the argument — Text Embeddings Reveal (Almost) As Much As Text — and showed a method that recovered 92% of 32-token inputs exactly and pulled full names out of a dataset of clinical notes.² The numbers are not noise. They are meaning in a numeric coat, and the coat comes off. What follows is the case against one quiet assumption in nearly every retrieval pipeline: that a vector is safe to store somewhere you would never store the note.

The assumption: a vector looks like random numbers

The common belief is that an embedding is a safe, one-way derivative. You send the model your text once, keep the numbers it returns, and store or ship those instead of the words. The vectors look like noise, so the pipeline feels like it has already been anonymized before anything leaves your machine.

There is real logic to it. Redaction happens at the text boundary, where you strip names and secrets before the words go anywhere, so a pipeline that never ships the words feels like it has closed the last door.

The vectors are high-dimensional floats; to a human they are unreadable, and the intuition that unreadable equals safe is old and deep. It is also why the cleaner question is sometimes whether you need a hosted vector store at all, rather than how to secure one.

The finding: the numbers give the meaning back

That assumption fails against a documented attack. In a 2023 paper presented at EMNLP, researchers at Cornell Tech trained a model to read embeddings in reverse and recovered 92% of short text inputs exactly. Against a black-box encoder they never see inside, the reconstruction reached a near-perfect BLEU score of 97.3.²

The mechanism is not exotic. An embedding is trained to place similar meanings near each other in space, which means the geometry preserves the meaning — and anything that preserves meaning can, with enough work, be made to give it back.

None of this needs the model's internals. The same paper trains its inverter directly on OpenAI's text-embedding-ada-002, the exact model a developer reaches for when sending notes to a hosted store, and a public library called vec2text now ships a pre-trained corrector for it. You can pip install vec2text and reconstruct text from those embeddings on your own machine.³

The researchers open by naming the gap they walked into: "Vector databases are increasingly popular, but privacy threats within them have not been comprehensively explored."² That gap is closing. A year later OWASP added embedding inversion to its 2025 Top 10 for LLM applications, under LLM08, warning that "attackers can exploit vulnerabilities to invert embeddings and recover significant amounts of source information, compromising data confidentiality."⁴ This is a catalogued risk class now, not a fringe result.

The correction: recovered content is not a rebuilt file

Recovery here means the content and meaning of the text, not a byte-perfect copy of your original file. The attack is approximate and lossy, which makes it useless as a backup yet plenty for a leak. A vector you cannot trust to rebuild your vault can still surrender enough to breach a confidence.

This is where two true statements have to be reconciled, not fudged. A companion essay here argues that vectors never reconstruct notes — that you cannot rebuild your authoritative vault from an index, because the mapping is model-specific and lossy, so the index is a disposable cache and the notes are the asset.

That holds, and it does not soften this. The same approximation that makes a vector useless as a backup leaves it dangerous as a leak: you do not need a perfect copy to expose what a note was about, who it named, or what it revealed. A backup has to be faithful. A breach only has to be close.

The rule: a note's vector is as sensitive as the note

The discipline is one line: treat a note's embedding as sensitive as the note itself. The researchers put it plainly: embeddings "should be treated as highly sensitive private data and protected, technically and perhaps legally, in the same way as one would protect raw text."²

If you would not paste a note into a stranger's server, do not ship its vector there either. Read that as an engineering instruction, not a slogan. Every place your threat model already puts the note, whether encrypted at rest, kept off shared servers, or never in a third party's logs, is a place the vector belongs too. The equivalence runs both ways: because the embedding carries nearly the same information as the text, it inherits nearly the same duty of care.

What to do tomorrow

The practical move is to keep the index where the notes already live. Embed on your own device, store the vectors beside your files rather than in a hosted database, and treat any embedding that must leave as the sensitive text it encodes. Where a vector has to travel, add noise or quantize it first.

Four moves, in order of leverage:

1. Embed locally. Run the embedding model on your own device so the text never crosses a boundary to become a vector in the first place.
2. Store the index next to the files. Keep the vectors where the notes already live, next to the files you own, rather than in a hosted database you do not control.
3. Treat an exported vector as exported text. If an embedding must go to a shared service, apply the same redaction and access rules you would apply to the note.
4. Perturb what you must ship. Where a vector has to travel, add Gaussian noise or quantize it — the defenses a 2025 reproducibility study found effective.⁵

The honest scope: what this attack does and does not do

None of this makes a hosted vector trivially readable by anyone. Inversion needs query access to the same embedding model, real computational effort, and it degrades as text grows longer. Defenses work: a reproducibility study found that Gaussian noise and quantization blunt the attack. The claim is narrow — a vector is not anonymous by default.

The authors are careful, and so should we be. "Neural networks are in general non-trivial or even impossible to invert exactly,"² they write; the 92% figure is for short, 32-token inputs, recovered over several rounds of iterative correction.

The team that reran the work replicated its key results in and out of domain, and even reconstructed password-like sequences that lack clear semantics — while naming its "sensitivity to input sequence length" as a real limit and confirming the defenses.⁵ So the honest scope is neither "your vectors are plaintext" nor "your vectors are safe." It is that a hosted embedding of a private note is recoverable content an adversary with model access can approximate — not anonymous, but not effortlessly readable either.

Frequently Asked Questions

Can you recover the original text from a text embedding?

Approximately, yes. A 2023 Cornell Tech method recovered 92% of 32-token inputs exactly and reached a near-perfect BLEU score of 97.3 against a black-box encoder.² Recovery is the content and meaning of the text, not a byte-perfect copy of your file, and it degrades as the input grows longer — but it is often faithful enough to breach confidentiality.

Are text embeddings anonymous, or are they personal data?

Not anonymous by default. The researchers who inverted them concluded embeddings "should be treated as highly sensitive private data" and protected like raw text.² If the source text is personal data, the embedding should be treated as personal data too — the numeric form does not launder the content it encodes, it only hides it from a casual human reader.

Is it safe to store note embeddings in a cloud vector database?

Treat it as storing the notes themselves. A hosted vector is recoverable content, and OWASP now lists embedding inversion as a named risk for vector stores.⁴ The safer pattern is to keep the index on your own device, beside your files. If a cloud store is unavoidable, encrypt, restrict access, and perturb the vectors before they leave.

What is embedding inversion, and what is vec2text?

Embedding inversion is reconstructing source text from its stored vector. vec2text is a public, pip install-able library that does exactly this: it iteratively decodes and re-embeds until the text converges, and it ships a pre-trained corrector for OpenAI's text-embedding-ada-002.³ The technique is reproducible on ordinary hardware — a released tool, not a lab-only result.

Can OpenAI embeddings be reversed?

The best-known attack targets them specifically. The 2023 Cornell Tech paper trains its inverter on OpenAI's text-embedding-ada-002, one of the two state-of-the-art models it decodes, and vec2text ships a corrector for the same model.²³ This is not a claim about OpenAI's security; it is that a general embedding preserves enough meaning to be inverted, whoever produced it.

Do I need to redact a note before embedding it?

Redaction at the text boundary does not cover the vector. If you strip secrets before you paste a note into an AI tool but then embed the unredacted note and ship those vectors, the sensitive content rides along inside the embedding. Redact before you embed, not only before you paste, and keep the resulting index local.

An embedding is not a shadow of your text; it is your text rewritten in a language you happen not to read — and a system with the right model can read it back. A note you would encrypt deserves a vector you would encrypt.

If keeping the words on your own device is the point, mnmnote.com is a plain-Markdown place where your notes, and any index you build over them, can stay there.