A new empirical study demonstrates that adding noise to document embeddings provides little protection against identification attacks when an adversary possesses even a modest number of known document-embedding pairs.
The research evaluated eight protection schemes across two BEIR collections (SciFact with 5,183 documents and NFCorpus with 3,633 documents) and two embedding models (all-MiniLM-L6-v2 and bge-small-en-v1.5). The schemes included Gaussian noise, secret rotation plus noise, SAP/DCPE (uniform noise in a ball), binary LSH, random projections, product quantization (PQ), secret nonlinear transformations, and k-anonymous quantization.
The core finding is that noise levels sufficient to reduce text reconstruction attacks to near zero still allow an attacker to match protected embeddings to known documents with high accuracy. When retrieval quality dropped by half, identification rates reached 99.9% for Gaussian noise, 99.2% for secret rotation plus noise, and 98.7% for SAP/DCPE.
Even with only 100 known pairs (approximately 2% of the SciFact corpus), linear least-squares alignment recovered 91% of mappings for SAP/DCPE, 89% for Gaussian noise, and 88% for secret rotation. At 200 known pairs the success rate approached 98-100% for most noise-based methods while preserving roughly 80% of original retrieval quality.
Schemes that discard information rather than add noise performed better. Product quantization reduced identification to 27% at 50% quality retention on SciFact, although results varied dramatically across corpora. k-anonymous quantization provided a provable upper bound on identification but incurred higher quality costs than PQ at comparable protection levels.
The author notes that secret linear transformations, previously proposed as a defense in vec2text research, are completely defeated by the linear alignment attack once a few hundred known pairs are available. Nonlinear transformations also failed to block the attack across a wide range of gain parameters.
The study concludes that embedding protections should be evaluated against membership inference rather than solely against full text reconstruction, and that meaningful protection requires deliberate information loss whose cost must be measured on the target corpus.
