vec2text

Noise in Embeddings Fails to Protect Data: 8 Schemes Tested, ~90% Documents Identified with Just 100 Known Pairs

A detailed evaluation of eight embedding protection schemes shows that adding noise does not prevent document identification attacks when an adversary knows even a small number of document-embedding pairs. The study tested Gaussian noise, secret rotations combined with noise, SAP/DCPE, binary LSH, random projections, product quantization, secret nonlinearities, and k-anonymous quantization on BEIR collections SciFact and NFCorpus using all-MiniLM-L6-v2 and bge-small-en-v1.5 models. Even when noise levels reduced retrieval quality by half, identification rates remained above 98% for most noise-based methods. With only 100 known pairs (roughly 2% of the corpus), linear alignment attacks recovered around 90% of mappings for several schemes. Product quantization offered better protection but required significant quality loss to bring identification below 50%. The findings highlight that protections evaluated only against text reconstruction attacks can still leak membership information in realistic partial-leak scenarios.