Skip to main content
LLM Security Database
Skip to research details
Back to research findings
LMVD-ID: 2021f881
Paper published September 4, 2026
Entry analyzed September 9, 2026
Paper-reported evidence
Confidence: Source-linked

The LMVD-ID is an internal research identifier, not an official CVE identifier.

Document reconstruction from exposed retrieval embeddings

Exposed retrieval embeddings can reveal source text. SHAQ evaluates indexing generated queries instead of direct document embeddings to reduce that leakage.

Application layer
Extraction
RAG
Embedding
Data privacy
Black-box
Read primary paperBibTeX citation

Paper-evaluated models(1)

  • QwQ 32B

Description

Exposed retrieval embeddings can reveal source text. SHAQ evaluates indexing generated queries instead of direct document embeddings to reduce that leakage.

Examples

See the primary study (opens in a new tab).

Impact

Across ten sampled BEIR datasets, the authors report defended mean reconstruction ROUGE-1 of 0.2710 under the standard evaluation and 0.3376 under its adaptive variant. Residual overlap remains. Documents were truncated to 32 tokens; full-length reconstruction privacy and downstream question answering were not evaluated.

Affected Systems

  • The FAISS retrieval setup with GTR-T5 embeddings and T5-based vec2text evaluation; exact encoder checkpoints are unspecified. DPR appears only in a retrieval-utility ablation. QwQ-32B generates the defensive queries.

Mitigation Steps

  • Restrict and audit embedding access.
  • Measure privacy and retrieval quality together.
  • Validate full-length document privacy before deploying this defense.

Evidence

Research context and confidence

Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
Black-box model, service, or application access.
Related deployment categories
Retrieval-augmented generation
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
The FAISS retrieval setup with GTR-T5 embeddings and T5-based vec2text evaluation; exact encoder checkpoints are unspecified. DPR appears only in a retrieval-utility ablation. QwQ-32B generates the defensive queries.

Research Paper

Shadow Queries for Private Retrieval in Vector Databases

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research