[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82600-en":3,"doc-seo-82600-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82600,8796095360427,"Lucas Martin","https://ap-avatar.wpscdn.com/davatar_994ba38a5ba835b3df7d355c54d3ed8d",8,"Research & Report","Embedding Inference Attack","Embedding models are foundational in modern Information Retrieval (IR) systems, yet they are often exposed through APIs where hidden security risks can emerge. Recent research shows dense IR may enable embedding inversion attacks, typically assuming the attacker knows the embedding model. This work studies a black-box setting where the adversary sees only the unordered set of retrieved documents, without rankings or similarity scores, and demonstrates how tailored queries can identify the embedding model from known candidates, even with rerankers or mitigation thresholds, and validates on a real RAG system.","Embedding Inference Attack  \nCedric Fitiavana Raelijohn and Sébastien Gambs and Jean-Francois Rajotte  \nUniversité du Québec à Montréal, Canada  \n[raelijohn.cedric_fitiavana@courrier.uqam.ca](raelijohn.cedric_fitiavana@courrier.uqam.ca), [gambs.sebastien.@uqam.ca](gambs.sebastien.@uqam.ca),  \n[rajotte.jean-francois@uqam.ca](rajotte.jean-francois@uqam.ca)  \narXiv :2607 .0 1276v 1 [ cs .CR] 1 Jul 2026  \nAbstract  \nEmbedding models are essential components of modern Information Retrieval (IR) systems, yet they are typically hidden behind APIs. Recent works have shown that dense IR system can lead to security vulnerabilities such as embedding inversion attacks. However, such attacks usually require that the attacker knows the embedding model for the attack to be applicable. In this paper, we study IR systems under a black-box setting in which the adversary observes only the unordered set of retrieved documents, without ranking or similarity scores.  \nWe demonstrate that in such contexts, tailored queries allow an adversary to identify which embedding model is in use from a set of known model candidate, which we coin as an embedding inference attack (EIA) . We also show that certain queries remain discriminative even when the system includes a reranker as a potential defense mechanism. We further validate our method on a real Retrieval-Augmented Generation (RAG) system, in which the tailored queries bypass the LLM’s tendency to reject inputs it does not recognize as well-formed questions. Finally, we propose and evaluate other mitigation strategies such as similarity thresholds.  \n1 Introduction  \nWith the growth of data and the rise of artificial intelligence (AI), IR systems have evolved into modern applications, such as dense (or semantic) IR, in which documents and queries are encoded into vector representations (embeddings vectors) using a neural network, denoted as embedding models (Karpukhin et al., 2020a) . This approach enables semantic matching rather than exact keyword matching, significantly improving retrieval performance, especially in large scale datasets. More recently, Retrieval-Augmented Generation (RAG) has emerged as a popular paradigm combining dense retrieval with general-purpose large language models (LLMs) to generate context-aware  \nresponses. This is especially relevant for domainspecific fields such as finance, healthcare and education (Chang et al., 2024 ; Arslan et al., 2024) .  \nWith respect to privacy, embedding vectors are often assumed to be safe to expose because they are only numerical values that do not directly convey an interpretable information for a human. However, recent works have demonstrated the feasibility of conducting embedding inversion attacks, which allow to reconstruct the text represented by embeddings vectors (Morris et al., 2023 ; Zhang et al., 2025a) . For instance, this could happen in the common situation in which a RAG system is based on publicly accessible data and is implemented to help users navigate a large set of documents, such as documentation, policies, etc. In this situation, the queries could contain sensitive information such as personal medical conditions. Embedding inversion attacks often rely on strong assumptions about the adversary’s capabilities such as access to large sets of leaked text–embedding pairs or knowledge of the victim’s embedding model and architecture (Morris et al., 2023 ; Huang et al., 2024 ; Zhang et al., 2025a) . We show here how IR systems based on publicly available datasets relaxes these assumptions, making them more vulnerable to inversion attacks.  \nIn this work, we introduce the concept of Embedding Inference Attack (EIA), which aims to infer the embedding model used by the target system ina black-box setting in which the adversary has only access to the API of the system. This setting is realistic because embedding models are commonly accessible only through API, for instance in Semantic Scholar AI-powered research tool and OpenEvide","cbCait70vOtfnjIx","https://ap.wps.com/l/cbCait70vOtfnjIx","pdf",382583,1,12,"English","en",105,"# Introduction\n# Contributions\n# System and Adversary Models\n# Related Work\n# Proposed Embedding Inference Attack (EIA)\n# Experiments and Evaluation\n# Mitigation Strategies","[{\"question\":\"What problem does the Embedding Inference Attack (EIA) address?\",\"answer\":\"EIA targets black-box IR systems to infer which embedding model the system is using, based only on observing an unordered set of retrieved documents from the API.\"},{\"question\":\"How does the paper set up the black-box attacker’s capabilities?\",\"answer\":\"The adversary can submit tailored queries and observe only the unordered retrieved documents, without access to ranking information or similarity scores.\"},{\"question\":\"Can EIA still work when a reranker or mitigation techniques are present?\",\"answer\":\"Yes. The paper shows certain queries remain discriminative even if the system includes a reranker, and it also evaluates mitigation options such as similarity thresholds.\"}]",1784181727,30,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"embedding-inference-attack","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/embedding-inference-attack/82600/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does the Embedding Inference Attack (EIA) address?","Question",{"text":75,"@type":76},"EIA targets black-box IR systems to infer which embedding model the system is using, based only on observing an unordered set of retrieved documents from the API.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How does the paper set up the black-box attacker’s capabilities?",{"text":80,"@type":76},"The adversary can submit tailored queries and observe only the unordered retrieved documents, without access to ranking information or similarity scores.",{"name":82,"@type":73,"acceptedAnswer":83},"Can EIA still work when a reranker or mitigation techniques are present?",{"text":84,"@type":76},"Yes. The paper shows certain queries remain discriminative even if the system includes a reranker, and it also evaluates mitigation options such as similarity thresholds.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":28,"slug":121},"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]