vec2vec translates across arbitrary embedding spaces, exposing vector database security risks

A Cornell team published the paper "Reading Between the Lines: Translating Text Embeddings Across Model Borders," proposing vec2vec, a method that learns translations between any two text embedding spaces without paired sentences, original encoders, or dictionaries, relying on adversarial training, reconstruction, cycle consistency, and distance-preserving losses to exploit the universal geometry of embeddings. This shows that embedding spaces from different models share exploitable common structure, with serious security implications for vector databases.

Confirmed

• On the hardest cross-backbone pairings, vec2vec achieved up to 0.96 cosine similarity, 100% top-1 accuracy, and mean rank 1.
• On out-of-distribution data (tweets and clinical notes), it retained over 0.73 cosine similarity, far above random guessing, demonstrating real-world effectiveness.
• Security implication: stolen vector databases can be weaponized—after translating embeddings into a known space with vec2vec, sensitive information can be recovered without the original text, at 80% accuracy.
• One author contextualized vec2vec alongside another Cornell paper, "Harnessing the Universal Geometry of Embeddings" (NeurIPS 2025), and a long blog post, arguing that geometric structure underpins the method.

Why it matters

• vec2vec breaks the common assumption that embeddings are irreversible and incomparable across models: holding only vectors (not the original text) can still leak private information.
• It is a direct warning for the security design of enterprise vector databases and RAG systems: access control over the vectors themselves is critical.

2026-09-10 ~ 2026-09-10 · 5 related posts

• vec2vec Paper: Translating Text Embeddings Across Model Borders — maier_ak · 2026-09-10
• [source] vec2vec translates any two text-embedding spaces without paired data, hits 0.96 cosine — maier_ak · 2026-09-10
• vec2vec Hits 100% Top-1 Accuracy and 0.96 Cosine Similarity on Hardest Embedding Pairs — maier_ak · 2026-09-10
• Stolen Vector Databases Can Be Weaponized: vec2vec Recovers Sensitive Facts at 80% Accuracy — maier_ak · 2026-09-10
• Stolen vector databases weaponized: embedding translation recovers sensitive data at 80% accuracy — maier_ak · 2026-09-10