vec2vec translates any text embedding spaces without paired data, exposing stolen vector DBs to privacy attacks

A Cornell team has released the paper "Reading Between the Lines: Translating Text Embeddings Across Model Borders," introducing vec2vec, a method that learns to translate between any two text embedding spaces without paired sentences, the original encoders, or a dictionary. Relying only on adversarial training, reconstruction, cycle-consistency, and distance-preserving losses, it exploits the universal geometric structure of embeddings to complete the mapping. The result shows that embedding spaces from different models share exploitable commonalities, posing security risks for vector databases.

Confirmed

• On the hardest cross-backbone pairings, vec2vec achieves up to 0.96 cosine similarity, 100% top-1 accuracy, and an average rank of 1.
• On out-of-distribution data (tweets and clinical notes), it still maintains cosine similarity above 0.73, far exceeding random guessing, demonstrating effectiveness in real-world scenarios.
• Security implications: a stolen vector database can be weaponized—translating embeddings into a known space with vec2vec allows recovery of sensitive information without the original text, with 80% accuracy.
• One of the authors combined vec2vec with another Cornell paper, "Harnessing the Universal Geometry of Embeddings" (NeurIPS 2025), and a long blog post, pointing out that geometric structure underpins the method.

Why it matters

• vec2vec breaks the common assumption that embeddings are irreversible and incomparable across models, meaning that holding only vectors (not the original text) can still leak private information.
• It is a direct warning for the security design of enterprise vector databases and RAG systems: access control over the vectors themselves is equally critical.

2026-09-10 ~ 2026-09-10 · 5 related posts

• [source] vec2vec Paper: Translating Text Embeddings Across Model Borders — maier_ak · 2026-09-10
• [source] vec2vec translates any two text-embedding spaces without paired data, hits 0.96 cosine — maier_ak · 2026-09-10
• vec2vec Hits 100% Top-1 Accuracy and 0.96 Cosine Similarity on Hardest Embedding Pairs — maier_ak · 2026-09-10
• Stolen Vector Databases Can Be Weaponized: vec2vec Recovers Sensitive Facts at 80% Accuracy — maier_ak · 2026-09-10
• Stolen vector databases weaponized: embedding translation recovers sensitive data at 80% accuracy — maier_ak · 2026-09-10