Lion Cipher Lab
Invert text embeddings to recover private input: prove your vector database is NOT anonymized (free, local, deterministic, no model download)
- AI Security
- Advanced
- ~75 min
- Free · no account required
Why it matters
Teams reach for a vector database and quietly assume that once a sensitive note -- a diagnosis, a salary, a termination reason, a support ticket with a customer's data -- has been 'turned into an embedding,' it is now just an opaque list of numbers and therefore anonymized. That assumption is wrong, and this lab proves it three ways on your own machine. This is specifically TEXT-EMBEDDING inversion and linkage, a different threat from the two neighbouring labs: model inversion reconstructs an IMAGE from a trained classifier's outputs, and gradient leakage recovers inputs from GRADIENTS shared…
What you'll learn
- why storing an embedding of sensitive text is NOT anonymization -- the vector is sensitive as its source
- EXACT inversion of a sparse bag-of-words embedding: recovering the verbatim token multiset from the nonzero vector components
- LINKAGE / re-identification: matching a stored dense embedding back to its source text by nearest neighbor over a candidate set
- greedy approximate RECONSTRUCTION of a dense embedding's tokens, and measuring precision / recall / F1 against the truth
- the many-to-one collision failure mode: high cosine similarity with the WRONG tokens, so reconstruction is ambiguous
- measuring the privacy/utility tradeoff of a noise (DP-style) defense: retrieval fidelity collapses before linkage is fully stopped
- how this differs from model inversion (image-from-classifier) and gradient leakage (input-from-training-gradients)
- the judgment: treat every embedding in a vector store as sensitive as the text it came from, and map it to OWASP LLM02
Steps in this lab
- The myth: 'we embedded it, so it's anonymized'
- Sparse vs dense embeddings -- the two shapes you will attack
- Set up the environment (offline, no model download)
- Write the inversion script
- Part 2 -- exact inversion of a sparse embedding (100% recovery)
- Part 3 -- linkage: recover WHICH private sentence made a dense vector
- Part 4 -- greedy reconstruction, and the many-to-one collision
- Part 5 -- the noise defense, and its measured privacy/utility cost
- The judgment: treat every embedding as sensitive as its source
- Do it better -- where a production version goes