UC Irvine

Text embedding inversion reconstructs source text from fixed-dimensional vector representations, posing an underappreciated privacy threat to systems that store embeddings in lieu of raw text. Prior work demonstrated inversion of GTR-base and OpenAI’s text-embedding-ada-002 but left open whether newer commercial embedding APIs are more or less vulnerable to the same attack, and whether the attack’s fidelity transfers to content categories beyond the in-distribution web passages on which the inverter was trained. This thesis addresses both gaps. The first contribution is a multi-API extension of the opensource vec2text codebase of Morris et al. that supports OpenAI’s text-embedding-3-small (1536 dimensions) and Mistral’s mistral-embed (1024 dimensions) as drop-in embedders alongside the original GTR-base, with five targeted code changes: dimension-agnostic projection layers in both the inverter and corrector models, two new API client functions with batched inference and rate-limit-aware exponential-backoff retry, a checkpoint registry, and an updated public-API model list. The structural changes are minimal — the T5-base backbone, the MLP projection scheme, the corrector concatenation format, and the training loop are unchanged from the original — which is what allows the resulting cross-embedder comparison to be interpreted as a comparison of embedders rather than of architectures.The second contribution is a controlled cross-domain case study. I evaluate inversion fidelity on 800 samples per category across five categories drawn from reproducible public sources with fixed random seed: in-distribution instructions from One Million Instructions, outof-distribution Wikipedia prose from Wikitext-103, large-language-model-generated paraphrases of the in-distribution instructions paired one-to-one with their originals, medicaldomain instruction prompts filtered by health keywords, and short literal code snippets in Python, JavaScript, and SQL. Each model is evaluated at five corrector steps with greedy decoding, and the four metrics reported are exact-match recovery, BLEU-4, ROUGE-L, and BERTScore-F1.The empirical findings revise the picture left by prior work. text-embedding-3-small is the most invertible model in every category, recovering 47.4% of medical queries and 24.5% of general instructions exactly from their embeddings alone — substantially exceeding the GTR-base baseline. mistral-embed sits in the middle. Domain matters as much as model: medical text is the easiest domain to invert, driven by the templated phrasing of health-related instruction prompts; literal code is the hardest by a wide margin, with BERTScore collapsing as low as 47.1 for mistral-embed on the code category — the only model-domain combination in the entire study in which the corrector’s output is not reliably text-shaped under a pre-trained BERT. Every prose category, by contrast, lies above 87 BERTScore for every embedder, confirming that semantic content is recovered reliably on natural-language inputs even when exact reconstruction fails. The paired paraphrase comparison cleanly isolates the surface-form leakage signal: exact-match recovery drops modestly from in-distribution instructions to their paraphrases (24.5% to 19.8% for text-embedding-3-small) while BERTScore is essentially preserved, indicating that paraphrase-neighbor ambiguity is a real but bounded source of inversion error. Dimensionality alone does not predict vulnerability: while the highest-dimensional embedder is the most invertible overall, the lower-dimensional GTR-base outperforms the higher-dimensional mistral-embed on five of twenty metric-by-category cells.