Embeddings Treated as Non-Sensitive

Vectors are exported, cached, logged, or shared with vendors under the assumption that embeddings reveal nothing about their source.

Open in the interactive atlas →

Impact

Copies of sensitive content spread outside the controls applied to the original documents.

Why this severity

Impact High × Likelihood Low = Medium

Impact high: hidden copies of sensitive data. Likelihood low: exploitation needs vector access plus an inversion model.

Impact High: Code execution, credential compromise, exposure of regulated or confidential data, irreversible actions, or system-wide failure.
Likelihood Low: No public cases yet, or the attack needs privileged or insider access.

Method: OWASP Risk Rating Methodology

Evidence

Research: Text Embeddings Reveal (Almost) As Much As Text (arXiv 2310.06816, 2023)

Exploited by

Embedding Inversion & Membership Inference Threat · Medium severity

Mitigated by

Protect Embeddings as Sensitive Data Guardrail · Fixes medium risks

Remediation

Classify vector stores at the level of their most sensitive source.
Encrypt vectors at rest and restrict exports.
Include vector stores in data-retention and deletion workflows.

How to verify

Data inventory lists every vector store and its classification.
Deleting a source document removes its vectors within the retention SLA.

Framework mapping

OWASP Top 10 for LLM Applications 2025

LLM08:2025 Vector and Embedding Weaknesses

MITRE ATLAS

AML.T0024.001 Exfiltration via AI Inference API: Invert AI Model

NIST AI RMF 1.0

MEASURE 2.10 Privacy risk of the AI system is examined and documented