Review text-embedding disclosure before exporting vectors

Use the research as a bounded counterexample

Text Embeddings Reveal (Almost) As Much As Text, the actual arXiv v1 PDF dated 10 October 2023, demonstrates text reconstruction in studied embedding setups. Its threat model assumes access to a target vector and query access to the same encoder; its learned inversion system uses text–embedding training pairs. Experiments include GTR-base embeddings of short Wikipedia passages. Section 10 limits investigated text lengths and discusses access and search assumptions. These historical findings counter the claim that vectors necessarily conceal their source. They do not establish recovery from every encoder, recipient capability or application.

The practical question is whether a particular recipient may receive this representation and accompanying information. The original worksheet below answers that governance question before export. It does not implement or reproduce the research.

Make the disclosure bundle explicit

Invent Cedar Search, which wants an outside evaluator to assess retrieval quality. Its proposed package E-7 contains vector records from corpus revision R-4. The request says “no source text,” but that phrase leaves the actual package unresolved. Record five separate components instead of one anonymous-data checkbox.

This is policy notation, not a vector format or an export manifest generated from files. No corpus, vectors, identifiers or recipient service exists for the exercise. If the actual byte and field inventory is unknown, mark E-7 incomplete rather than approving the visible preview.

Keep permission and measured exposure separate

Suppose R-4 contains restricted internal material whose approved use is local retrieval. A reviewer cannot turn “vectors only” into authorization for a new evaluator. Identify the applicable data policy and decision owner. If derived exports are not covered, hold the transfer and seek an explicit permitted scope; the scientific paper cannot grant that permission.

Conversely, permission to share a source does not prove that every field in an export is needed. If the evaluator requires only a teaching demonstration, prepare an independently authorized synthetic or public corpus instead. Give that proposal its own provenance. Substituting synthetic material must be checked as a concrete input decision, not inferred from an export filename.

Maintain a separate exposure assessment: which encoder produced the representation, what access the recipient has, which information would matter if inferred, and which assumptions remain unsupported. This worksheet makes no numerical estimate. Missing evidence is not proof of either successful reconstruction or confidentiality.

Preserve a useful ordinary positive

For the positive card, use fictional public teaching source S-1. The evaluator is independently permitted to receive S-1 itself and its derived representation for the declared retrieval lesson. The proposed package includes only necessary synthetic record references and the agreed representation, with no private lookup map or unrelated metadata. An owned review record binds that exact package, recipient and purpose.

Conditional admission means this plan satisfies its declared disclosure policy after the prerequisites are established. It is not an observed transfer, a claim of anonymous vectors, or proof that the evaluator cannot learn the source. The task remains useful because no secrecy premise is needed for this invented public lesson.

Actual source rights, current recipient authorization, complete package inventory, encoder and revision lineage, applicable handling terms, copy restrictions and operational enforcement are unimplemented and unknown here. Any unresolved required premise blocks a real positive. A matching record label alone cannot establish those facts.

Predeclare eight different decisions

Cards 2 and 5 are deliberately different. One rejects an unsupported confidentiality premise; the other rejects an unsupported attack-success estimate. Neither authorizes an experiment against a recipient or sensitive corpus.

Record the decision without copying the source again

A minimal internal receipt can name the corpus revision, package reference, approved component list, recipient scope, purpose, reviewer, unresolved assumptions and disposition. Keep the actual restricted source and vectors out of an ordinary issue or chat. Retain evidence through the authorized system rather than creating an unrestricted debugging copy.

This guide supplies no anonymization, noise, quantization or cryptographic recipe, legal classification, universal invertibility claim or measured privacy improvement. The paper is motivation for a representation-disclosure review, not a current vendor vulnerability report. Deletion and incident handling remain separate lifecycle questions.

All worksheet cases are PROPOSED_UNRUN. No embedding generation, reconstruction, model training, scoring, vector export or candidate runtime experiment occurred. Boundary is a prelaunch model router with planned request-path checks, not an implemented embedding privacy assessor or export-control service. The separate local mock-policy evidence does not validate this disclosure worksheet.