Vector Inversion
An attack technique that reconstructs the original input from dense vectors, by training a decoder or directly optimizing pixels so that the vectors of the reconstructed image align with the target vectors in embedding space; it is feasible because the encoder is a deterministic mapping.
Timeline (last 90 days)
From the multi-vector index alone, an attacker can reconstruct pages quite close to the original images and even precisely identify their source documents.
The inversion pipeline built in this study can recover about 47% of the original text on the ViDoRe v3 benchmark and ranks its source document first in 98.4% of queries.
Vector inversion refers to an attack technique that reconstructs the original input from dense vectors, and its feasibility stems from the encoder being a deterministic mapping, allowing attackers to turn "finding the original image" into an optimizable inverse problem.
Patch-level multi-vector indexes are especially vulnerable, because each vector corresponds to a local region, and an attacker can invert them one by one and reassemble them according to the geometric layout, bypassing the global information compression blurring of whole-page embeddings.
All Facts (4)
From the multi-vector index alone, an attacker can reconstruct pages quite close to the original images and even precisely identify their source documents.
50%UnverifiedThe inversion pipeline built in this study can recover about 47% of the original text on the ViDoRe v3 benchmark and ranks its source document first in 98.4% of queries.
50%UnverifiedVector inversion refers to an attack technique that reconstructs the original input from dense vectors, and its feasibility stems from the encoder being a deterministic mapping, allowing attackers to turn "finding the original image" into an optimizable inverse problem.
50%UnverifiedPatch-level multi-vector indexes are especially vulnerable, because each vector corresponds to a local region, and an attacker can invert them one by one and reassemble them according to the geometric layout, bypassing the global information compression blurring of whole-page embeddings.
50%