Cybersecurity glossary
What is an Embedding?
Learn what an embedding is in machine learning, how text is mapped to vectors for search and RAG, why embeddings can leak meaning, and how to handle them as sensitive derived data.
Definition
An embedding is a dense numeric vector that represents a piece of content—text, code, an image, or a user—in a geometric space where similar items lie close together. Applications use embeddings for search, clustering, recommendations, and RAG retrieval.
Why embeddings matter
Search used to match strings. Embeddings match meaning. A question about “invoice overdue for Acme” can retrieve a chunk titled “past-due AR for customer A,” even if the words differ. That property is why RAG works—and why a vector is not harmless metadata.
An embedding is a compressed fingerprint of content. Combined with the usual payload text stored beside it, it is another copy of your data. Even the vector alone can leak topics, cluster users, or support inversion if an attacker can query the embedding model at scale.
How text becomes a vector
Choose a model
A dedicated embedding model (or a model API) is selected for language, dimension, and domain.
Prepare the chunk
Documents are split, cleaned, and sometimes prefixed with titles or instruction text.
Encode
The model maps tokens to a dense vector, often hundreds or thousands of dimensions.
Normalize and store
Vectors may be normalized for cosine similarity, then written to a vector database with payload.
Encode queries the same way
User questions use the same model so they land in the same geometric space.
Rank by distance
Cosine or inner-product scores decide which chunks the LLM will see.
What embeddings leak in practice
Topic clusters
Nearest-neighbor graphs can reveal that a tenant’s corpus is about a merger, a diagnosis, or a vulnerability.
Membership hints
If a query vector for a secret phrase ranks unusually close, an attacker may infer that phrase exists in the index.
Vendor copies
Calling a hosted embedding API sends chunk text off-box. That is a data-flow decision, not a free utility.
Instruction prefixes
Some embedders use task prefixes. Attackers who control prefixes can shift where malicious chunks sit in space.
Embedding data versus source data
| Property | Source document | Embedding |
|---|---|---|
| Human readable | Yes | No, but often stored next to the original chunk |
| Useful for search | Keywords and metadata | Semantic similarity |
| Sensitivity | Classified by content | Inherit the source classification; do not downgrade |
| Reconstruction | The document is the reconstruction | Partial inversion and topic recovery are realistic threats |
| Retention | Lifecycle in the DMS | Needs its own delete, re-embed, and vendor-retention policy |
- Classify embeddings at the same level as the source chunk; do not treat vectors as anonymous telemetry.
- Do not send regulated or secret text to a third-party embedder without a contract, region, and retention review.
- Keep one embedding model per index; mixing models silently corrupts neighbor ranking.
- Strip secrets before chunking; embedding is not encryption.
- Rate-limit embedding APIs to slow inversion and extraction-style scraping.
- Log model ID, version, and chunk IDs used to produce stored vectors.
- Re-embed after model upgrades; old and new spaces are not interchangeable.
- Include embedding APIs and indexes in data-protection impact assessments.
The practical takeaway
An embedding is a numeric stand-in for meaning. It makes semantic search possible and turns documents into geometry that RAG can query.
Treat embeddings as sensitive derived data: same classification as the source, same access rules in the index, and no casual shipping of private chunks to an unknown model API. A vector is not a hash, and it is not a safe anonymization of the original text.
Related security terms
Vector Database
The index that stores embeddings and returns nearest neighbors.
Retrieval-Augmented Generation (RAG)
Uses query and document embeddings to select prompt context.
Vector and Embedding Weaknesses
The OWASP class covering insecure embedding pipelines.
Model Inversion
Attacks that reconstruct information from model outputs, including embeddings.
Large Language Model (LLM)
Often paired with a separate embedding model for retrieval.
Frequently asked questions
What is an embedding in simple terms?
It is a list of numbers that stands in for a sentence or document. Items with similar meaning get similar numbers, so search can match ideas instead of exact words.
Is an embedding the same as an LLM?
No. An LLM generates tokens. An embedding model maps input to a vector and usually stops there. Some products expose both from one vendor, but they are different jobs.
Can you recover the original text from an embedding?
Not as a lossless copy, but research on embedding inversion shows that topics, names, and even approximate sentences can sometimes be reconstructed, especially with access to the embedding model.
Why do embeddings need access control?
They are derived from source documents. If an API lets anyone embed and compare private corpora, they can probe what is in the index without opening the files in the UI.
Should you embed secrets and passwords?
No. Secrets should not be in searchable chunks at all. Embedding a password or API key still places sensitive material in logs, indexes, and vendor APIs.
Do different embedding models share a space?
Generally no. Vectors from model A are not comparable to model B. Mixing models silently breaks retrieval and can hide failed access filters behind nonsense neighbors.
How do attackers abuse embeddings?
They poison documents so their vectors rank highly, query indexes to map private topics, or steal embedding-model access to invert or extract training-like content.
References
Explore authoritative guidance and frameworks related to embedding.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.