Large language models increasingly rely on retrieval-augmented generation (RAG) and similar IR systems to inject domain knowledge via vector databases without costly retraining.
Vector databases typically store pre‑computed document embeddings, which are vulnerable to embedding inversion attacks (EIAs) that can reconstruct the original text. Existing defenses such as adding noise or scaling embeddings either provide limited privacy gains or severely degrade retrieval performance.
We introduce SHAQ (Shadow Query Generation), a defense based on semantic decomposition and embedding decoupling. The key insight is that EIAs exploit the strong coupling between an embedding and its source text. Instead of storing document embeddings directly, SHAQ uses a generative language model to produce diverse shadow queries that capture different semantic facets of each document. These queries are then encoded and stored in the vector database, thereby decomposing semantics and decoupling stored embeddings from the original text.
Experiments on several public IR benchmarks show that SHAQ reduces the recovery rate to 0.2104, protects up to 19.50% more tokens than baseline defenses, and achieves up to 0.7967 MAP@10 with a 5.53% utility improvement. The results demonstrate that semantic decomposition and embedding decoupling constitute an effective alternative to direct embedding modification for defending against EIAs.
In summary, SHAQ replaces raw embeddings with a set of generated shadow queries, preserving retrieval quality while substantially enhancing privacy, and offers a new direction for securing vector‑database‑based retrieval.
Review