Skip to content
AI Security

Interview question · LLM Application Security

Can embeddings leak information about their source text? What does that mean for how you store them?

The tempting answer is that embeddings are one-way hashes. They are not. The answer that scores explains inversion and protects the index like the documents.

hardNewPreparation tags: Google, Microsoft, PineconeUpdated Nov 2026

The tempting answer is that embeddings are one-way hashes. They are not. The answer that scores explains inversion and protects the index like the documents.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

signing in unlocks more free answers per topic

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A team stores embeddings of confidential documents in a vector database and says the text itself is not stored, so the index is low risk.

  1. Can embeddings reveal the original text?
  2. What if the vector store also keeps the text chunks as metadata?
  3. What if the vector database is shared across tenants?
  4. What if users request deletion of their data?
  5. What if a third-party embedding API is used?
  6. What controls would you require?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Sign in free to open it.

UP NEXT ON YOUR JOURNEY
Next in this trackHow should prompts, traces and logs in an LLM application handle personal data and secrets?Next in this trackShould LLM guardrails fail open or closed, and how do you handle their latency and cost?Next in this trackHow do you evaluate guardrails honestly, without optimising only for pass rate?
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.