Recommender embeddings give away the items they encode
Reviewing Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems · Linda Beková and Rodrigo Alves
Researchers show that the language embeddings recommenders use to describe items can be matched back to real titles with a simple similarity search against public text. Those identified items can then help re-identify users from a few ratings, and rewriting descriptions to hide them reduces the leak but does not remove it.
Take the vector a recommender uses to describe a film. It is a list of numbers and looks meaningless. Embed a plot summary from a public catalogue with the same model, compare the two, and the film's name falls out. What surprised me in this research is how little the attacker has to do.
Recommenders increasingly turn item text into language embeddings. A pretrained sentence encoder reads a title and description and produces a vector, so items with similar content land close together. That is the point: the system can suggest a book because it reads like one you rated. These vectors are often assumed to be opaque, so they get shared or exposed in pipelines.
The researchers' attacker takes the same off-the-shelf encoder and embeds item text gathered from elsewhere. It then ranks every candidate by cosine similarity to the victim vector. There is no training and no model inversion. Across six encoders and two real datasets, films from MovieLens and books from GoodReads, the true identity tends to land at or near the top.
This is a dictionary attack. You cannot reverse the hash, so you hash every likely input and look for a match. The idea is old; the target is new. The encoder is built to place similar meaning close together, so it does the attacker's work.
Rewriting the text does not hide the meaning
Leakage is strongest when the attacker's text overlaps the victim's, such as a shared title. The more interesting finding is that it persists when descriptions come from entirely different sources, including ones generated by another language model. The encoder captures what an item is about, not just its words.
Then it reaches people. Once items have names, a handful of sparse ratings is often enough to rank the true user highly. Item leakage becomes user re-identification.
The researchers tested one defence: having a language model rewrite descriptions to obscure them before embedding. Credit where due: it sharply cuts attacks that lean on titles. Attacks matching on descriptions still recover a mean reciprocal rank of roughly 0.32 to 0.51. Put plainly, the right item still usually sits within the first few guesses. The rewritten text also makes recommendations worse. Only one model and one prompting approach were tried, and there was no attacker tuned to the rewrites.
The preconditions are real. The attacker needs access to the vectors, a catalogue of candidates and knowledge of the encoder. That last one is weaker than it sounds. The models are off the shelf, and a preliminary probe suggests the encoder can be picked out by reconstruction error. The work covers two domains, both with large public catalogues.
If you expose item embeddings through an API or ship them to clients, treat them as the text they came from. Embedding is not encryption.
Further analysis
Problem
The paper studies whether item-level language embeddings exposed by recommender systems can reveal the actual identities of items when an adversary has access to auxiliary item text from external sources. This matters because language embeddings are increasingly shared or accessible in recommender pipelines and are often assumed to be opaque, yet public catalogues and domain knowledge may enable inference attacks that compromise item privacy and, indirectly, user privacy.
Approach
The authors formalise an adversary that knows the embedding function and builds an auxiliary labelled corpus of item texts. Victim items are represented by embeddings produced by a pretrained sentence-transformer. The attacker embeds auxiliary texts with the same encoder and ranks candidate identities by a scoring function, instantiated as cosine similarity. Experiments use six off-the-shelf sentence-transformer models, two domains (MovieLens 32M and GoodReads), and victim corpora formed from descriptions or titles plus descriptions. The attacker corpus includes title-only and generated descriptions produced with gpt-oss-20b; obfuscated descriptions are also generated with gpt-oss-20b to evaluate mitigation. Candidate-set regimes model closed and open catalogues with varying sizes. Identity recovery is measured by mean reciprocal rank, and the utility impact of obfuscation is measured on downstream recommendation via RMSE and Spearman correlation. The study also adapts a sparse-rating re-identification task to assess propagation of item leakage to user privacy.
Key Findings
- Simple cosine-similarity matching recovers item identities with substantial mean reciprocal rank across datasets, encoder models, and candidate-set sizes, showing the embedding space preserves identity-relevant information.
- Leakage is strongest when the adversary’s text partially overlaps with the victim representation, for example when titles are available, but significant leakage also occurs through semantic alignment when descriptions differ in source.
- Performance degrades only modestly as the candidate catalogue grows, indicating leakage is not confined to tiny item sets.
- Obfuscating descriptions substantially reduces title-driven leakage; title-only auxiliary attacks see MRR drop to roughly 0.06–0.17 across models and settings, but description-based auxiliary attacks still yield non-negligible MRR around 0.32–0.51, so obfuscation does not eliminate identity signals.
- Obfuscation produces a clear leakage–utility tradeoff: item embeddings derived from obfuscated text increase RMSE and reduce Spearman correlation in downstream rating prediction and ranking tasks.
- Item-level leakage enables user re-identification from sparse ratings: a small number of observed rated items is often sufficient for the attacker to rank the true user highly, and description-based auxiliary data can maintain re-identification effectiveness even under obfuscation.
- Preliminary autoencoder probes indicate the attacker may be able to identify the victim encoder from a candidate set by reconstruction error, under the tested conditions.
Limitations
Experiments focus on two domains and six sentence-transformer encoders; results may not generalise to all languages, encoder families, or domains. The adversary is assumed to know or correctly identify the embedding function, and the principal attack is non-parametric cosine matching. Obfuscation is evaluated using a single generative model and prompt strategy. The work does not evaluate more sophisticated defences, nor does it prove impossibility of leakage under other transformations.
Implications
An attacker with access to a public catalogue or generated descriptions and knowledge of the encoder can map exposed item embeddings to real-world identities, then link sparse user ratings to recover user histories. Obfuscation can reduce but not remove this risk and harms recommendation quality, so attackers can exploit semantic alignment and partial overlaps to deanonymise items and, by extension, users. The findings highlight practical offensive paths for linking embeddings to external data and motivate stronger privacy-aware design and auditing of embedding-based recommender components.
The paper title, authors and abstract
Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems
Language embeddings are increasingly used in recommenders to represent item content, but their privacy risks remain poorly understood. We study whether item embeddings can reveal item identities when an adversary has access to auxiliary item text from external sources. We show that a simple cosine-similarity attack can recover item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets. Leakage is strongest when the adversary's partial information overlaps with the victim representation, but it also persists through semantic alignment between independently sourced descriptions. We further show that item leakage can propagate to user re-identification from sparse ratings. Finally, we evaluate obfuscated descriptions as a mitigation and find a clear leakage-utility tradeoff.
