Embedding Obfuscation

A method where embeddings are transformed using a secret key known only to authorized parties. Legitimate queries are encoded with the same key, allowing accurate similarity search in the obfuscated space. Unauthorized users without the key see only noise.

• Mechanism: Applies a random orthogonal rotation or isometric transformation to the vector space.
• Property: Distance and inner product relationships are perfectly preserved for key-holders.
• Use Case: Secure multi-tenant vector databases where data must remain opaque to the infrastructure provider.

A technique that adds calibrated random noise to an embedding to irreversibly degrade its semantic precision. This prevents an attacker from performing exact membership inference or reconstruction attacks, while still allowing approximate similarity search.

• Mechanism: Adds Laplacian or Gaussian noise drawn from a distribution calibrated to the sensitivity of the data.
• Trade-off: A direct, tunable balance between privacy budget (ε) and search accuracy.
• Foundation: Directly implements principles of Differential Privacy at the vector level.

Embeds the original vector into a higher-dimensional space with a random projection matrix, then applies a non-linear activation. The resulting vector's geometry is scrambled, making the original semantic direction unrecoverable without the inverse projection.

• Mechanism: Uses a sparse random matrix to project a d-dimensional vector into a D-dimensional space (D > d).
• Security: Recovery is equivalent to solving an underdetermined system of equations.
• Benefit: Can be combined with secret-key rotation for time-based access revocation.

Applies a small, carefully crafted perturbation to the embedding that is imperceptible in terms of utility but maximally disruptive to unauthorized semantic decoders or attribute classifiers.

• Mechanism: Uses adversarial machine learning to generate a perturbation that maximizes the loss of a pre-trained attribute inference model.
• Target: Specifically designed to defeat Attribute Inference Attacks that try to deduce sensitive metadata from the vector.
• Analogy: A targeted adversarial attack used as a defensive shield.

Encodes the embedding into a cryptographic ciphertext that supports mathematical operations. Similarity comparisons are performed directly on the encrypted data, and only the final result is decrypted by the authorized user.

• Mechanism: Leverages Fully Homomorphic Encryption (FHE) or Secure Multi-Party Computation (SMPC) schemes.
• Security Guarantee: The vector is never exposed in plaintext to the server performing the search.
• Constraint: Currently incurs significant computational overhead, making it suitable for low-latency, high-value queries.

Identifies and surgically removes or replaces the specific dimensions in an embedding that encode a sensitive attribute (e.g., author identity, sentiment), while preserving the dimensions encoding the core semantic content.

• Mechanism: Uses linear classifiers to identify the subspace corresponding to a sensitive concept, then projects the vector to nullify that subspace.
• Goal: Achieve Attribute Obfuscation without adding noise to the primary semantic signal.
• Challenge: Requires precise identification of the sensitive subspace, which can be entangled with useful features.