aiqbench analysis
This paper shows that language-model embeddings used in recommender systems can leak item identities, and even user identities, when an attacker has external text about items. A simple cosine-similarity attack achieves high recovery rates, so treating embeddings as anonymized or privacy-neutral is a risky assumption. The authors also find a clear tradeoff when obfuscating descriptions, so teams deploying these pipelines should weigh privacy protections against recommendation quality.
Encoded but Exposed: Language Embeddings can Reveal More Than They Should in Recommender Systems
arXiv:2610.21713v1 Announce Type: cross Abstract: Language embeddings are increasingly used in recommenders to represent item content, but their privacy risks remain poorly understood. We study whether item embeddings can reveal item identities when an adversary has access to auxiliary item text from external sources. We show that a simple cosine-similarity attack can recover item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets. Leakage is strongest when the adversary's partial information overlaps with the victim representation, but it also persists through semantic alignment between independently sourced descriptions. We further show that item leakage can propagate to user re-identification from sparse ratings. Finally, we evaluate obfuscated descriptions as a mitigation and find a clear leakage-utility tradeoff.
Abstract:Language embeddings are increasingly used in recommenders to represent item content, but their privacy risks remain poorly understood. We study whether item embeddings can reveal item identities when an adversary has access to auxiliary item text from external sources. We show that a simple cosine-similarity attack can recover item identities with high mean reciprocal rank across language models and candidate-set settings on two real-world datasets. Leakage is strongest when the adversary's partial information overlaps with the victim representation, but it also persists through semantic alignment between independently sourced descriptions. We further show that item leakage can propagate to user re-identification from sparse ratings. Finally, we evaluate obfuscated descriptions as a mitigation and find a clear leakage-utility tradeoff.
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2610.21713 [cs.CR]
(or arXiv:2610.21713v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2610.21713 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 215 words
Related coverage
MDLMPE: Distribution Aware Positional Encoding for Masked Diffusion Language Models
arXiv · Aug 6, 2026
RoPE is Dead, Long Live RoPE: Towards Scalable Data-aware Positional Encodings
arXiv · Sep 30, 2026
Vision-Language Models Suppress Female Representations Under Ambiguous Input
arXiv · Sep 1, 2026
Human-Grounded Calibration for Long-Text Image-Text Congruence in Vision-Language Models
arXiv · Sep 15, 2026