AI

Inverting Multi-Vector Visual Document Indices

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 08/10/2026, 03:18:25 UTC.

Briefings

A research paper published in October 2026 describes a vulnerability where attackers can reconstruct visual documents from multi-vector retrieval indices. Using the ViDoRe v3 benchmark, the study found that raw indices recover 47% of words and 45% of sensitive tokens. The attack works by predicting the encoder, page shape, and vector order. Simple protections like token pooling or shuffling significantly reduce word recall to around 8%. A model restoring shuffled index order ranks source pages first 93.5% of the time, whereas inverted pooled indices remain vulnerable.

Key points

• Attackers can reconstruct visual documents from multi-vector retrieval indices by predicting the encoder, page shape, and vector order.
• Simple protections like token pooling or shuffling significantly reduce word recall to around 8% on the ViDoRe v3 benchmark.

Context

Multi-vector visual document retrievers store each page as approximately a thousand patch vectors, often in vector databases run by third parties. Since no one can read a page directly from its vectors, the index is treated as less sensitive than the page itself. However, because the index keeps one vector per patch in raster order and each vector is computed by a vision-language model pre-trained to read documents, the researchers hypothesize that whoever runs or breaches the store can reproduce a page from its index alone.

Limitations

The study uses the ViDoRe v3 benchmark and applies the attack unchanged to another multi-vector retriever. Word recall and ranking performance vary significantly between datasets and retrievers. The research is presented as a preprint with uncertainty regarding generalization across different systems and the effectiveness of proposed protections.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 04/11/2026, 11:12:53 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeiguli6d47zsw2eoiz43ch4uic4mhuygkgci2ta32pwpzehm2vhgia