Embedding models in text retrieval systems leak identity through query behavior
The TellTail of Embeddings: Fingerprinting Retrievers in Black-Box Systems
Cryptography and Security
Summary
Text retrieval systems often use hidden embedding models to find relevant information, but users cannot see which model is being used. The authors show it is possible to guess which model powers a system only by looking at how it responds to certain queries. They developed TellTail, a method that can fingerprint these models by carefully crafting queries and comparing the results, even when only final answers are visible. This reveals that embedding models are not as secret as previously thought, which has implications for security and intellectual property.
What this means in practice
- •For security analysts: Detect which embedding model a retrieval system uses to identify potential security risks or plan targeted defenses.
- •For ai service providers: Verify whether deployed retrievers match claimed embedding models for compliance and intellectual property protection.
Authors
Abdullah Garra, Matan Ben-Tov, Mahmood Sharif
Abstract
Dense embedding models are core to modern text retrieval, enabling systems ranging from web search to retrieval-augmented generation (RAG). Yet, retrievers are usually deployed within opaque systems, exposing only ranked results, cited sources, or generated answers. This opacity prevents users from verifying which retrievers providers serve and may create a false sense of robustness against retrieval attacks. We show that attackers can infer retrievers' identity only through queries. We introduce TellTail, a fingerprinting attack for identifying retrievers behind black-box systems across a spectrum of access levels. Despite sharing many properties, retrievers can be steered to emit distinct results. When retrieved passages are exposed, TellTail compares retrieval overlap to deduce the underlying model. When only the final generated response is exposed, TellTail optimizes model-specific queries that induce a chosen retrieval behavior on the target retriever but transfer poorly to others. Interestingly, the poor transferability that limits attacks elsewhere is exactly what makes them useful for fingerprinting. We evaluate TellTail using 53 retrievers under three increasingly restrictive settings. TellTail perfectly identifies the deployed retriever from full retrieval rankings; in 94.3% of attempts with unordered top-3 results; and in 92.5% of cases from language-model-generated answers alone. Furthermore, fingerprinting succeeds against a popular RAG system (OpenWebUI). Overall, TellTail shows that retrieval-based systems leak the identity of their embedding model---exposing intellectual property and enabling reconnaissance ahead of model-specific attacks such as corpus poisoning.