A vector of your words

An embedding is what a model makes when it reads your sentence and hands back a list of numbers. The industry has spent a decade treating that list as a shadow of the text, safe to persist where the text is not, safe to sync where the text is not, safe to hand to a vendor under terms the text would never have passed. In 2023 Morris, Kuleshov, Shmatikov, and Rush published the experiment that ends the assumption. They framed inversion as controlled generation, producing text that lands close to a fixed point in the same latent space, and a method that iteratively corrects its guess and re-embeds it recovered 92 percent of 32-token text inputs exactly. Not the gist of them. The inputs. On a corpus of clinical notes the same method pulled back full names.

The instinct that mislabeled the vector was an analogy to hashing, and the analogy is wrong at the only place it mattered. A hash destroys its input and keeps a fingerprint, which is why a password hash can sit in a breach dump and still protect something. An embedding preserves enough of the source to support reconstruction, because preserving meaning is the entire job it was trained for, and a representation faithful enough to retrieve a document is faithful enough to rebuild it. So the vector is a second copy of the words rather than an abstraction of them, and a second copy inherits every restriction that attached to the first.

Once that lands, the rules stop being a matter of policy preference and start falling out of arithmetic. Our own embedding policy names embeddings derived from a person’s content as content-bearing derived data and handles them at the sensitivity of their source, which is the only classification the inversion result permits. Hard deletion of a source has to remove the vectors derived from it, or the deletion was a gesture performed on one copy while another sat in an index answering queries. Every persisted vector has to record which model made it, because a vector without model identity cannot be reasoned about, revoked coherently, or reproduced. And the part we find most instructive is the refusal that follows: vectorization of core message and artifact content stays blocked in our platform until the purge behavior is built and tested, rather than shipping the capability first and building the deletion path once someone asks for it.

That ordering is the whole rule, and it generalizes past embeddings to every derivative a system is tempted to make. Summaries, classifications, extracted entities, behavioral profiles, and fine-tuning corpora are all derivatives whose relationship to a deletion request is exactly as strong as the engineering that connects them back to a source row. If the derivative cannot be deleted, it must not be created, because creating it converts a reversible act into a permanent one on someone else’s behalf and without telling them. Most systems have this backwards; they build the derivative because it is cheap and discover the deletion problem when a person exercises a right, at which point the honest answer is that the right cannot be honored and the dishonest answer is much easier to give. The discipline is small and it is available to anyone building today. Before you derive anything from a person’s words, write down how it dies, and if you cannot, you have just learned something true about what you were about to build.