8-bit Quantization Provides No Privacy Benefit Against Training-Free Embedding Inversion

Abstract

Text embeddings enable efficient retrieval but leak private information through inversion attacks that reconstruct original text. Quantization is widely deployed for storage efficiency---does it also provide privacy protection? We present the first utility-matched evaluation of 8-bit quantization against ZSInvert, a training-free inversion attack. By calibrating Gaussian noise to match quantization's retrieval utility (nDCG@10 $\approx$ 0.544), we isolate privacy effects from utility differences. Our key finding is surprising: quantization provides negligible privacy benefit, achieving only 6% relative reduction in attribute recovery (Canary-EM: 6.0% vs 6.4%) compared to 70% reduction for noise (1.9%). Geometric analysis reveals the mechanism: quantization preserves the cosine similarity structure that ZSInvert exploits (0.9° angular deviation, pairwise $\rho$=0.9999), while noise disrupts it (41.5° deviation, $\rho$=0.656). Practitioners should not rely on quantization for privacy; efficiency and privacy require separate, explicit mechanisms.