A few months ago I built a way to search documents by meaning while keeping the embeddings hidden — even from the server doing the search. I called it ZATRON.
The obvious question everyone (including me) kept asking was: does it actually hide anything, or does it just look scrambled?
Scrambled-looking isn't the same as secure. So instead of trusting a correlation number, I did the thing that actually scares me: I trained a neural network to break it.
This post is the honest write-up — including the part where I tried hard to make the attack win.
The setup
