DNA foundation models --- DNABERT-2, Evo 2, Nucleotide Transformer v2 --- advertise embeddings as privacy-preserving representations of genomic sequences, but decoder networks fed zero-shot per-token embeddings achieve near-perfect sequence reconstruction across all three models. Mean-pooled embeddings degrade with sequence length but substantially exceed random baselines. Evo 2 and NTv2 are most vulnerable, with reconstruction similarities exceeding 90% for short sequences, while DNABERT-2's byte-pair encoding tokenization provides partial protection. The fundamental vulnerability traces to a correlation between embedding similarity and sequence similarity --- the very property that makes embeddings useful for downstream tasks is precisely what makes them invertible.
Embeddings-as-a-Service platforms rest on an implicit assumption that dense vector representations obscure their inputs. For natural language, this assumption has already been challenged; for genomic data --- where the sequences are finite-alphabet, the stakes are medical, and the identifiability is permanent --- the failure is more consequential. The attack does not require access to the model architecture or weights, only to the embeddings themselves. BPE tokenization's partial resistance is informative: it breaks the one-to-one mapping between positions and tokens, introducing a combinatorial barrier that character-level and k-mer tokenizations lack. The protection is accidental --- a side effect of compression, not a privacy design.
The utility-privacy tension in representation learning is not a tradeoff to be optimized but a structural constraint: any embedding that preserves task-relevant information preserves reconstruction-relevant information, because the two are the same information viewed from different directions. The only embeddings that are truly private are the ones that have destroyed the signal --- and those are useless. Every claim that a transformation “preserves utility while ensuring privacy” must specify exactly which dimensions of utility are orthogonal to which dimensions of identity, and for genomic data, that orthogonality does not exist.
(arXiv:2603.06950)