用文本嵌入反推原文，可高效制造误导性数据破坏检索系统
Does Vec2Text Pose a New Corpus Poisoning Threat?
- 通过嵌入逆向生成恶意文本，无需模型权重即可批量攻击
- 能在排名靠前位置注入对抗样本，严重威胁系统可靠性
- 适合研究检索安全与隐私防护的学者及工程师参考
Vec2Text是一种文本嵌入逆向方法，引发对密集检索系统隐私泄露的担忧。本文重新审视该技术在语料库投毒攻击中的威胁：攻击者利用文本嵌入重构原始文本，无需访问模型权重即可高效生成大量对抗性段落。理论上，其威胁程度远超以往方法。实验表明，在特定条件下，使用Vec2Text进行语料库投毒可将恶意内容置入检索结果前列，严重损害密集检索系统的完整性与用户体验。代码与数据已公开于https://github.com/ielab/vec2text-corpus-poisoning。
原文摘要 · Abstract (English)
The emergence of Vec2Text -- a method for text embedding inversion -- has raised serious privacy concerns for dense retrieval systems which use text embeddings. This threat comes from the ability for an attacker with access to embeddings to reconstruct the original text. In this paper, we take a new look at Vec2Text and investigate how much of a threat it poses to the different attacks of corpus poisoning, whereby an attacker injects adversarial passages into a retrieval corpus with the intention of misleading dense retrievers. Theoretically, Vec2Text is far more dangerous than previous attack methods because it does not need access to the embedding model's weights and it can efficiently generate many adversarial passages. We show that under certain conditions, corpus poisoning with Vec2Text can pose a serious threat to dense retriever system integrity and user experience by injecting adversarial passaged into top ranked positions. Code and data are made available at https://github.com/ielab/vec2text-corpus-poisoning
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。