攻击者可逆推句子嵌入，暴露训练数据中的敏感信息
Information Leakage of Sentence Embeddings via Generative Embedding Inversion Attacks
- 通过比较掩码与原始数据的对数似然差异，实现嵌入逆向攻击
- 在多个主流模型上成功还原出训练数据中的关键语义内容
- 无需修改攻击架构，适用于评估嵌入模型的安全性
文本常被编码为密集向量（即嵌入），以捕捉语义、语法、上下文及领域特定信息。这些嵌入广泛用于各类应用，但可能在特定攻击下存在信息泄露风险。本文复现了GEIA框架的发现，验证了句子嵌入易被逆向还原为原句。进一步分析表明，这些模型会泄露其训练数据中的敏感信息。我们提出一种简单有效的方法，无需修改原攻击架构，仅通过在攻击者嵌入空间中计算掩码与原始数据的对数似然差，即可恢复出主流模型预训练知识中的有意义敏感内容，严重威胁嵌入模型安全性。代码已开源：https://github.com/taslanidis/GEIA
原文摘要 · Abstract (English)
Text data are often encoded as dense vectors, known as embeddings, which capture semantic, syntactic, contextual, and domain-specific information. These embeddings, widely adopted in various applications, inherently contain rich information that may be susceptible to leakage under certain attacks. The GEIA framework highlights vulnerabilities in sentence embeddings, demonstrating that they can reveal the original sentences they represent. In this study, we reproduce GEIA's findings across various neural sentence embedding models. Additionally, we contribute new analysis to examine whether these models leak sensitive information from their training datasets. We propose a simple yet effective method without any modification to the attacker's architecture proposed in GEIA. The key idea is to examine differences between log-likelihood for masked and original variants of data that sentence embedding models have been pre-trained on, calculated on the embedding space of the attacker. Our findings indicate that following our approach, an adversary party can recover meaningful sensitive information related to the pre-training knowledge of the popular models used for creating sentence embeddings, seriously undermining their security. Our code is available on: https://github.com/taslanidis/GEIA
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。