arXiv:2507.07700cs.CLcs.IR2025-07中稿 · oral presentation …被引 7

文本嵌入可能泄露原始内容,需警惕隐私风险。

Rethinking the Privacy of Text Embeddings: A Reproducibility Study of "Text Embeddings Reveal (Almost) As Much As Text"

  • 复现并验证了从嵌入向量还原文本的方法有效性
  • 发现嵌入长度敏感且可被量化等技术缓解风险
  • 适合关注NLP隐私与安全的研究者阅读

文本嵌入广泛应用于推荐系统与信息检索等领域,传统认为传输嵌入而非原文可保护隐私。然而,如Vec2Text等方法表明,通过可控解码可成功重构原始文本。本文复现该框架,在域内与域外设置下均验证了其核心结果,仅因缺少模型检查点和数据划分导致微小差异。进一步开展参数敏感性分析,评估敏感输入(如密码)的可重构性,并探索嵌入量化作为轻量级隐私防御。结果表明,理想条件下该方法能还原无语义的密码类序列;但对输入长度敏感。高斯噪声与量化可缓解风险,其中量化更简单且适用性更广。研究强调使用嵌入时需谨慎,亟需构建鲁棒的隐私保护机制。

原文摘要 · Abstract (English)

Text embeddings are fundamental to many natural language processing (NLP) tasks, extensively applied in domains such as recommendation systems and information retrieval (IR). Traditionally, transmitting embeddings instead of raw text has been seen as privacy-preserving. However, recent methods such as Vec2Text challenge this assumption by demonstrating that controlled decoding can successfully reconstruct original texts from black-box embeddings. The unexpectedly strong results reported by Vec2Text motivated us to conduct further verification, particularly considering the typically non-intuitive and opaque structure of high-dimensional embedding spaces. In this work, we reproduce the Vec2Text framework and evaluate it from two perspectives: (1) validating the original claims, and (2) extending the study through targeted experiments. First, we successfully replicate the original key results in both in-domain and out-of-domain settings, with only minor discrepancies arising due to missing artifacts, such as model checkpoints and dataset splits. Furthermore, we extend the study by conducting a parameter sensitivity analysis, evaluating the feasibility of reconstructing sensitive inputs (e.g., passwords), and exploring embedding quantization as a lightweight privacy defense. Our results show that Vec2Text is effective under ideal conditions, capable of reconstructing even password-like sequences that lack clear semantics. However, we identify key limitations, including its sensitivity to input sequence length. We also find that Gaussian noise and quantization techniques can mitigate the privacy risks posed by Vec2Text, with quantization offering a simpler and more widely applicable solution. Our findings emphasize the need for caution in using text embeddings and highlight the importance of further research into robust defense mechanisms for NLP systems.

文本嵌入隐私安全还原攻击量化

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。