无需训练即可攻击文本嵌入，跨领域恢复原始句子。
Zero2Text: Zero-Training Cross-Domain Inversion Attacks on Textual Embeddings
- 利用大模型先验与动态岭回归实现零训练在线对齐
- 在MS MARCO上比基线ROUGE-L高1.8倍，BLEU-2高6.4倍
- 适用于黑盒场景，适合研究隐私安全的学者
检索增强生成（RAG）的普及使向量数据库成为关键基础设施，但也带来了嵌入逆向攻击的严重隐私风险。现有方法存在根本性权衡：基于优化的方法需大量计算查询，基于对齐的方法依赖可获取的域内训练数据。这些限制使其在严格黑盒和跨域场景下失效。为此，我们提出Zero2Text，一种基于递归在线对齐的零训练框架。不同于依赖静态数据集的方法，Zero2Text结合大语言模型先验与动态岭回归机制，在生成过程中实时对齐目标嵌入。我们进一步证明，差分隐私等标准防御措施无法有效缓解这一自适应威胁。在多种基准上的广泛实验验证了Zero2Text的有效性；尤其在针对OpenAI受害模型的MS MARCO数据集上，其ROUGE-L得分比基线高1.8倍，BLEU-2得分高6.4倍，可在无任何泄露数据对的情况下从未知域恢复句子。
原文摘要 · Abstract (English)
The proliferation of retrieval-augmented generation (RAG) has established vector databases as critical infrastructure, yet they introduce severe privacy risks via embedding inversion attacks. Existing paradigms face a fundamental trade-off: optimization-based methods require computationally prohibitive queries, while alignment-based approaches hinge on the unrealistic assumption of accessible in-domain training data. These constraints render them ineffective in strict black-box and cross-domain settings. To dismantle these barriers, we introduce Zero2Text, a novel training-free framework based on recursive online alignment. Unlike methods relying on static datasets, Zero2Text synergizes LLM priors with a dynamic ridge regression mechanism to iteratively align generation to the target embedding on-the-fly. We further demonstrate that standard defenses, such as differential privacy, fail to effectively mitigate this adaptive threat. Extensive experiments across diverse benchmarks validate Zero2Text; notably, on MS MARCO against the OpenAI victim model, it achieves 1.8x higher ROUGE-L and 6.4x higher BLEU-2 scores compared to baselines, recovering sentences from unknown domains without a single leaked data pair.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。