Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries

TL;DR

This paper presents a transfer attack method that uncovers privacy vulnerabilities in text embeddings without direct access to the original model, highlighting significant security concerns.

Contribution

It introduces a novel transfer attack approach that infers sensitive information from text embeddings using a surrogate model, without requiring direct model queries.

Findings

Transfer attack outperforms traditional methods across models.

Demonstrates privacy risks in text embedding technologies.

Effective on clinical datasets.

Abstract

This study investigates the privacy risks associated with text embeddings, focusing on the scenario where attackers cannot access the original embedding model. Contrary to previous research requiring direct model access, we explore a more realistic threat model by developing a transfer attack method. This approach uses a surrogate model to mimic the victim model's behavior, allowing the attacker to infer sensitive information from text embeddings without direct access. Our experiments across various embedding models and a clinical dataset demonstrate that our transfer attack significantly outperforms traditional methods, revealing the potential privacy vulnerabilities in embedding technologies and emphasizing the need for enhanced security measures.