Eguard: Defending LLM Embeddings Against Inversion Attacks via Text Mutual Information Optimization

TL;DR

Eguard is a novel defense method that uses transformer-based projection and mutual information optimization to protect LLM embeddings from inversion attacks without sacrificing task performance.

Contribution

The paper introduces Eguard, a new approach combining transformer projections and mutual information optimization to defend against embedding inversion attacks in LLMs.

Findings

Protects over 95% of tokens from inversion attacks

Maintains high downstream task performance

Reduces privacy leakage effectively

Abstract

Embeddings have become a cornerstone in the functionality of large language models (LLMs) due to their ability to transform text data into rich, dense numerical representations that capture semantic and syntactic properties. These embedding vector databases serve as the long-term memory of LLMs, enabling efficient handling of a wide range of natural language processing tasks. However, the surge in popularity of embedding vector databases in LLMs has been accompanied by significant concerns about privacy leakage. Embedding vector databases are particularly vulnerable to embedding inversion attacks, where adversaries can exploit the embeddings to reverse-engineer and extract sensitive information from the original text data. Existing defense mechanisms have shown limitations, often struggling to balance security with the performance of downstream tasks. To address these challenges, we introduce Eguard, a novel defense mechanism designed to mitigate embedding inversion attacks. Eguard employs a transformer-based projection network and text mutual information optimization to safeguard embeddings while preserving the utility of LLMs. Our approach significantly reduces privacy risks, protecting over 95% of tokens from inversion while maintaining high performance across downstream tasks consistent with original embeddings.