BeamClean: Language Aware Embedding Reconstruction

2025/05/19 by Kaan Kale, Kyle Mylonakis, Kale, Kaan +5 · 1 citation
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Natural Language Processing Techniques

paper · pdf · doi:10.48550/arxiv.2505.13758

openalex publication_date 2025/05/19 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

In this work, we consider an inversion attack on the obfuscated input embeddings sent to a language model on a server, where the adversary has no access to the language model or the obfuscation mechanism and sees only the obfuscated embeddings along with the model's embedding table. We propose BeamClean, an inversion attack that jointly estimates the noise parameters and decodes token sequences by integrating a language-model prior. Against Laplacian and Gaussian obfuscation mechanisms, BeamClean always surpasses naive distance-based attacks. This work highlights the necessity for and robustness of more advanced learned, input-dependent methods.

Citations

• PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensembles
• A Split-and-Privatize Framework for Large Language Model Fine-Tuning
• Split-and-Denoise: Protect large language model inference with local differential privacy
• Text Embeddings Reveal (Almost) As Much As Text
• Efficient Memory Management for Large Language Model Serving with PagedAttention
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• Orca: Progressive Learning from Complex Explanation Traces of GPT-4
• Privacy-Preserving Parameter-Efficient Fine-Tuning for Large Language Model Services
• GPT-4 Technical Report
• Differentially Private Fine-tuning of Language Models
• Large Language Models Can Be Strong Differentially Private Learners
• InvBERT: Reconstructing Text from Contextualized Word Embeddings by inverting the BERT pipeline
• TEM: High Utility Metric Differential Privacy on Text
• A Differentially Private Text Perturbation Method Using a Regularized Mahalanobis Metric
• Privacy- and Utility-Preserving Textual Analysis via Calibrated\n Multivariate Perturbations
• GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understanding
• Universally Optimal Privacy Mechanisms for Minimax Agents
• Universally Utility-Maximizing Privacy Mechanisms

Cited by

• Learning Obfuscations Of LLM Embedding Sequences: Stained Glass Transform

Related

• Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence
• Hiding Behind Backdoors: Self-Obfuscation Against Generative Models
• Better Language Model Inversion by Compactly Representing Next-Token Distributions
• Information Leakage from Embedding in Large Language Models
• GPT, But Backwards: Exactly Inverting Language Model Outputs