Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries
This work addresses privacy vulnerabilities in embedding technologies for users of AI systems, representing an incremental advance by extending attacks to more realistic scenarios without model queries.
The study tackled the problem of privacy risks in text embeddings by developing a transfer attack method that infers sensitive information without direct model access, achieving significant performance improvements over traditional methods in experiments across various models and a clinical dataset.
This study investigates the privacy risks associated with text embeddings, focusing on the scenario where attackers cannot access the original embedding model. Contrary to previous research requiring direct model access, we explore a more realistic threat model by developing a transfer attack method. This approach uses a surrogate model to mimic the victim model's behavior, allowing the attacker to infer sensitive information from text embeddings without direct access. Our experiments across various embedding models and a clinical dataset demonstrate that our transfer attack significantly outperforms traditional methods, revealing the potential privacy vulnerabilities in embedding technologies and emphasizing the need for enhanced security measures.