mlsanityData to 7 Oct 2026

Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence

arXiv 2305.03010 ↗First posted 4 May 2023cs.CL cs.CRcited by 81

Not on the map. Why?

Abstract (arXiv)

Sentence-level representations are beneficial for various natural language processing tasks. It is commonly believed that vector representations can capture rich linguistic properties. Currently, large language models (LMs) achieve state-of-the-art performance on sentence embedding. However, some recent works suggest that vector representations from LMs can cause information leakage. In this work, we further investigate the information leakage issue and propose a generative embedding inversion attack (GEIA) that aims to reconstruct input sequences based only on their sentence embeddings. Given the black-box access to a language model, we treat sentence embeddings as initial tokens' representations and train or fine-tune a powerful decoder model to decode the whole sequences directly. We conduct extensive experiments to demonstrate that our generative inversion attack outperforms previous embedding inversion attacks in classification metrics and generates coherent and contextually similar sentences as the original inputs.

Key facts. Cited by 81 papers in the map (data through 7 Oct 2026). Builds on 33 of its 46 references that are in the map. First posted on arXiv 4 May 2023.

Builds on

33 of 46 references.

References · 33

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
  3. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  4. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  5. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  6. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,115
  7. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  8. 2015Neural Machine Translation of Rare Words with Subword Unitscited by 2,898
  9. 2019The Curious Case of Neural Text Degenerationcited by 2,881
  10. 2016Categorical Reparameterization with Gumbel-Softmaxcited by 2,708
  11. 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,665
  12. 2014Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modelingcited by 2,341
21 more
  1. 2021SimCSE: Simple Contrastive Learning of Sentence Embeddingscited by 2,168
  2. 2020Extracting Training Data from Large Language Modelscited by 2,144
  3. 2019Deep Leakage from Gradientscited by 1,004
  4. 2017SemEval-2017 Task 1: Semantic Textual Similarity - Multilingual and Cross-lingual Focused Evaluationcited by 998
  5. 2020MPNet: Masked and Permuted Pre-training for Language Understandingcited by 973
  6. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  7. 2018Personalizing Dialogue Agents: I have a dog, do you have pets too?cited by 820
  8. 2018MultiWOZ -- A Large-Scale Multi-Domain Wizard-of-Oz Dataset for Task-Oriented Dialogue Modellingcited by 760
  9. 2020Stanza: A Python Natural Language Processing Toolkit for Many Human Languagescited by 719
  10. 2021Sentence-T5: Scalable Sentence Encoders from Pre-trained Text-to-Text Modelscited by 462
  11. 2020iDLG: Improved Deep Leakage from Gradientscited by 367
  12. 2015Skip-Thought Vectorscited by 321
  13. 2018SentEval: An Evaluation Toolkit for Universal Sentence Representationscited by 294
  14. 2020Information Leakage in Embedding Modelscited by 199
  15. 2017Machine Learning Models that Remember Too Muchcited by 165
  16. 2016Learning Distributed Representations of Sentences from Unlabelled Datacited by 90
  17. 2021Action-Based Conversations Dataset: A Corpus for Building More In-Depth Task-Oriented Dialogue Systemscited by 73
  18. 2022Recovering Private Text in Federated Learning of Language Modelscited by 67
  19. 2017Loss Functions for Multiset Predictioncited by 6
  20. 2016Learning Generic Sentence Representations Using Convolutional Neural Networkscited by 5
  21. 2018Learning Universal Sentence Representations with Mean-Max Attention Autoencodercited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 4; 2024: 23; 2025: 25; 2026: 29.

81 papers.

Sort:

By area:

  1. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
  2. 2024xRAG: Extreme Context Compression for Retrieval-augmented Generation with One Tokencited by 123
  3. 2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 122
  4. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  5. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasurescited by 93
  6. 2023Language Model Inversioncited by 66
  7. 2025Harnessing the Universal Geometry of Embeddingscited by 54
  8. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  9. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  10. 2023PrivLM-Bench: A Multi-level Privacy Evaluation Benchmark for Language Modelscited by 35
  11. 2025MCIP: Protecting MCP Safety via Model Contextual Integrity Protocolcited by 33
  12. 2024Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defensescited by 30
38 more
  1. 2024PrivacyRestore: Privacy-Preserving Inference in Large Language Models via Privacy Removal and Restorationcited by 27
  2. 2024Text Embedding Inversion Security for Multilingual Language Modelscited by 26
  3. 2024Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queriescited by 25
  4. 2025Shadow in the Cache: Unveiling and Mitigating Privacy Risks of KV-cache in LLM Inferencecited by 19
  5. 2024RemoteRAG: A Privacy-Preserving LLM Cloud RAG Servicecited by 17
  6. 2024Privacy Checklist: Privacy Violation Detection Grounding on Contextual Integrity Theorycited by 15
  7. 2025Depth Gives a False Sense of Privacy: LLM Internal States Inversioncited by 14
  8. 2024No Free Lunch Theorem for Privacy-Preserving LLM Inferencecited by 13
  9. 2025LLM-Microscope: Uncovering the Hidden Role of Punctuation in Context Memory of Transformerscited by 12
  10. 2024Model Inversion Attacks: A Survey of Approaches and Countermeasurescited by 11
  11. 2024Information Leakage from Embedding in Large Language Modelscited by 10
  12. 2024Against All Odds: Overcoming Typology, Script, and Language Confusion in Multilingual Embedding Inversion Attackscited by 10
  13. 2025Better Language Model Inversion by Compactly Representing Next-Token Distributionscited by 9
  14. 2024Eguard: Defending LLM Embeddings Against Inversion Attacks via Text Mutual Information Optimizationcited by 8
  15. 2025Universal Zero-shot Embedding Inversioncited by 8
  16. 2024SecFormer: Fast and Accurate Privacy-Preserving Inference for Transformer Models via SMPCcited by 7
  17. 2024DORY: Deliberative Prompt Recovery for LLMcited by 7
  18. 2025Privacy-Preserving Federated Embedding Learning for Localized Retrieval-Augmented Generationcited by 7
  19. 2025Rep2Text: Decoding Full Text from a Single LLM Token Representationcited by 7
  20. 2024Privacy-preserving Fine-tuning of Large Language Models through Flatnesscited by 6
  21. 2024From Word Vectors to Multimodal Embeddings: Techniques, Applications, and Future Directions For Large Language Modelscited by 6
  22. 2025Memory Tokens: Large Language Models Can Generate Reversible Sentence Embeddingscited by 6
  23. 2025Privacy-Preserving LLM Embedding Transmission for End-Cloud Collaborationcited by 5
  24. 2024ObfuscaTune: Obfuscated Offsite Fine-tuning and Inference of Proprietary LLMs on Private Datasetscited by 4
  25. 2024Mitigating Paraphrase Attacks on Machine-Text Detectors via Paraphrase Inversioncited by 4
  26. 2025ALGEN: Few-shot Inversion Attacks on Textual Embeddings using Alignment and Generationcited by 4
  27. 2025VFLAIR-LLM: A Comprehensive Framework and Benchmark for Split Learning of LLMscited by 4
  28. 2026Zero2Text: Zero-Training Cross-Domain Inversion Attacks on Textual Embeddingscited by 4
  29. 2025On The Role of Pretrained Language Models in General-Purpose Text Embeddings: A Surveycited by 3
  30. 2024Understanding Privacy Risks of Embeddings Induced by Large Language Modelscited by 2
  31. 2024SecGenAI: Enhancing Security of Cloud-based Generative AI Applications within Australian Critical Technologies of National Interestcited by 2
  32. 2025NLP Security and Ethics, in the Wildcited by 2
  33. 2025An Attack to Break Permutation-Based Private Third-Party Inference Schemes for LLMscited by 2
  34. 2025Dense Retrievers Can Fail on Simple Queries: Revealing The Granularity Dilemma of Embeddingscited by 2
  35. 2025GPT, But Backwards: Exactly Inverting Language Model Outputscited by 2
  36. 2026Causally Disentangled Contrastive Learning for Multilingual Speaker Embeddingscited by 2
  37. 2026Concept-Aware Privacy Mechanisms for Defending Embedding Inversion Attackscited by 2
  38. 2026PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agentscited by 2

50 most cited of 81 All 81 (JSON)