mlsanityData to 7 Oct 2026

Universal Zero-shot Embedding Inversion

arXiv 2504.00147 ↗First posted 31 Mar 2025cs.CL cs.CRcited by 8

Not on the map. Why?

Abstract (arXiv)

Embedding inversion, i.e., reconstructing text given its embedding and black-box access to the embedding encoder, is a fundamental problem in both NLP and security. From the NLP perspective, it helps determine how much semantic information about the input is retained in the embedding. From the security perspective, it measures how much information is leaked by vector databases and embedding-based retrieval systems. State-of-the-art methods for embedding inversion, such as vec2text, have high accuracy but require (a) training a separate model for each embedding, and (b) a large number of queries to the corresponding encoder. We design, implement, and evaluate ZSInvert, a zero-shot inversion method based on the recently proposed adversarial decoding technique. ZSInvert is fast, query-efficient, and can be used for any text embedding without training an embedding-specific inversion model. We measure the effectiveness of ZSInvert on several embeddings and demonstrate that it recovers key semantic information about the corresponding texts.

Key facts. Cited by 8 papers in the map (data through 7 Oct 2026). Builds on 19 of its 23 references that are in the map. First posted on arXiv 31 Mar 2025.

Builds on

19 of 23 references.

References · 19

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2024Qwen2.5 Technical Reportcited by 4,713
  3. 2021Unsupervised Dense Information Retrieval with Contrastive Learningcited by 1,203
  4. 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 705
  5. 2021Large Dual Encoders Are Generalizable Retrieverscited by 454
  6. 2024LLM2Vec: Large Language Models Are Secretly Powerful Text Encoderscited by 396
  7. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Modelscited by 251
  8. 2020Information Leakage in Embedding Modelscited by 199
  9. 2023Text Embeddings Reveal (Almost) As Much As Textcited by 189
  10. 2024Stealing Part of a Production Language Modelcited by 152
  11. 2024From Decoding to Meta-Generation: Inference-time Algorithms for Large Language Modelscited by 136
  12. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 102
7 more
  1. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documentscited by 93
  2. 2024Fast Adversarial Attacks on Language Models In One GPU Minutecited by 85
  3. 2023Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentencecited by 81
  4. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generationcited by 46
  5. 2024Extracting Prompts by Inverting LLM Outputscited by 40
  6. 2024Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queriescited by 25
  7. 2024Adversarial Decoding: Generating Readable Documents for Adversarial Objectivescited by 16

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 6.

8 papers.

  1. 2025Harnessing the Universal Geometry of Embeddingscited by 54
  2. 2026Expert Selections In MoE Models Reveal (Almost) As Much As Textcited by 6
  3. 2026Hybrid privacy-aware semantic search: SVD-truncated document geometry and CKKS-encrypted query reranking under a restricted threat modelcited by 1
  4. 2026Pointing the Way, Hiding the Destination: Practical Private Dense Retrieval at Scalecited by 1
  5. 2025ObCLIP: Oblivious CLoud-Device Hybrid Image Generation with Privacy Preservationcited by 0
  6. 2026SHARD: cell-keyed residual splitting for alignment-resistant private dense retrievalcited by 0
  7. 2026Denoising-Aware Inversion: Revealing Privacy Risks in Noise-Protected Text Embeddingscited by 0
  8. 2026Learning to Refer: Client-Resolved Generation for Privacy-Aware Language Modelscited by 0