ALGEN: Few-shot Inversion Attacks on Textual Embeddings using Alignment and Generation
Authors: Yiyi Chen, Qiongkai Xu, Johannes Bjerva
Accepted at: acl25

ALGEN: Few-shot Inversion Attacks on Textual Embeddings via Cross-Model Alignment and Generation

Yiyi Chen1, Qiongkai Xu2*, Johannes Bjerva1
1Department of Computer Science, Aalborg University, Copenhagen, Denmark
2School of Computing, FSE, Macquarie University, Sydney, Australia
yiyic@cs.aau.dk, qiongkai.xu@mq.edu.au, jbjerv@cs.aau.dk

Abstract
With the growing popularity of Large Language Models (LLMs) and vector databases, private textual data is increasingly processed and stored as numerical embeddings. However, recent studies have proven that such embeddings are vulnerable to inversion attacks, where original text is reconstructed to reveal sensitive information. Previous research has largely assumed access to millions of sentences to train attack models, e.g., through data leakage or nearly unrestricted API access. With our method, a single data point is sufficient for a partially successful inversion attack. With as little as 1k data samples, performance reaches an optimum across a range of black-box encoders, without training on leaked data. We present a Few-shot Textual Embedding Inversion Attack using Cross-Model ALignment and GENeration (ALGEN), by aligning victim embeddings to the attack space and using a generative model to reconstruct text. We find that ALGEN attacks can be effectively transferred across domains and languages, revealing key information. We further examine a variety of defense mechanisms against ALGEN, and find that none are effective, highlighting the vulnerabilities posed by inversion attacks. By significantly lowering the cost of inversion and proving that embedding spaces can be aligned through one-step optimization, we establish a new textual embedding inversion paradigm with broader applications for embedding alignment in NLP.1

1 Introduction
Large Language Models (LLMs) such as OpenAI’s GPT series (Radford, 2018; Radford et al., 2019; Brown et al., 2020; OpenAI et al., 2024) and Claude from Anthropic,2 have become essential across a wide range of applications, extending far beyond natural language processing (NLP). These models are deeply integrated into people’s daily lives and business operations, e.g., powering search engines, virtual assistants, and content generation. A critical component enabling the efficiency of these applications is vector databases (DB), which allow for fast and scalable retrieval and processing of high-dimensional vector representations. Companies such as Pinecone and Weaviate, provide vector DB services and build AI services on top of them.3 In a recent Google whitepaper on generative AI agents (Wiesinger et al., 2025), vector DBs are considered one of the essential components enabling such agents through external sources. Retrieval-augmented generation (RAG) is another common use case in leveraging vector DBs to generate more diverse and factually grounded responses (Lewis et al., 2020).

While applications such as these benefit from

Figure 1: An illustration of inversion attacks on textual embeddings stored in a vector DB, in scenarios where (I) a user exploits API access to extract excessive embeddings to train attack model; (II) a generative AI agent’s interaction channel with the DB is compromised; (III) the DB is misconfigured by an insider to expose private embeddings.

*Corresponding author.
1We open-source our code https://github.com/siebeniris/ALGEN.
2https://www.anthropic.com/clause
3https://www.pinecone.io, https://weaviate.io
vector DBs, the potential security and privacy risks permeate the process. Fig. 1 illustrates three separate threat scenarios where a vector DB can be exploited to expose private and sensitive information: (I) a malicious user exploits the model API to extract embeddings to train an attack model; (II) when an AI agent interacts with the DB, a malicious attacker can compromise the communication channel to intercept sensitive data; (III) a misconfigured vector DB may expose private data, either through access vulnerabilities or insider threats. The attacker can train an attack model (e.g. an embedding-to-text generator) to reconstruct text from intercepted embeddings, which might contain sensitive, private, or proprietary information. This so-called embedding inversion attack poses significant risks and potential harm.

Previous work has demonstrated the feasibility and detrimental effects of inversion attacks (Song and Raghunathan, 2020; Li et al., 2023). However, either a massive amount of intercepted (victim) embeddings and their texts are required for training an attack model (Morris et al., 2023), or the attack is conducted under white-box settings, where the model parameters and architecture are known to the attacker (Song and Raghunathan, 2020). Moreover, inversion attacks have been demonstrated to threaten multiple languages, especially lower-resource ones (Chen et al., 2024a,b).

We propose a Few-shot Textual Embedding Inversion Attack using Cross-Model ALignment and GENeration (ALGEN), to first align victim embeddings to the attack embedding space, and then reconstruct text from the aligned embeddings using the generative attack model. In contrast to previous work, we investigate inversion attacks using a small handful of samples – e.g., a Rouge-L score of 10 can be reached by leveraging a single leaked data point. Our work makes the following main contributions:

• We propose and verify the effectiveness of a novel few-shot inversion attack, which drastically reduces the cost and complexity of such attacks, making them plausible real-world threats.

• We demonstrate the transferability of the inversion attack across various languages, models and domains.

• We examine several established defense mechanisms, none of which are successful mitigation strategies for this attack, highlighting the new security and privacy vulnerabilities of embeddings in vector databases.

2 Related Work

2.1 Textual Embedding Inversion Attacks

Textual embedding inversion attack aims to learn the inversion function that reconstructs the original textual inputs given their embeddings. Song and Raghunathan (2020) demonstrates that it is possible to recover over half of the input words from a text embedding without preserving their order. Li et al. (2023) starts to treat the inversion attacks as a generation task, generating coherent and contextually similar sentences compared to the original text. Morris et al. (2023) adopts an iterative approach to train the attack model by parameterizing attack and hypothesis embeddings based on decoded text from the previous step, which results in exact matches between original and reconstructed text in certain settings. Huang et al. (2024) implements adversarial training to align victim embeddings to attack embeddings, making them not differentiable. Chen et al. (2024a,b) expand inversion attacks beyond English embeddings to multilingual spaces, leveraging linguistic typology to investigate inversion attack performance, finding that certain languages are particularly vulnerable.

However, all existing works in embedding inversion attacks require an enormous amount of data leakage to train the generative attack models, such as 100k samples for Li et al. (2023), 1-5 million for Morris et al. (2023); Chen et al. (2024a,b) and 8k for Huang et al. (2024). In comparison, our proposed approach ALGEN does not require training an attack model on leaked/private embeddings, and the inversion attack succeeds with few leaked data, we additionally experiment on multiple languages.

2.2 Embedding Alignment

Embedding alignment has continuously progressed in NLP with the development of embedding representations and LLMs. In the early stages, a common approach involved independently training monolingual word vectors (Mikolov et al., 2013b) and then learning a mapping between source and target language embeddings using a bilingual dictionary (Mikolov et al., 2013a; Smith et al., 2017; Artetxe et al., 2017). When this mapping is restricted to an orthogonal linear transformation, the optimal word pair alignment can be computed in
closed form (Artetxe et al., 2016; Schönemann, 1966). In contrast, Lample et al. (2018) introduce an unsupervised method for aligning word embedding spaces, incorporating cross-domain similarity adaptation to address the hubness problem.

With the advancement of contextualized embeddings since the emergence of LLMs such as BERT (Devlin, 2018), the focus shifted to the alignment of contextual word representations (Schuster et al., 2019; Aldarmaki and Diab, 2019; Wang et al., 2019b; Alqahtani et al., 2021; Cao et al., 2020; Jalili Sabet et al., 2020). Moreover, sentence embedding alignment has been operated in lifelong relation extraction with a linear transformation (Wang et al., 2019a), aligning encoders in different languages to evaluate crosslingual transfer (Conneau et al., 2018), aligning unsupervised multilingual sentence embeddings across languages to build parallel corpus (Kvapilíková et al., 2020), building parallel data for machine translation (Krahn et al., 2023), and further to improve information retrieval (Bhattarai et al., 2025; Yadav and McMillan, 2024).

In comparison, ALGEN aligns sentence embeddings from different models to conduct embedding inversion attacks, but it can also be applied in embedding alignment in general.

2.3 Mitigating Embedding Inversion Attacks

Most research on textual embedding inversion focuses on attacks (Li et al., 2023; Huang et al., 2024; Chen et al., 2024a). While Song and Raghunathan (2020) adopt an adversarial training approach to mitigate the risks of inversion attacks, this method is ineffective for defending textual embeddings in black-box settings. To defend against inversion attacks while maintaining embedding utility in downstream tasks, Morris et al. (2023) propose inserting Gaussian noise as a defense mechanism. Expanding inversion attacks into multilingual space using the same method, Chen et al. (2024b) find that Gaussian noise effectively protects monolingual embeddings but is less effective for multilingual ones.

Differential privacy (DP) limits the impact of individual element (Dwork et al., 2014), and has been shown to preserve the privacy of the extracted representation from text, when applied during model training (Lyu et al., 2020). To ensure sequence-level metric-based local DP, which can be employed during inference, a sentence embedding sanitization pipeline has been developed, maintaining non-private task accuracy and effectively thwarting privacy threats of membership inference attacks (Du et al., 2023). Pertinent to vector DBs, Watermarking EaaS with Linear Transformation (WET) introduces a method that applies linear transformations to embeddings to implant watermarks to counter paraphrasing vulnerabilities (Shetty et al., 2024).

In this work, we examine these defenses against ALGEN, and discuss the potentials and challenges of defending embeddings from inversion attacks.

![Three steps for Few-shot Inversion Attack, (1) Train a Local Embedding-to-Text Generation Model; (2) Transform victim embeddings \( e_V \) to the attack embeddings space \( A \) with matrix \( W \); and (3) Textual embedding inversion attack.](page_1012_172_388_246.png)

Figure 2: Three steps for Few-shot Inversion Attack, (1) Train a Local Embedding-to-Text Generation Model; (2) Transform victim embeddings \( e_V \) to the attack embeddings space \( A \) with matrix \( W \); and (3) Textual embedding inversion attack.

We explore a situation in which a malicious attacker gains access to a limited set of embeddings, and attempts to reconstruct private and sensitive text data. We propose ALGEN to circumvent the disadvantage of scarce data and leverage a pretrained encoder-decoder to align the victim embeddings to the attack space and reconstruct the texts. We note the victim and attack embedding spaces as \( V \) and \( A \), respectively. As illustrated in Fig. 2, the framework consists of three steps: (1) we train an embedding-to-sequence generation model by fine-tuning a pre-trained decoder \( dec_A(\cdot) \); (2) we align the embeddings from a black-box victim encoder \( e_V \) to attack embeddings in attacker’s model space \( e_A \); (3) the attacker leverages the capability of the generation model \( dec_A(\cdot) \) with the embedding alignment model \( W \) to reconstruct the original text from \( e_V \) to \( e_{V \rightarrow A} \) and finally to text.
3.1 Local Embedding-to-Text Generator
To train the local embedding-to-text generator, we use a publicly available text corpus, noted as \( D_L \). Given a sentence \( x \in D_L \), and attack encoder \( enc_A(\cdot) \), the token embeddings are obtained \( \mathbf{H} = enc_A(x) \in \mathbb{R}^{s \times n} \) where \( s \) is the sequence length and \( n \) the embedding dimension. The sentence embeddings are computed through mean pooling the last hidden embeddings \( e_A = \sum_{j=1}^s m_j H_j / \sum_{j=1}^s m_j \in \mathbb{R}^n \), where \( m \in \{0, 1\}^s \) is the attention mask for the sequence \( x \). Furthermore, L2 normalization is implemented on the sentence embeddings, i.e., \( e_A / \|e_A\| \) as sentence embedding normalization has proven beneficial in avoiding overfitting and inducing faster convergence in fine-tuning (Aboagye et al., 2022). The pre-trained decoder \( dec_A(\cdot) \), parameterized by \( \theta \), processes the embeddings to produce an output sequence \( \hat{x} = (\hat{x}_1, \hat{x}_2, \ldots, \hat{x}_s) \), where \( \hat{x}_i \) are tokens in the predicted output sequence. We train the embedding-to-text generator by fine-tuning \( dec_A(\cdot) \), by minimizing the cross-entropy loss:

\[
\mathcal{L}(\theta) = - \sum_{i=1}^s \log \mathbb{P}(\hat{x}_i|\hat{x}_{<i}, e_A; \theta),
\]

where \( \mathbb{P}(\hat{x}_i|\hat{x}_{<i}, e_A; \theta) \) is the probability of predicting token \( \hat{x}_i \) given the previous tokens \( \hat{x}_{<i} \) and the input sentence embeddings \( e_A \).

Notably, attackers can easily retrieve a large corpus \( D_L \) to train this generator model, as it operates independently of any victim models. The challenge of aligning victim semantics to target embedding space is addressed in the next subsection.

3.2 Embedding Space Alignment
Suppose there is a leaked data pair \( (\mathbf{X}, \mathbf{E}_V) \), given that \( \mathbf{X} \subseteq D_V \) is the victim dataset with \( b \in \mathbb{N} \) samples, and embedding matrix \( \mathbf{E}_V = enc_V(\mathbf{X}) \), where \( enc_V \) is the black-box victim encoder. To align the victim embeddings to the attack space \( A \), we obtain the embedding matrix \( \mathbf{E}_A = enc_A(\mathbf{X}) \) given the leaked text dataset, and seek a solution to solve the system

\[
\mathbf{E}_V \mathbf{W} \approx \mathbf{E}_A,
\]

and the best possible \( \mathbf{W} \in \mathbb{R}^{m \times n} \), given \( \mathbf{E}_V \in \mathbb{R}^{b \times m} \) and \( \mathbf{E}_A \in \mathbb{R}^{b \times n} \), where \( n \) and \( m \) are the regarding embedding dimensions of victim and attacker embeddings. While there is no exact solution to the system, our approach is to minimize their deviation, \( e = \mathbf{E}_A - \mathbf{E}_V \mathbf{W} \). Taking the square of the error by each sample, the objective is to minimize the following:

\[
\min_{\mathbf{W}} \sum_{i=1}^b \|e_A^i - e_V^i \cdot \mathbf{W}\|^2.
\]

The solution to this least squares loss is:

\[
\mathbf{W} = (\mathbf{E}_V^T \mathbf{E}_V)^{-1} \mathbf{E}_V^T \mathbf{E}_A,
\]

where \( (\mathbf{E}_V^T \mathbf{E}_V)^{-1} \mathbf{E}_V^T \) is the Moore-Penrose Inverse of \( \mathbf{E}_V \) (see the detailed derivation in Appendix A).

The aligned embedding from \( V \) to \( A \) is thus:

\[
\mathbf{E}_{V \to A} = \mathbf{E}_V \mathbf{W},
\]

where \( \mathbf{E}_{V \to A} \in \mathbb{R}^{b \times n} \). Implementing this alignment does not require any training; it is a one-step linear scaling. Moreover, aligning using \( D_V \) with a batch size \( b \) varying from 1 to 1,000, we observe that even with as few as 30 samples the Rouge-L score exceeds 20, and a reasonably successful attack can be initiated with only a single data point. The density distribution of the alignment transformation matrix \( \mathbf{W} \)'s weights of encoders remains consistent across different datasets (see Fig 5).

3.3 Textual Embedding Inversion Attack
Given the attack model, i.e. the local embedding-to-text generator \( dec_A(\cdot) \) and the \( e_V \) to \( e_A \) alignment model, and a body of eavesdropped embeddings \( \mathbf{E}_V \), we launch the inversion attack:

\[
\hat{\mathbf{X}} = dec_A(\mathbf{E}_V \mathbf{W}).
\]

4 Experimental Setup

4.1 LLMs
We use pretrained FlanT5 as the backbone to launch our attack modules, encoder \( enc_A(\cdot) \) and decoder \( dec_A(\cdot) \). For victim models, a variety of encoders are experimented on, including T5, GTR, mT5, mBERT and OpenAI text embedders TEXT-EMBEDDING-ADA-002 (ADA-2) and TEXT-EMBEDDING-3-LARGE (3-LARGE) (see the details of LLMs in Table 10).

4.2 Attack Experimental Setup
Datasets and Attack Model We train the embedding-to-text generator \( dec_A(\cdot) \) by fine-tuning FlanT5-decoder, using the MultiHPLT English dataset (de Gibert et al., 2024) to explore few-shot inversion attacks. For multilingual inversion
attacks, we utilize English, German, French, and Spanish datasets from mMarco (Bonifacio et al., 2021). In dataset, we split 150k samples (\( D_L \)) to train \( dec_A(\cdot) \); and up to 1k samples (\( D_V \)) to derive the alignment metric \( W \) by aligning \( e_V \) to \( e_A \), as alignment samples; and 200 for evaluation.

<table>
  <tr>
    <th>Dataset</th>
    <th>Clasification</th>
    <th>#Class</th>
    <th>#Train</th>
    <th>#Dev</th>
    <th>#Test</th>
  </tr>
  <tr>
    <td>SNLI</td>
    <td>NLI</td>
    <td>3</td>
    <td>540,000</td>
    <td>200</td>
    <td>200</td>
  </tr>
  <tr>
    <td>SST2</td>
    <td>Sentiment</td>
    <td>2</td>
    <td>59,560</td>
    <td>200</td>
    <td>200</td>
  </tr>
  <tr>
    <td>S140</td>
    <td>Sentiment</td>
    <td>2</td>
    <td>1,599,798</td>
    <td>200</td>
    <td>200</td>
  </tr>
</table>

Table 1: Statistics of Utility Task Datasets

Embedding-to-Text Generator Training We conduct a series of experiments varying the training set size (from 10k to 1M samples), learning rate and weight decay, then select the generator configuration that achieves the best Rouge-L score on the evaluation set. Eventually, to strike a balance of performance and data usage, we train \( dec_A(\cdot) \), an embedding-to-sequence decoder, with a learning rate of \( 1e-4 \) and weight decay \( 1e-4 \) on AdamW optimizer (Loshchilov et al., 2017), batch size 128, and 150k data samples performs the best. We use Cross-entropy Loss for training the generator.

Evaluation Metrics Rouge-L (Lin, 2004) is used to measure the accuracy and overlap between ground truth text \( x \) and reconstructed text \( \hat{x} \) based on n-grams. In addition, we report Rouge1, BLEU1 and BLEU2. Cosine Similarity (COS) between the aligned victim embeddings \( e_{V \rightarrow A} \) and the attack embeddings \( e_A \) is calculated to evaluate the semantic similarity in the latent embedding space.

4.3 Defense Experimental Setup

We aim to evaluate how embeddings with defense mechanisms perform in downstream tasks.

Datasets We use SST2 (Socher et al., 2013), sentiment140 (S140) (Go et al., 2009) and SNLI (Bowman et al., 2015) in our experiments, which are curated to ensure a balanced distribution of labels. Table 1 shows the statistics of datasets.

Utility of Embeddings Using the embeddings from the victim encoders, we train multi-layer perceptron classifiers on the datasets and evaluate the accuracy (ACC) and \( F_1 \)-score (F1) performance. We train each classifier 6 epochs, and select the best model with ACC on the dev dataset to evaluate the test dataset. There would be minimal difference in the utility performance between the protected and original embeddings, if a defense is successful.

<table>
  <tr>
    <th>Victim</th>
    <th>BLEU1</th>
    <th>BLEU2</th>
    <th>Rouge-L</th>
    <th>Rouge1</th>
    <th>COS</th>
  </tr>
  <tr>
    <td>enc_A(·)</td>
    <td>62.27</td>
    <td>40.68</td>
    <td>54.16</td>
    <td>62.07</td>
    <td>-</td>
  </tr>
  <tr>
    <td>T5 (Base)</td>
    <td>21.47</td>
    <td>9.07</td>
    <td><u>17.38</u></td>
    <td>19.52</td>
    <td>0.4663</td>
  </tr>
  <tr>
    <td>Corrector</td>
    <td>18.35</td>
    <td>7.60</td>
    <td>15.81</td>
    <td>17.76</td>
    <td>0.4835</td>
  </tr>
  <tr>
    <td>GTR (Base)</td>
    <td>6.70</td>
    <td>2.31</td>
    <td>4.70</td>
    <td>4.82</td>
    <td>0.1911</td>
  </tr>
  <tr>
    <td>Corrector</td>
    <td>13.42</td>
    <td>2.79</td>
    <td><u>10.26</u></td>
    <td>12.31</td>
    <td>0.2725</td>
  </tr>
  <tr>
    <td>MT5 (Base)</td>
    <td>22.27</td>
    <td>9.86</td>
    <td><u>17.21</u></td>
    <td>19.28</td>
    <td>0.2718</td>
  </tr>
  <tr>
    <td>Corrector</td>
    <td>18.73</td>
    <td>7.79</td>
    <td>15.98</td>
    <td>17.82</td>
    <td>0.6891</td>
  </tr>
  <tr>
    <td>mBERT (Base)</td>
    <td>21.56</td>
    <td>9.09</td>
    <td><u>16.97</u></td>
    <td>18.81</td>
    <td>0.5335</td>
  </tr>
  <tr>
    <td>Corrector</td>
    <td>18.45</td>
    <td>7.48</td>
    <td>15.99</td>
    <td>18.10</td>
    <td>0.5531</td>
  </tr>
  <tr>
    <td>RANDOM</td>
    <td>11.63</td>
    <td>0.6</td>
    <td>7.09</td>
    <td>8.36</td>
    <td>-0.0440</td>
  </tr>
  <tr>
    <td>ALGEN</td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
    <td></td>
  </tr>
  <tr>
    <td>T5</td>
    <td>52.98</td>
    <td>33.86</td>
    <td><u>45.75</u></td>
    <td>51.56</td>
    <td>0.9464</td>
  </tr>
  <tr>
    <td>GTR</td>
    <td>42.59</td>
    <td>26.17</td>
    <td>38.27</td>
    <td>42.32</td>
    <td>0.8879</td>
  </tr>
  <tr>
    <td>MT5</td>
    <td>49.61</td>
    <td>31</td>
    <td><u>43.35</u></td>
    <td>48.47</td>
    <td>0.9370</td>
  </tr>
  <tr>
    <td>mBERT</td>
    <td>47.06</td>
    <td>28.66</td>
    <td>39.9</td>
    <td>45.04</td>
    <td>0.9217</td>
  </tr>
  <tr>
    <td>OPENAI (ADA-2)</td>
    <td>46.7</td>
    <td>28.67</td>
    <td><u>41.45</u></td>
    <td>47.01</td>
    <td>0.9312</td>
  </tr>
  <tr>
    <td>OPENAI (3-LARGE)</td>
    <td>46.28</td>
    <td>28.74</td>
    <td>41.31</td>
    <td>46.28</td>
    <td>0.9066</td>
  </tr>
</table>

Table 2: Inversion Attack Performances by victim models with 1,000 leaked data samples. The best Rouge-L scores are bolded, and the highest cosine similarities are underlined.

in the utility performance between the protected and original embeddings, if a defense is successful.

5 Few-shot Inversion Attacks

Each subsection aims to answer one Research Question (RQ).

5.1 How few Leaked Data do Attackers Need?

With only a single leaked data sample, our attack model manages to invert the victim embeddings, achieving a Rouge-L score of 10 across the encoders, as shown in Fig. 3. We use randomly generated embeddings as a baseline to verify that the aligned embeddings from ALGEN capture meaningful information. As shown in Table 2, all victim embeddings substantially outperform the RANDOM across metrics, validating our approach. Furthermore, when the number of leaked data samples increases until 1k, the inversion performance increases sharply, reaching 45.75 in Rouge-L and 0.9464 for cosine similarity for T5 embeddings. Notably, while GTR and T5 share the same tokenizer with the attack model, their inversion performances are not superior to others. Moreover, the inversion performance on proprietary OPENAI embeddings also reaches comparable performance, more than 41 in Rouge-L and 0.9 in cosine similarities for both ADA-2 and 3-LARGE, highlighting the risks posed by inversion attacks. As shown in the qualitative analysis in Table 11, some sentences can be inverted with almost an exact match. Furthermore, we conduct an ablation study with the size of alignment data samples and find that 1k
Figure 3: Inversion Performance in Rouge-L (Top) and Cosine Similarities (Bottom) by Victim Models and Alignment samples. Dashed lines are results of Vec2Text and solid lines are results of ALGEN.

alignment samples strike a balance between data size and performances (see Fig. 6 in Appendix. C).

We compare our method with Vec2Text (Morris et al., 2023), which trains two-step models (i.e., Base and Corrector) with iterative access to the victim encoder, and it requires training on embeddings from each encoder to invert the regarding embeddings. In comparison, our method only requires training one local attack model, and training does not involve specific victim encoders. Up to 1k samples, Vec2Text performance is much inferior compared to our method both in Rouge-L and cosine similarities, lower than 20 and 0.72, respectively, as detailed in Fig. 3 and Table 2.

We generally observe small alignment errors, with the cosine similarities between victim embeddings and attack embeddings consistently higher than 0.8 and near 1.0 when the number of alignment samples increases. The bottleneck of the performance of ALGEN is likely to lie in the decoding, as the trained attack decoder can only reach 54.16 in Rouge-L to invert the attack embeddings, as shown in Table 2, which is considered to be the upper bound of inversion attack performance.

<table>
  <tr>
    <th rowspan="2">Victim</th>
    <th rowspan="2">λ</th>
    <th colspan="9">1</th>
  </tr>
  <tr>
    <th>1</th>
    <th>10</th>
    <th>30</th>
    <th>100</th>
    <th>500</th>
    <th>1000</th>
  </tr>
  <tr>
    <td rowspan="5">MT5</td>
    <td>0</td>
    <td>9.27</td>
    <td>18.40</td>
    <td>20.46</td>
    <td>26.43</td>
    <td>40.04</td>
    <td>43.35</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>9.27</td>
    <td>18.44</td>
    <td>20.49</td>
    <td>26.09</td>
    <td>39.99</td>
    <td>43.00</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>9.27</td>
    <td>18.45</td>
    <td>20.60</td>
    <td>25.95</td>
    <td>39.77</td>
    <td>42.99</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>9.27</td>
    <td>18.82</td>
    <td>19.96</td>
    <td>27.48</td>
    <td>40.25</td>
    <td>43.50</td>
  </tr>
  <tr>
    <td>1</td>
    <td>9.27</td>
    <td>13.99</td>
    <td>18.82</td>
    <td>20.86</td>
    <td>35.30</td>
    <td>38.55</td>
  </tr>
  <tr>
    <td>10</td>
    <td>9.27</td>
    <td>10.15</td>
    <td>11.10</td>
    <td>12.38</td>
    <td>21.38</td>
    <td>25.84</td>
  </tr>
  <tr>
    <td rowspan="5">ADA-2</td>
    <td>0</td>
    <td>9.27</td>
    <td>18.35</td>
    <td>19.72</td>
    <td>23.82</td>
    <td>37.70</td>
    <td>41.45</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>9.27</td>
    <td>18.39</td>
    <td>19.81</td>
    <td>24.45</td>
    <td>37.72</td>
    <td>41.23</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>9.27</td>
    <td>18.37</td>
    <td>19.64</td>
    <td>24.18</td>
    <td>37.86</td>
    <td>41.55</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>9.27</td>
    <td>18.27</td>
    <td>19.48</td>
    <td>24.80</td>
    <td>38.77</td>
    <td>41.75</td>
  </tr>
  <tr>
    <td>1</td>
    <td>9.27</td>
    <td>11.66</td>
    <td>16.20</td>
    <td>19.23</td>
    <td>32.99</td>
    <td>38.22</td>
  </tr>
  <tr>
    <td>10</td>
    <td>9.27</td>
    <td>8.86</td>
    <td>10.50</td>
    <td>10.73</td>
    <td>20.10</td>
    <td>21.55</td>
  </tr>
</table>

Table 3: Inversion Performance in Rouge-L of the Victim models across regularization parameter \( \lambda \) by the Alignment samples.

5.2 Does Regularization further Increase Few-shot Inversion Vulnerabilities?

To experiment whether adding regularization in our solution \( W \) further improve the inversion attack performance, we add an L2 regularization term to Eq. 4, which give us

\[
W = (E_V^T E_V + \lambda I_m)^{-1} E_V^T E_A,
\]

where \( m \) is the dimension of \( E_V \). We experimented with \( \lambda \in \{0.001, 0.01, 0.1, 1, 10\} \), across a range of alignment samples [1, 10, 30, 100, 500, 1000], and \( \lambda = 0 \) refers to no regularization.

As shown in Table 3, the best regularization results in Rouge-L provide only marginal improvements, which indicates the robustness and generalization of ALGEN.

5.3 Are Other Languages (More) Vulnerable?

Building on previous work on multilingual embedding inversion, we also investigate the impact of ALGEN on languages other than English. To achieve this, we trained local attack models in English, French, German, and Spanish. We further conduct crosslingual embedding inversion attacks, for example, applying the English-trained attack model to invert French textual embeddings. Table 5 summarizes the results of multilingual and crosslingual embedding inversion attacks. The first row shows the results of monolingual inversion on the attack embeddings, which serve as an upper bound of the inversion performances on this dataset. As expected, the monolingual inversion attacks perform better than the crosslingual ones.

Consistent with previous findings (Chen et al., 2024b), crosslingual inversion often reconstructs
<table>
  <tr>
    <th>Input</th>
    <td>This business uses tools provided by TripAdvisor [ORG](or one of its official Review Collection Partners) to encourage and collect guest reviews, including this one.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td>This business uses tools provided by TripAdvisor [ORG] (or one of its official Review Collection Partners) to encourage and collect guest reviews, including this one</td>
  </tr>
  <tr>
    <th>Input</th>
    <td>Book your flights now from Hermosillo (<b>Mexico [GPE]</b>) to the most important cities in the world. The box below contains flights from Her.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td>Book your flights now from Las Vegas (<b>Mexico [GPE]</b>) to the most important cities in the world. The box below contains flights from Las Vegas to</td>
  </tr>
</table>

Table 4: Qualitative Analysis of In-Domain Inversion Results from OPENAI (ADA-2) embeddings with 1k alignment data samples and the attack model trained on MultiHPLT English dataset. The matched entities with their entity types are colored and bolded in Input and Reconstructed. The mismatched reconstructed texts are in grey colored box . [GPE]: Countries/cities/states; [ORG]:Organization.

<table>
  <tr>
    <th rowspan="2">Attack Lang.</th>
    <th colspan="4">Victim Languages</th>
  </tr>
  <tr>
    <th>English</th>
    <th>French</th>
    <th>German</th>
    <th>Spanish</th>
  </tr>
  <tr>
    <td>enra(1)</td>
    <td>54.47</td>
    <td>52.78</td>
    <td>24.77</td>
    <td>53.98</td>
  </tr>
  <tr>
    <td>T5</td>
    <td>29.29<br>(+2.37)<br>11.31 (+0.48)<br>6.56 (+4.49)</td>
    <td>12.57 (+2.58)<br>13.37 (+0.15)<br>11.33 (+1.05)</td>
    <td>5.54 (+0.72)<br>1.56 (+0.06)<br>2.18 (+0.95)</td>
    <td>13.33 (+0.33)<br>13.04 (+0.25)<br>31.83</td>
  </tr>
  <tr>
    <td>GTR</td>
    <td>19.22<br>4.78 (+2.85)<br>4.4 (+3.74)</td>
    <td>10.45 (+1.34)<br>2.98<br>10.5 (+1.98)</td>
    <td>4.27 (+0.57)<br>1.95 (+1.14)<br>1.9 (+0.95)</td>
    <td>10.17 (+1.09)<br>12.16 (+0.42)<br>20.88</td>
  </tr>
  <tr>
    <td>mT5</td>
    <td>25.48<br>15.54 (+0.06)<br>6.84 (+3.98)</td>
    <td>12.29 (+1.64)<br>15.2 (+0.1)<br>11.62 (+1.35)</td>
    <td>5.31 (+0.03)<br>10.08<br>1.88 (+1.31)</td>
    <td>12.46 (+0.97)<br>15.59 (+0.02)<br>24.05</td>
  </tr>
  <tr>
    <td>MBERT</td>
    <td>21.3<br>5.91 (+3.61)<br>5.17 (+1.44)</td>
    <td>11.72 (+1.42)<br>2.79<br>11.07 (+0.99)</td>
    <td>4.46 (+0.43)<br>1.87 (+1.71)<br>1.75 (+0.57)</td>
    <td>11.76 (+0.82)<br>12.05 (+0.19)<br>21.74</td>
  </tr>
  <tr>
    <td>OPENAI (ADA-2)</td>
    <td>28.47<br>14.97 (+3.73)<br>7.08 (+3.57)</td>
    <td>11.62 (+1.32)<br>14.16 (+0.05)<br>9.82 (+1.39)</td>
    <td>5.40 (+1.07)<br>9.17<br>1.63 (+0.15)</td>
    <td>12.36 (+0.95)<br>12.03 (+0.71)<br>21.25</td>
  </tr>
</table>

Table 5: Crosslingual Embedding Inversion Performance in Rouge-L with \( |D_V|=1k \). The results in the brackets are the performance gain after translation.

text in a language other than the intended, usually English (the dominant language in most multilingual LLMs) or trained languages in the attack model, hindering the performance evaluation with string-match metrics. For example, a French text “un composé organique qui ne contient que du carbone”, is reconstructed into English “a chemical compound composed of carbon”. Rouge-L evaluation is more accurate when the inverted text is translated back into the target language (e.g., “un composé chimique composé de carbone”). To ensure fairness, we translate the inverted texts into their target languages using deep-translator.4 After translation, Rouge-L scores improve across most models, with the most notable gains observed in the French-to-English scenario, as shown in Table 5. From an attacker’s perspective, splitting words in English rather than in the victim’s language is advantageous. Attackers can be assumed to be proficient in English, while the victim’s language might be unintelligible to them. This further exacerbates the vulnerabilities of non-English languages.

5.4 Is Risk Transferable across Domains?
To evaluate the cross-domain transferability of ALGEN, we attack the embeddings on the mMarco English dataset using an attack model trained on MultiHPLT English data. Although the cross-domain inversion performance in Rouge-L is about 25% lower than that of in-domain attacks on mMarco (see Table 5), the results remain alarmingly high - with Rouge-L near 20 and BLEU1 near 31 across victim encoders.

<table>
  <tr>
    <th>Model</th>
    <th>BLEU1</th>
    <th>BLEU2</th>
    <th>Rouge-L</th>
    <th>Rouge1</th>
    <th>COS</th>
  </tr>
  <tr>
    <td>T5</td>
    <td>31.4</td>
    <td>5.72</td>
    <td>21.76</td>
    <td>29.6</td>
    <td>0.9278</td>
  </tr>
  <tr>
    <td>GTR</td>
    <td>22.04</td>
    <td>2.26</td>
    <td>15.27</td>
    <td>20.45</td>
    <td>0.8442</td>
  </tr>
  <tr>
    <td>mT5</td>
    <td>30.08</td>
    <td>4.82</td>
    <td>19.33</td>
    <td>26.94</td>
    <td>0.9188</td>
  </tr>
  <tr>
    <td>MBERT</td>
    <td>26.68</td>
    <td>3.57</td>
    <td>17.16</td>
    <td>23.88</td>
    <td>0.9033</td>
  </tr>
  <tr>
    <td>OPENAI (ADA-2)</td>
    <td>27.62</td>
    <td>4.63</td>
    <td>19.07</td>
    <td>26.40</td>
    <td>0.9089</td>
  </tr>
</table>

Table 6: Cross-Domain Inversion Attack with \( |D_V|=1k \).

5.5 Does Inversion Recover Key Information?

<table>
  <tr>
    <th>Model</th>
    <th>Overall</th>
    <th>Product</th>
    <th>ORG</th>
    <th>GPE</th>
    <th>Date</th>
    <th>Time</th>
    <th>Cardinal</th>
    <th>Ordinal</th>
  </tr>
  <tr>
    <td>T5</td>
    <td>23.86</td>
    <td>50</td>
    <td>32.41</td>
    <td>21.62</td>
    <td>14.55</td>
    <td>16.67</td>
    <td>28.57</td>
    <td>40.00</td>
  </tr>
  <tr>
    <td>mT5</td>
    <td>20.2</td>
    <td>53.33</td>
    <td>28.04</td>
    <td>17.5</td>
    <td>11.11</td>
    <td>0</td>
    <td>10.53</td>
    <td>25.00</td>
  </tr>
  <tr>
    <td>GTR</td>
    <td>21.17</td>
    <td>54.55</td>
    <td>32.13</td>
    <td>10.67</td>
    <td>11.11</td>
    <td>22.22</td>
    <td>13.79</td>
    <td>25.00</td>
  </tr>
  <tr>
    <td>MBERT</td>
    <td>26.68</td>
    <td>40.67</td>
    <td>28.04</td>
    <td>12.58</td>
    <td>13.33</td>
    <td>6.90</td>
    <td>13.33</td>
    <td>33.33</td>
  </tr>
  <tr>
    <td>OPENAI</td>
    <td>22.45</td>
    <td>33.33</td>
    <td>34.13</td>
    <td>16.47</td>
    <td>13.79</td>
    <td>0</td>
    <td>14.55</td>
    <td>37.50</td>
  </tr>
</table>

Table 7: Named Entity Recognition in F1 scores for overall and top 10 entities in specific.

To examine whether ALGEN attacks real key information, we apply Named Entity Recognition5 on input and reconstructed test data from MultiHPLT English dataset to calculate the current ratio

4https://github.com/nidhaloff/deep-translator
5https://github.com/explosion/spacy-stanza
of Named Entities in the reconstructed texts. Table 7 shows the results in F1 scores for overall and individual entities. In the qualitative analysis, as shown in Table 4 and 11, the input and reconstructed texts in the inversion attacks on OPENAI (ADA-2) embeddings are compared, with named entities highlighted. These attacks reveal sensitive details, such as organization, country, and numbers, highlighting the risks of privacy disclosure by embeddings.

6 Defending Textual Embeddings

To explore defenses against ALGEN, we evaluate defense mechanisms designed to protect textual embeddings from adversarial attacks.

6.1 Defense Methods

WET We implement WET on textual embeddings, to examine whether it makes embeddings robust against inversion attacks, since it is effective in defending paraphrasing attacks (Shetty et al., 2024). A transformation matrix \( T \) is generated to transform the \( e_V \) into \( e_{WET} \) with \( T \cdot e_V / \|T \cdot e_V\| \), to ensure that i) the original elements are discarded and only the transformed ones are retained; and ii) \( T \) is full-rank and well-conditioned to allow for accurate recovery of the original embeddings (see details of generating \( T \) in Appendix B.1).

Shuffling We randomly shuffle the embeddings with \( e_{V,\pi(i)} \), where \( \pi \) is a random permutation function that reorders the indices \( i \) along the hidden dimension.

Gaussian Noise Insertion We add Gaussian noises to \( e_V \) with \( (e_V + \lambda \cdot \epsilon)/\|e_V + \lambda \cdot \epsilon\|, \epsilon \sim \mathcal{N}(0, 1) \) (Morris et al., 2023; Chen et al., 2024b) with \( \lambda \in [0.001, 0.005, 0.01, 0.05, 0.1, 0.5, 1] \).

Differential Privacy Du et al. (2023) adopts Purkayastha Mechanism (PurMech) and Normalized Planer Laplace (LapMech) on sentence embeddings to ensure metric-LDP (see details in Appendix B.2). We adopt the parameters from Du et al. (2023) to experiment with defending textual embeddings from inversion attacks. The privacy budgets \( \epsilon \in [1, 4, 8, 12] \) are selected.

6.2 Results

As shown in Table 8, 12 and 13, WET and Shuffling have minimal impact on both inversion attack performance and the utility performance across victim models and datasets. The randomly generated embeddings are also used as a baseline. With Gaussian noise insertion, the bigger the noise \( \lambda \), both performance in inversion and utility decrease.

<table>
  <tr>
    <th rowspan="2">Victim</th>
    <th rowspan="2">Defense</th>
    <th colspan="2">Rouge-L↓</th>
    <th colspan="2">COS↓</th>
    <th colspan="2">F1↑</th>
  </tr>
  <tr>
    <th>COS↓</th>
    <th>F1↑</th>
    <th>COS↓</th>
    <th>F1↑</th>
  </tr>
  <tr>
    <td>RANDOM</td>
    <td>-</td>
    <td>12.42</td>
    <td>0.0052</td>
    <td>40.5</td>
    <td>40.33</td>
  </tr>
  <tr>
    <td></td>
    <td>-</td>
    <td>42.89</td>
    <td>0.9959</td>
    <td>63</td>
    <td>62.92</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>-</td>
    <td>39.4</td>
    <td>0.9562</td>
    <td>63</td>
    <td>62.92</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>-</td>
    <td>35.33</td>
    <td>0.9599</td>
    <td>63</td>
    <td>62.92</td>
  </tr>
  <tr>
    <td rowspan="7">T5</td>
    <td>0.001</td>
    <td>43.3</td>
    <td>0.9595</td>
    <td>66.5</td>
    <td>66.38</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>42.88</td>
    <td>0.9601</td>
    <td>63</td>
    <td>62.55</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>40.26</td>
    <td>0.9537</td>
    <td>69</td>
    <td>68.57</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>22.82</td>
    <td>0.8459</td>
    <td>59</td>
    <td>58.61</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>19.32</td>
    <td>0.7918</td>
    <td>48</td>
    <td>47.6</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>14.29</td>
    <td>0.3853</td>
    <td>38</td>
    <td>37.92</td>
  </tr>
  <tr>
    <td>1</td>
    <td>12.97</td>
    <td>0.1543</td>
    <td>30.5</td>
    <td>30.54</td>
  </tr>
  <tr>
    <td></td>
    <td>-</td>
    <td>37.39</td>
    <td>0.9284</td>
    <td>60.5</td>
    <td>60.53</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>-</td>
    <td>35.58</td>
    <td>0.9289</td>
    <td>53.5</td>
    <td>53.1</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>-</td>
    <td>31.01</td>
    <td>0.9280</td>
    <td>60.5</td>
    <td>60.58</td>
  </tr>
  <tr>
    <td rowspan="7">GTR</td>
    <td>0.001</td>
    <td>36.52</td>
    <td>0.9279</td>
    <td>60</td>
    <td>60.06</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>36.48</td>
    <td>0.9299</td>
    <td>63</td>
    <td>62.91</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>34.41</td>
    <td>0.9218</td>
    <td>60.5</td>
    <td>60.59</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>22.31</td>
    <td>0.8160</td>
    <td>46.5</td>
    <td>46.42</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>19.39</td>
    <td>0.7701</td>
    <td>50.5</td>
    <td>49.98</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>14.31</td>
    <td>0.2920</td>
    <td>30.5</td>
    <td>29.97</td>
  </tr>
  <tr>
    <td>1</td>
    <td>13.48</td>
    <td>0.1659</td>
    <td>30.5</td>
    <td>30.57</td>
  </tr>
  <tr>
    <td></td>
    <td>-</td>
    <td>37.98</td>
    <td>0.9518</td>
    <td>61</td>
    <td>60.95</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>-</td>
    <td>34.69</td>
    <td>0.9479</td>
    <td>55.5</td>
    <td>55.12</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>-</td>
    <td>31.83</td>
    <td>0.9515</td>
    <td>60.5</td>
    <td>60.44</td>
  </tr>
  <tr>
    <td rowspan="7">mt5</td>
    <td>0.001</td>
    <td>37.97</td>
    <td>0.9519</td>
    <td>61.5</td>
    <td>61.47</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>37.84</td>
    <td>0.9493</td>
    <td>55.5</td>
    <td>55.06</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>34.5</td>
    <td>0.9438</td>
    <td>60</td>
    <td>59.96</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>21.58</td>
    <td>0.8292</td>
    <td>54</td>
    <td>53.52</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>17.65</td>
    <td>0.7578</td>
    <td>36.5</td>
    <td>36.45</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>14.8</td>
    <td>0.4482</td>
    <td>36</td>
    <td>35.17</td>
  </tr>
  <tr>
    <td>1</td>
    <td>13.31</td>
    <td>0.1468</td>
    <td>35.5</td>
    <td>34.85</td>
  </tr>
  <tr>
    <td></td>
    <td>-</td>
    <td>35.47</td>
    <td>0.9423</td>
    <td>57</td>
    <td>57.05</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>-</td>
    <td>34.35</td>
    <td>0.9428</td>
    <td>53.5</td>
    <td>53.5</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>-</td>
    <td>30.29</td>
    <td>0.9408</td>
    <td>52</td>
    <td>51.93</td>
  </tr>
  <tr>
    <td rowspan="7">mBERT</td>
    <td>0.001</td>
    <td>35.82</td>
    <td>0.9422</td>
    <td>51.5</td>
    <td>51.37</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>36.18</td>
    <td>0.9409</td>
    <td>51</td>
    <td>50.82</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>34.18</td>
    <td>0.9349</td>
    <td>57</td>
    <td>57.01</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>22.29</td>
    <td>0.8265</td>
    <td>50.5</td>
    <td>50.48</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>18.65</td>
    <td>0.7741</td>
    <td>43</td>
    <td>43.03</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>13.76</td>
    <td>0.3969</td>
    <td>35</td>
    <td>33.96</td>
  </tr>
  <tr>
    <td>1</td>
    <td>13.11</td>
    <td>0.1824</td>
    <td>32.5</td>
    <td>32.62</td>
  </tr>
  <tr>
    <td></td>
    <td>-</td>
    <td>38.15</td>
    <td>0.9433</td>
    <td>74.5</td>
    <td>74.78</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>-</td>
    <td>31.74</td>
    <td>0.9405</td>
    <td>64.5</td>
    <td>64.51</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>-</td>
    <td>33.91</td>
    <td>0.9440</td>
    <td>72</td>
    <td>72.31</td>
  </tr>
  <tr>
    <td rowspan="7">OPENAI (ADA-2)</td>
    <td>0.001</td>
    <td>37.94</td>
    <td>0.9437</td>
    <td>74.5</td>
    <td>74.51</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>37.63</td>
    <td>0.9445</td>
    <td>69</td>
    <td>69.09</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>35.59</td>
    <td>0.9409</td>
    <td>67</td>
    <td>66.85</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>20.59</td>
    <td>0.8426</td>
    <td>49.5</td>
    <td>49.39</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>18.72</td>
    <td>0.8231</td>
    <td>44</td>
    <td>42.76</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>14.75</td>
    <td>0.4483</td>
    <td>37</td>
    <td>36.87</td>
  </tr>
  <tr>
    <td>1</td>
    <td>11.94</td>
    <td>0.1097</td>
    <td>30.5</td>
    <td>30.49</td>
  </tr>
</table>

Table 8: The Inversion and Utility Performance on Classification Tasks on SNLI dataset with WET, Shuffling, Guassian Noise Insertion. From a defender’s perspective, ↑ means higher are better, ↓ means lower are better.
Figure 4: The Inversion and Utility Performance in Accuracy on Classification Tasks on SNLI dataset with local DP, across \( \epsilon \). The solid lines represent utility performance for non-private embeddings, while the dashed lines are for LDP-guaranteed embeddings.

<table>
  <tr>
    <th rowspan="2">Victim</th>
    <th rowspan="2">\( \epsilon \)</th>
    <th colspan="2">Rouge-L<sub>\( \downarrow \)</sub></th>
    <th colspan="2">COS<sub>\( \downarrow \)</sub></th>
  </tr>
  <tr>
    <th>LapMech</th>
    <th>PurMech</th>
    <th>LapMech</th>
    <th>PurMech</th>
  </tr>
  <tr>
    <td rowspan="4">T5</td>
    <td>1</td>
    <td>11.58</td>
    <td>0.0184</td>
    <td>11.38</td>
    <td>-0.0341</td>
  </tr>
  <tr>
    <td>4</td>
    <td>12.02</td>
    <td>-0.0171</td>
    <td>11.52</td>
    <td>-0.0095</td>
  </tr>
  <tr>
    <td>8</td>
    <td>11.8</td>
    <td>0.0510</td>
    <td>11.96</td>
    <td>0.0137</td>
  </tr>
  <tr>
    <td>12</td>
    <td>11.64</td>
    <td>0.0438</td>
    <td>11.48</td>
    <td>-0.0239</td>
  </tr>
  <tr>
    <td rowspan="4">GTR</td>
    <td>1</td>
    <td>11.9</td>
    <td>0.0327</td>
    <td>11.86</td>
    <td>0.0183</td>
  </tr>
  <tr>
    <td>4</td>
    <td>11.78</td>
    <td>-0.0193</td>
    <td>11.82</td>
    <td>0.0073</td>
  </tr>
  <tr>
    <td>8</td>
    <td>11.89</td>
    <td>-0.0217</td>
    <td>11.51</td>
    <td>0.0226</td>
  </tr>
  <tr>
    <td>12</td>
    <td>10.92</td>
    <td>-0.0277</td>
    <td>11.33</td>
    <td>-0.0314</td>
  </tr>
  <tr>
    <td rowspan="4">mT5</td>
    <td>1</td>
    <td>12.3</td>
    <td>0.0827</td>
    <td>11.96</td>
    <td>0.0143</td>
  </tr>
  <tr>
    <td>4</td>
    <td>13.15</td>
    <td>0.0696</td>
    <td>13.17</td>
    <td>0.0652</td>
  </tr>
  <tr>
    <td>8</td>
    <td>11.89</td>
    <td>-0.0148</td>
    <td>12.09</td>
    <td>0.0493</td>
  </tr>
  <tr>
    <td>12</td>
    <td>13.44</td>
    <td>0.1179</td>
    <td>11.61</td>
    <td>-0.0443</td>
  </tr>
  <tr>
    <td rowspan="4">mBERT</td>
    <td>1</td>
    <td>12.37</td>
    <td>-0.0026</td>
    <td>11.33</td>
    <td>0.0016</td>
  </tr>
  <tr>
    <td>4</td>
    <td>11.84</td>
    <td>-0.0431</td>
    <td>11.58</td>
    <td>-0.0019</td>
  </tr>
  <tr>
    <td>8</td>
    <td>11.58</td>
    <td>-0.0333</td>
    <td>12.93</td>
    <td>0.1003</td>
  </tr>
  <tr>
    <td>12</td>
    <td>11</td>
    <td>-0.0242</td>
    <td>11.48</td>
    <td>0.0271</td>
  </tr>
  <tr>
    <td rowspan="4">OPENAI (ADA-2)</td>
    <td>1</td>
    <td>12.33</td>
    <td>0.0198</td>
    <td>11.15</td>
    <td>-0.0020</td>
  </tr>
  <tr>
    <td>4</td>
    <td>12.31</td>
    <td>0.0133</td>
    <td>11.87</td>
    <td>-0.0417</td>
  </tr>
  <tr>
    <td>8</td>
    <td>10.87</td>
    <td>-0.0659</td>
    <td>13.13</td>
    <td>0.1078</td>
  </tr>
  <tr>
    <td>12</td>
    <td>11.07</td>
    <td>-0.0050</td>
    <td>12.48</td>
    <td>0.0447</td>
  </tr>
</table>

Table 9: The Inversion Performance on Classification Tasks on SNLI dataset with Local DP. From a defender’s perspective, \( \downarrow \) means lower are better.

Using local DP, while the utility performance is preserved almost as the non-private embeddings with \( \epsilon = 12 \), as shown in Fig. 4, Tabel 14 and 15. However, the inversion performance still maintains more than 25% of the non-private embeddings in Rouge-L across encoders for both LapMech and PurMech, as detailed in Table 9, 14 and 15, posing security and privacy risks for the embeddings.

7 Discussion and Conclusion

In this work, we introduce and validate the effectiveness of a novel few-shot inversion attack, ALGEN, which drastically lowers the cost and complexity of such attacks on widely used vector databases. Our results show that the attack transfers effectively across domains and languages while revealing critical information. Moreover, its ability to align embeddings from different LLMs with minimal loss highlights its broad NLP applications, especially in cross-lingual embedding alignment. Finally, our evaluation of existing defense mechanisms reveals that none can adequately protect textual embeddings from inversion attacks while maintaining utility, highlighting significant security and privacy vulnerabilities.

Limitations

Our work does not propose a sufficient defense mechanism for ALGEN. Although we evaluated a number of existing defense mechanisms for textual embeddings, we found them to be ineffective against the proposed embedding inversion attack. The primary focus of this work is to expose the security vulnerabilities in embedding services and to inspire the development of future defense paradigms.

Computational Resources

We conduct experiments and train each text-to-embedding generator model on a single Nvidia A40 GPU, with the training process completing in three hours. Beyond this, ALGEN requires minimal GPU resources, making it a genuinely few-shot experimental setting.

Ethics Statement

We comply with the ACL Ethics Policy. The inversion attacks implemented in this paper can be misused and potentially harmful to proprietary embeddings. We discuss and experiment with potential mitigation and defense mechanisms, and we encourage further research in developing effective defenses in this attack space.
Acknowledgements

YC and JB are funded by the Carlsberg Foundation, under the Semper Ardens: Accelerate programme (project nr. CF21-0454). We further acknowledge the support of the AAU AI Cloud and express our gratitude to DeiC for providing computing resources on the LUMI cluster (project nr. DeiC-AAU-N5-2024085-H2-2024-28). YC expresses her gratitude to the Danish Ministry of Higher Education and Science for the EliteForsk travel grant and to the School of Computing at Macquarie University for hosting her research stay. Q. Xu acknowledges support from 2024 FSE Strategic Startup and FSE Travel Grant. We also thank the anonymous reviewers for their constructive feedback, which helped us improve this paper.

References

Prince Osei Aboagye, Yan Zheng, Chin-Chia Michael Yeh, Junpeng Wang, Wei Zhang, Liang Wang, Hao Yang, and Jeff M Phillips. 2022. Normalization of language embeddings for cross-lingual alignment. In International Conference on Learning Representations.

Hanan Aldarmaki and Mona Diab. 2019. Context-aware cross-lingual mapping. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 3906–3911, Minneapolis, Minnesota. Association for Computational Linguistics.

Sawsan Alqahtani, Garima Lalwani, Yi Zhang, Salvatore Romeo, and Saab Mansour. 2021. Using optimal transport as alignment objective for fine-tuning multilingual contextualized embeddings. In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 3904–3919, Punta Cana, Dominican Republic. Association for Computational Linguistics.

Mikel Artetxe, Gorka Labaka, and Eneko Agirre. 2016. Learning principled bilingual mappings of word embeddings while preserving monolingual invariance. In Proceedings of the 2016 Conference on Empirical Methods in Natural Language Processing, pages 2289–2294, Austin, Texas. Association for Computational Linguistics.

Mikel Artetxe, Gorka Labaka, and Eneko Agirre. 2017. Learning bilingual word embeddings with (almost) no bilingual data. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 451–462, Vancouver, Canada. Association for Computational Linguistics.

Manish Bhattarai, Ryan Barron, Maksim E. Eren, Minh N. Vu, Vesselin Grancharov, Ismael Ismail, Valentin Stanev, Cynthia Matuszek, Vladimir I Valtchinov, Kim Rasmussen, and Boian S. Alexandrov. 2025. HEAL: Hierarchical embedding alignment loss for improved retrieval and representation learning. In Proceedings of the 4th International Workshop on Knowledge-Augmented Methods for Natural Language Processing, pages 205–214, Albuquerque, New Mexico, USA. Association for Computational Linguistics.

Luiz Bonifacio, Vitor Jeronymo, Hugo Queiroz Abonizio, Israel Campiotti, Marzieh Fadaee, Roberto Lotufo, and Rodrigo Nogueira. 2021. mmarco: A multilingual version of the ms marco passage ranking dataset. arXiv preprint arXiv:2108.13897.

Samuel R. Bowman, Gabor Angeli, Christopher Potts, and Christopher D. Manning. 2015. A large annotated corpus for learning natural language inference. In Proceedings of the 2015 Conference on Empirical Methods in Natural Language Processing, pages 632–642, Lisbon, Portugal. Association for Computational Linguistics.

Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. 2020. Language models are few-shot learners.

Steven Cao, Nikita Kitaev, and Dan Klein. 2020. Multilingual alignment of contextual word representations.

Yiyi Chen, Russa Biswas, Heather Lent, and Johannes Bjerva. 2024a. Against all odds: Overcoming typology, script, and language confusion in multilingual embedding inversion attacks. arXiv preprint arXiv:2408.11749.

Yiyi Chen, Heather Lent, and Johannes Bjerva. 2024b. Text embedding inversion security for multilingual language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7808–7827.

Hyung Won Chung, Le Hou, Shayne Longpre, Barret Zoph, Yi Tay, William Fedus, Yunxuan Li, Xuezhi Wang, Mostafa Dehghani, Siddhartha Brahma, Albert Webson, Shixiang Shang Gu, Zhuyun Dai, Mirac Suzgun, Xinyun Chen, Aakanksha Chowdhery, Alex Castro-Ros, Marie Pellat, Kevin Robinson, Dasha Valter, Sharan Narang, Gaurav Mishra, Adams Yu, Vincent Zhao, Yanping Huang, Andrew Dai, Hongkun Yu, Slav Petrov, Ed H. Chi, Jeff Dean, Jacob Devlin, Adam Roberts, Denny Zhou, Quoc V. Le, and Jason Wei. 2022. Scaling instruction-finetuned language models.
Alexis Conneau, Guillaume Lample, Ruty Rinott, Adina Williams, Samuel R. Bowman, Holger Schwenk, and Veselin Stoyanov. 2018. Xnli: Evaluating cross-lingual sentence representations.

Ona de Gibert, Graeme Nail, Nikolay Arefyev, Marta Bañón, Jelmer van der Linde, Shaoxiong Ji, Jaume Zaragoza-Bernabeu, Mikko Aulamo, Gema Ramírez-Sánchez, Andrey Kutuzov, Sampo Pyysalo, Stephan Oepen, and Jörg Tiedemann. 2024. A new massive multilingual dataset for high-performance language technologies. In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pages 1116–1128, Torino, Italia: ELRA and ICCL.

Jacob Devlin. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805.

Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding.

Minxin Du, Xiang Yue, Sherman SM Chow, and Huan Sun. 2023. Sanitizing sentence embeddings (and labels) for local differential privacy. In Proceedings of the ACM Web Conference 2023, pages 2349–2359.

Cynthia Dwork, Aaron Roth, et al. 2014. The algorithmic foundations of differential privacy. Foundations and Trends® in Theoretical Computer Science, 9(3–4):211–407.

Alec Go, Richa Bhayani, and Lei Huang. 2009. Twitter sentiment classification using distant supervision. CS224N project report, Stanford, 1(12):2009.

Robert M Gray et al. 2006. Toeplitz and circulant matrices: A review. Foundations and Trends® in Communications and Information Theory, 2(3):155–239.

Yu-Hsiang Huang, Yuche Tsai, Hsian Hsiao, Hong-Yi Lin, and Shou-De Lin. 2024. Transferable Embedding Inversion Attack: Uncovering Privacy Risks in Text Embeddings without Model Queries. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 4193–4205, Bangkok, Thailand. Association for Computational Linguistics.

Masoud Jalili Sabet, Philipp Dutter, François Yvon, and Hinrich Schütze. 2020. SimAlign: High quality word alignments without parallel training data using static and contextualized embeddings. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 1627–1643, Online. Association for Computational Linguistics.

Shiva Prasad Kasiviswanathan, Homin K Lee, Kobbi Nissim, Sofya Raskhodnikova, and Adam Smith. 2011. What can we learn privately? SIAM Journal on Computing, 40(3):793–826.

Kevin Krahn, Derrick Tate, and Andrew C. Lamicela. 2023. Sentence embedding models for ancient greek using multilingual knowledge distillation.

Ivana Kvapilíková, Mikel Artetxe, Gorka Labaka, Eneko Agirre, and Ondřej Bojar. 2020. Unsupervised multilingual sentence embeddings for parallel corpus mining. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics: Student Research Workshop, pages 255–262, Online. Association for Computational Linguistics.

Guillaume Lample, Alexis Conneau, Marc’Aurelio Ranzato, Ludovic Denoyer, and Hervé Jégou. 2018. Word translation without parallel data. In International conference on learning representations.

Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY, USA. Curran Associates Inc.

Haoran Li, Mingshi Xu, and Yangqiu Song. 2023. Sentence embedding leaks more information than you expect: Generative embedding inversion attack to recover the whole sentence. In Findings of the Association for Computational Linguistics: ACL 2023, pages 14022–14040, Toronto, Canada. Association for Computational Linguistics.

Chin-Yew Lin. 2004. ROUGE: A package for automatic evaluation of summaries. In Text Summarization Branches Out, pages 74–81, Barcelona, Spain. Association for Computational Linguistics.

Ilya Loshchilov, Frank Hutter, et al. 2017. Fixing weight decay regularization in adam. arXiv preprint arXiv:1711.05101, 5.

Lingjuan Lyu, Xuanli He, and Yitong Li. 2020. Differentially private representation for NLP: Formal guarantee and an empirical study on privacy and fairness. In Findings of the Association for Computational Linguistics: EMNLP 2020, pages 2355–2365, Online. Association for Computational Linguistics.

Tomas Mikolov, Quoc V Le, and Ilya Sutskever. 2013a. Exploiting similarities among languages for machine translation. arXiv preprint arXiv:1309.4168.

Tomas Mikolov, Ilya Sutskever, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013b. Distributed representations of words and phrases and their compositionality. In Proceedings of the 27th International Conference on Neural Information Processing Systems - Volume 2, NIPS’13, page 3111–3119, Red Hook, NY, USA. Curran Associates Inc.

John X Morris, Volodymyr Kuleshov, Vitaly Shmatikov, and Alexander M Rush. 2023. Text embeddings reveal (almost) as much as text. arXiv preprint arXiv:2310.06816.
Jianmo Ni, Chen Qu, Jing Lu, Zhuyun Dai, Gustavo Hernández Ábrego, Ji Ma, Vincent Y. Zhao, Yi Luan, Keith B. Hall, Ming-Wei Chang, and Yinfei Yang. 2021. Large dual encoders are generalizable retrievers.

OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, Irwan Bello, Jake Berdine, Gabriel Bernadett-Shapiro, Christopher Berner, Lenny Bogdonoff, Oleg Boiko, Madelaine Boyd, Anna-Luisa Brakman, Greg Brockman, Tim Brooks, Miles Brundage, Kevin Button, Trevor Cai, Rosie Campbell, Andrew Cann, Brittany Carey, Chelsea Carlson, Rory Carmichael, Brooke Chan, Che Chang, Fotis Chantzis, Derek Chen, Sully Chen, Ruby Chen, Jason Chen, Mark Chen, Ben Chess, Chester Cho, Casey Chu, Hyung Won Chung, Dave Cummings, Jeremiah Currier, Yunxing Dai, Cory Decareaux, Thomas Degry, Noah Deutsch, Damien Deville, Arka Dhar, David Dohan, Steve Dowling, Sheila Dunning, Adrien Ecoffet, Atty Eleti, Tyna Eloundou, David Farhi, Liam Fedus, Niko Felix, Simón Posada Fishman, Justin Forte, Isabella Fulford, Leo Gao, Elie Georges, Christian Gibson, Vik Goel, Tarun Gogineni, Gabriel Goh, Rapha Gontijo-Lopes, Jonathan Gordon, Morgan Grafstein, Scott Gray, Ryan Greene, Joshua Gross, Shixiangane Shang Gu, Yufei Guo, Chris Hallacy, Jesse Han, Jeff Harris, Yuchen He, Mike Heaton, Johannes Heidecke, Chris Hesse, Alan Hickey, Wade Hickey, Peter Hoeschele, Brandon Houghton, Kenny Hsu, Shengli Hu, Xin Hu, Joost Huizinga, Shantanu Jain, Shawn Jain, Joanne Jang, Angela Jiang, Roger Jiang, Haozhoun Jin, Denny Jin, Shino Jomoto, Billie Jonn, Hee woo Jun, Tomer Kaftan, Łukasz Kaiser, Ali Kamali, Ingmar Kanitscheider, Nitish Shirish Keskar, Tabarak Khan, Logan Kilpatrick, Jong Wook Kim, Christina Kim, Yongjik Kim, Jan Hendrik Kirchner, Jamie Kiros, Matt Knight, Daniel Kokotajlo, Łukasz Kondratiuk, Andrew Kondrich, Aris Konstantinidis, Kyle Kosic, Gretchen Krueger, Vishal Kuo, Michael Lampe, IkaI Lan, Teddy Lee, Jan Leike, Jade Leung, Daniel Levy, Chak Ming Li, Rachel Lim, Molly Lin, Stephanie Lin, Mateusz Litwin, Theresa Lopez, Ryan Lowe, Patricia Lue, Anna Makanju, Kim Malfacini, Sam Manning, Todor Markov, Yaniv Markovsky, Bianca Martin, Katie Mayer, Andrew Mayne, Bob McGrew, Scott Mayer McKinney, Christine McLeavey, Paul McMillan, Jake McNeil, David Medina, Aalok Mehta, Jacob Menick, Luke Metz, Andrey Mishchenko, Pamela Mishkin, Vinnie Monaco, Evan Morikawa, Daniel Mossing, Tong Mu, Mira Murati, Oleg Murek, David Mélé, Ashvin Nair, Reiichiro Nakano, Rajeev Nayak, Arvind Neelakantan, Richard Ngo, Hyeonwoo Noh, Long Ouyang, Cullen O’Keefe, Jakub Pachocki, Alex Paino, Joe Palermo, Ashley Pantuliano, Giambattista Parascandolo, Joel Parish, Emry Parparita, Alex Passos, Mikhail Pavlov, Andrew Peng, Adam Perelman, Filipe de Avila Belbute Peres, Michael Petrov, Henrique Ponde de Oliveira Pinto, Michael Pokorny, Michelle Pokrass, Vitchyr H. Pong, Tolly Powell, Alethea Power, Boris Power, Elizabeth Proehl, Raul Puri, Alec Radford, Jack Rae, Aditya Ramesh, Cameron Raymond, Francis Real, Kendra Rimbach, Carl Ross, Bob Rotsted, Henri Roussez, Nick Ryder, Mario Saltarelli, Ted Sanders, Shibani Santurkar, Girish Sastry, Heather Schmidt, David Schnurr, John Schulman, Daniel Selsam, Kyla Sheppard, Toki Sherbakov, Jessica Shieh, Sarah Shoker, Pranav Shyam, Szymon Sidor, Eric Sigler, Maddie Simens, Jordan Sitkin, Katarina Slama, Ian Sohl, Benjamin Sokolowsky, Yang Song, Natalie Staudacher, Felipe Petroski Such, Natalie Summers, Ilya Sutskever, Jie Tang, Nikolas Tezak, Madeleine B. Thompson, Phil Tillett, Amin Tootoonchian, Elizabeth Tseng, Preston Tuggle, Nick Turley, Jerry Tworek, Juan Felipe Cerón Uribe, Andrea Vallone, Arun Vijayvergiya, Chelsea Voss, Carroll Wainwright, Justin Jay Wang, Alvin Wang, Ben Wang, Jonathan Ward, Jason Wei, CJ Weinmann, Akila Welihinda, Peter Welinder, Jiayi Weng, Lilian Weng, Matt Wiethoff, Dave Willner, Clemens Winter, Samuel Wolrich, Hannah Wong, Lauren Workman, Sherwin Wu, Jeff Wu, Michael Wu, Kai Xiao, Tao Xu, Sarah Yoo, Kevin Yu, Qiming Yuan, Wojciech Zaremba, Rowan Zellers, Chong Zhang, Marvin Zhang, Shengjia Zhao, Tianhao Zheng, Juntang Zhuang, William Zhuk, and Barret Zoph. 2024. Gpt-4 technical report.

Alec Radford. 2018. Improving language understanding by generative pre-training.

Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. 2019. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9.

Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J. Liu. 2023. Exploring the limits of transfer learning with a unified text-to-text transformer.

Peter H Schönemann. 1966. A generalized solution of the orthogonal procrustes problem. Psychometrika, 31(1):1–10.

Tal Schuster, Ori Ram, Regina Barzilay, and Amir Globerson. 2019. Cross-lingual alignment of contextual word embeddings, with applications to zero-shot dependency parsing. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 1599–1613, Minneapolis, Minnesota. Association for Computational Linguistics.

Anudeex Shetty, Qiongkai Xu, and Jey Han Lau. 2024. Wet: Overcoming paraphrasing vulnerabilities in embeddings-as-a-service with linear transformation watermarks. arXiv preprint arXiv:2409.04459.

Samuel L Smith, David HP Turban, Steven Hamblin, and Nils Y Hammerla. 2017. Offline bilingual word
vectors, orthogonal transformations and the inverted softmax. arXiv preprint arXiv:1702.03859.

Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pages 1631–1642, Seattle, Washington, USA. Association for Computational Linguistics.

Congzheng Song and Ananth Raghunathan. 2020. Information leakage in embedding models. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, CCS ’20, page 377–390, New York, NY, USA. Association for Computing Machinery.

Hong Wang, Wenhao Xiong, Mo Yu, Xiaoxiao Guo, Shiyu Chang, and William Yang Wang. 2019a. Sentence embedding alignment for lifelong relation extraction. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 796–806, Minneapolis, Minnesota. Association for Computational Linguistics.

Yuxuan Wang, Wanxiang Che, Jiang Guo, Yijia Liu, and Ting Liu. 2019b. Cross-lingual BERT transformation for zero-shot dependency parsing. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 5721–5727, Hong Kong, China. Association for Computational Linguistics.

Julia Wiesinger, Patrick Marlow, and Vladimir Vuskovic. 2025. Agents. Accessed: 2025-01-07.

Linting Xue, Noah Constant, Adam Roberts, Mihir Kale, Rami Al-Rfou, Aditya Siddhant, Aditya Barua, and Colin Raffel. 2021. mT5: A massively multilingual pre-trained text-to-text transformer. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 483–498, Online. Association for Computational Linguistics.

Arihan Yadav and Alan McMillan. 2024. Mind the gap: A generalized approach for cross-modal embedding alignment. arXiv preprint arXiv:2410.23437.

A Derivation of Normal Equation

To determine the optimal alignment matrix \( W \), we aim to minimize a cost function \( J \) that quantifies the discrepancy between the attack embedding matrix \( E_A \) and the transformed victim embeddings \( E_{V \rightarrow A} = E_V W \):

\[
J(W) = \frac{1}{2}(E_A - E_V W)^T(E_A - E_V W)
= \frac{1}{2}(E_A^T E_A - E_A^T E_V W - (E_V W)^T E_A + (E_V W)^T E_V W)
= \frac{1}{2}(E_A^T E_A - E_A^T E_V W - W^T E_V^T E_A + W^T E_V^T E_V W).
\]

(8)

By calculating the derivatives of \( J(W) \), we have

\[
\nabla_W J(W) = \frac{1}{2} \nabla_W (E_A^T E_A - E_A^T E_V W - W^T E_V^T E_V W)
= 2E_V^T E_V W - 2E_V^T E_A.
\]

(9)

The optimized \( W \) is achieved when the derivative is equal to 0,

\[
E_V^T E_V W = E_V^T E_A.
\]

(10)

Then, the matrix \( W \) that minimizes \( J(W) \) is

\[
W = (E_V^T E_V)^{-1} E_V^T E_A.
\]

(11)

B Defense Mechanisms

B.1 WET

\( T \) is constructed by adopting circulant matrices (Gray et al., 2006) to ensure that the transformation matrix is both full-rank and well-conditioned to allow for accurate pseudoinverse computation for recovering the original embeddings from watermarked embeddings (Shetty et al., 2024), refer to Shetty et al. (2024) for the complete algorithm for generating \( T \).

In detail, WET as a defense is applied to aligned embeddings with the equation 12, where \( W \) is the optimal solution for alignment, and \( T \) is invertible.

\[
\text{Norm}(T E_{V \rightarrow A}) = \text{Norm}(T (E_V W)) \\
= \text{Norm}((T E_V) W)
\]

(12)
<table>
  <tr>
    <th>Model</th>
    <th>Huggingface</th>
    <th>Architecture</th>
    <th>#Languages</th>
    <th>Dimension</th>
  </tr>
  <tr>
    <td>FlAN-T5 (Chung et al., 2022)</td>
    <td>google/flan-t5-small</td>
    <td>Encoder-Decoder</td>
    <td>60</td>
    <td>512</td>
  </tr>
  <tr>
    <td>GTR (Ni et al., 2021)</td>
    <td>sentence-transformers/gtr-t5-base</td>
    <td>Encoder</td>
    <td>1</td>
    <td>768</td>
  </tr>
  <tr>
    <td>T5 (Raffel et al., 2023)</td>
    <td>google/t5-base</td>
    <td>Encoder-Decoder</td>
    <td>4</td>
    <td>768</td>
  </tr>
  <tr>
    <td>mT5 (Xue et al., 2021)</td>
    <td>google/mt5-base</td>
    <td>Encoder-Decoder</td>
    <td>102</td>
    <td>768</td>
  </tr>
  <tr>
    <td>mBERT (Devlin et al., 2019)</td>
    <td>google/bert/bert-base-multilingual-cased</td>
    <td>Encoder</td>
    <td>104</td>
    <td>768</td>
  </tr>
  <tr>
    <td>TEXT-EMBEDDING-ADA-002</td>
    <td>OpenAI API</td>
    <td>Encoder</td>
    <td>100+</td>
    <td>1536</td>
  </tr>
  <tr>
    <td>TEXT-EMBEDDING-3-LARGE</td>
    <td>OpenAI API</td>
    <td>Encoder</td>
    <td>100+</td>
    <td>3072</td>
  </tr>
</table>

Table 10: Details of LLMs and Embeddings.

B.2 (Local) Differential Privacy (DP)

As illustrated in Du et al. (2023), DP ensures that a randomized mechanism \( \mathcal{M} \) behaves similarly on any two neighboring datasets \( \mathcal{X} \simeq \mathcal{X}' \) differing in only one individual’s contribution (e.g., a sequence). It is formally defined as follows:

Definition B.1. Let \( \epsilon \geq 0,\ 0 \leq \delta \leq 1 \) be two privacy parameters. \( \mathcal{M} \) fulfills \( (\epsilon, \delta) \)-DP, if \( \forall \mathcal{X} \simeq \mathcal{X}' \) and any output set \( \mathcal{O} \subseteq Range(\mathcal{M}) \),
\[
\Pr[\mathcal{M}(\mathcal{X}) \in \mathcal{O}] \leq e^{\epsilon} \cdot \Pr[\mathcal{M}(\mathcal{X}') \in \mathcal{O}] + \delta.
\]
If \( \delta = 0 \), then we say that \( \mathcal{M} \) is \( \epsilon \)-DP or pure DP.

There are two popular DP settings, central and local. In central DP, a trusted curator can access the raw data of all individuals, apply a Mechanism \( \mathcal{M} \) with random noise to ensure DP, and then release the perturbed outputs. Local DP (LDP) is ensured without the curator by letting individuals perturb their data locally before being shared. The local DP (Kasiviswanathan et al., 2011) is defined as follows:

Definition B.2. Let \( \epsilon \geq 0 \) be a privacy parameter. \( \mathcal{M} \) is \( \epsilon \)-LDP, if for any two private inputs \( \mathcal{X}, \mathcal{X}' \) and any output set \( \mathcal{O} \subseteq Range(\mathcal{M}), \Pr[\mathcal{M}(\mathbf{X}) \in \mathcal{O}] \leq e^{\epsilon} \cdot \Pr[\mathcal{M}(\mathcal{X}') \in \mathcal{O}] \).

However, \( \epsilon - LDP \) offers homogenous protection for all input pairs, which can be too stringent in certain scenarios. When \( \epsilon \) is too small, the noisy outputs are useless for utility tasks.

Thus, Du et al. (2023) customizes heterogeneous privacy guarantees for different pairs of inputs, so called metric-based LDP, formally defined as follows:

Definition B.3. Let \( \epsilon \geq 0 \) be the privacy parameter, and \( d \) be a suitable distance metric for the input space. \( \mathcal{M} \) satisfies \( ed \)-LDP, if for any two inputs \( \mathcal{X}, \mathcal{X}' \) and any output set \( \mathcal{O} \subseteq Range(\mathcal{M}), \Pr[\mathcal{M}(\mathbf{X}) \in \mathcal{O}] \leq e^{ed(\mathbf{X}, \mathbf{X}')} \cdot \Pr[\mathcal{M}(\mathcal{X}') \in \mathcal{O}] \).

Purkayastha Mechanism with Purkayastha distribution and Planar Laplace Mechanism with Euclidean metric, are thus proposed to ensure \( ed \)-LDP on embeddings. Refer to Du et al. (2023) for details in transforming embeddings with these mechanisms.

C Ablation Study of Leakage Data Size

The more data for alignment, the better the performance for ALGEN. However, after a certain amount of data, i.e., 3K, the increase in data samples does not boost the inversion performance. We conduct an ablation study of the sizes of leakage data for alignment in terms of inversion performances. Fig. 6 shows the inversion performance in Cosine Similarity (Top) and Rouge-L (Bottom) with the leakage data sizes from 1 to 8k. As shown in Fig. 6 (Top), embeddings for alignment are the perfect match for cosine similarities from 1 to 100 samples, then they decrease until they converge with the cosine similarities for aligned test embeddings for the corresponding encoder. In Fig. 6 (Top), while the inversion performances in Rouge-L increase with more data points for alignment until 8k across the encoders, the performance increases sharply from 1 to 1k. It becomes relatively stagnant from 2k to 8k. Considering the trade-off between inversion performance and the size of data samples, we choose 1k as the upper bound of the number of data samples for alignment to conduct thorough experimentation in this work.
<table>
  <tr>
    <th>Input</th>
    <td>KOffice Project Reviews Starts: <b>1, 2, 3, 4, 5 [CARDINAL]</b> with comment only In chronological order from new to old - KOffice - OSDN Download.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td><b>DevOps</b> Project Reviews Starts: <b>1, 2, 3, 4, 5 [CARDINAL]</b> with comment only In chronological order from new to old - <b>DevOp</b></td>
  </tr>
  <tr>
    <th>Input</th>
    <td>TripAdvisor [ORG] is proud to partner with <b>Travelocity, Expedia, Hotels.com, Agoda, Booking.com, Price [ORG]</b>.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td><b>TripAdvisor [ORG]</b> is proud to partner with <b>Booking.com, Expedia, Hotels.com, Travelocity, Agoda, Price [ORG]</b></td>
  </tr>
  <tr>
    <th>Input</th>
    <td>Step <b>5 [CARDINAL]:</b> Utilize Windows System Restore to """"Undo"""" Recent System Changes Windows System Restore allows you to """"go back in.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td>Step <b>5 [CARDINAL]:</b> Utilize Windows System Restore to """"Undo"""" Recent System Changes Windows System Restore allows you to """"go back in</td>
  </tr>
  <tr>
    <th>Input</th>
    <td>If you want to ensure you grab a bargain, try to book <b>more than 90 days [DATE]</b> before your stay to get the best price for a Paris [GPE].</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td>If you want to ensure you grab a bargain, try to book <b>more than 90 days [DATE]</b> before your stay to get the best price for a <b>Paris [GPE]</b></td>
  </tr>
  <tr>
    <th>Input</th>
    <td>The Fund’s total amount for the Fund is limited to a maximum of <b>$4,000,000 [MONEY]</b>, and the Fund’s total amount for each transaction is means an amount up to <b>USD 4,000,000 [MONEY]</b>.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td>means an amount up to <b>USD 4,000,000 [MONEY]</b>. <b>for the Winners, the exact amount is subject to the sole and final discretion of</b> the Fund;</td>
  </tr>
  <tr>
    <th>Input</th>
    <td>Microsoft [ORG] is constantly updating and improving <b>Windows [PRODUCT]</b> system files that could be associated with 100street_bkg_bikini_bottom.swf.</td>
  </tr>
  <tr>
    <th>Reconstructed</th>
    <td><b>Microsoft [ORG]</b> is constantly updating and improving <b>Windows [PRODUCT]</b> system files that could be associated with <b>jabber-shp-src.jar. Sometimes</b></td>
  </tr>
</table>

Table 11: Qualitative Analysis of In-Domain Inversion Results from OPENAI (ADA-2) embeddings with 1k alignment data samples and the attack model trained on MultiPHLT English dataset. The matched entities with their entity types are colored and <b>bolded</b> in <b>Input</b> and <b>Reconstructed</b>. The mismatched reconstructed texts are in grey colored box . [GPE]: Countries/cities/states; [ORG]:Organization.
Figure 5: The Analysis of Alignment Transformation Weight (\( \mathbf{W} \)) on Victim Encoders on different datasets.

<table>
  <tr>
    <th>Victim</th>
    <th>Defense</th>
    <th>Rouge-L\(\downarrow\)</th>
    <th>COS\(_1\)</th>
    <th>ACC\(\uparrow\)</th>
    <th>F1\(\uparrow\)</th>
  </tr>
  <tr>
    <td rowspan="3">RANDOM</td>
    <td>-</td>
    <td>6.57</td>
    <td>-0.0108</td>
    <td>56.50</td>
    <td>56.02</td>
  </tr>
  <tr>
    <td>-</td>
    <td>25.06</td>
    <td>0.9359</td>
    <td>89.5</td>
    <td>89.5</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>24.52</td>
    <td>0.9344</td>
    <td>87</td>
    <td>87</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>20.34</td>
    <td>0.9358</td>
    <td>89</td>
    <td>89</td>
  </tr>
  <tr>
    <td rowspan="6">T5</td>
    <td>0.001</td>
    <td>25.15</td>
    <td>0.9355</td>
    <td>89.5</td>
    <td>89.5</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>24.59</td>
    <td>0.9308</td>
    <td>88.5</td>
    <td>88.5</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>22.06</td>
    <td>0.9172</td>
    <td>88</td>
    <td>88</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>12.11</td>
    <td>0.7637</td>
    <td>87.5</td>
    <td>87.5</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>9.57</td>
    <td>0.7092</td>
    <td>79</td>
    <td>79</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>7.03</td>
    <td>0.3169</td>
    <td>59</td>
    <td>59</td>
  </tr>
  <tr>
    <td>1</td>
    <td>7.05</td>
    <td>0.1878</td>
    <td>56.5</td>
    <td>56.41</td>
  </tr>
  <tr>
    <td>-</td>
    <td>18.14</td>
    <td>0.8823</td>
    <td>85.5</td>
    <td>85.5</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>15.69</td>
    <td>0.9178</td>
    <td>84</td>
    <td>83.97</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>14.69</td>
    <td>0.8835</td>
    <td>85.5</td>
    <td>85.5</td>
  </tr>
  <tr>
    <td rowspan="6">GTR</td>
    <td>0.001</td>
    <td>17.22</td>
    <td>0.8804</td>
    <td>85</td>
    <td>84.99</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>17.01</td>
    <td>0.8748</td>
    <td>85</td>
    <td>84.99</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>15.09</td>
    <td>0.8489</td>
    <td>85</td>
    <td>84.99</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>9.91</td>
    <td>0.7136</td>
    <td>83.5</td>
    <td>83.5</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>9.18</td>
    <td>0.6505</td>
    <td>76</td>
    <td>75.91</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>7.53</td>
    <td>0.2297</td>
    <td>55</td>
    <td>54.93</td>
  </tr>
  <tr>
    <td>1</td>
    <td>6.62</td>
    <td>0.0293</td>
    <td>49</td>
    <td>48.87</td>
  </tr>
  <tr>
    <td>-</td>
    <td>21.83</td>
    <td>0.9320</td>
    <td>79.5</td>
    <td>79.47</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>21.04</td>
    <td>0.9307</td>
    <td>80</td>
    <td>79.93</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>18.19</td>
    <td>0.9321</td>
    <td>78.5</td>
    <td>78.47</td>
  </tr>
  <tr>
    <td rowspan="6">mT5</td>
    <td>0.001</td>
    <td>22.13</td>
    <td>0.9327</td>
    <td>77.5</td>
    <td>77.43</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>21.71</td>
    <td>0.9277</td>
    <td>80</td>
    <td>79.99</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>18.97</td>
    <td>0.9119</td>
    <td>79.5</td>
    <td>79.41</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>9.72</td>
    <td>0.7410</td>
    <td>77.5</td>
    <td>77.34</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>8.83</td>
    <td>0.6924</td>
    <td>64</td>
    <td>62.79</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>7.55</td>
    <td>0.2407</td>
    <td>51</td>
    <td>50.98</td>
  </tr>
  <tr>
    <td>1</td>
    <td>6.55</td>
    <td>0.1930</td>
    <td>49</td>
    <td>48.95</td>
  </tr>
  <tr>
    <td>-</td>
    <td>20.44</td>
    <td>0.9211</td>
    <td>76.5</td>
    <td>76.06</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>20.19</td>
    <td>0.9261</td>
    <td>77</td>
    <td>76.66</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>17.07</td>
    <td>0.9209</td>
    <td>76</td>
    <td>75.59</td>
  </tr>
  <tr>
    <td rowspan="6">mBERT</td>
    <td>0.001</td>
    <td>20.32</td>
    <td>0.9209</td>
    <td>76.5</td>
    <td>76.06</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>20.01</td>
    <td>0.9156</td>
    <td>77</td>
    <td>76.6</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>18.22</td>
    <td>0.9018</td>
    <td>76</td>
    <td>75.59</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>10.97</td>
    <td>0.7320</td>
    <td>69.5</td>
    <td>68.54</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>8.6</td>
    <td>0.6851</td>
    <td>64.5</td>
    <td>64.02</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>7.06</td>
    <td>0.3407</td>
    <td>59.5</td>
    <td>59.5</td>
  </tr>
  <tr>
    <td>1</td>
    <td>6.12</td>
    <td>0.0838</td>
    <td>46</td>
    <td>45.86</td>
  </tr>
  <tr>
    <td>-</td>
    <td>20.15</td>
    <td>0.9309</td>
    <td>92</td>
    <td>92</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>15.83</td>
    <td>0.9258</td>
    <td>91</td>
    <td>91</td>
  </tr>
  <tr>
    <td>Shuffling</td>
    <td>17.74</td>
    <td>0.9311</td>
    <td>91.5</td>
    <td>91.5</td>
  </tr>
  <tr>
    <td rowspan="6">OPENAI (ADA-2)</td>
    <td>0.001</td>
    <td>20.11</td>
    <td>0.9308</td>
    <td>91</td>
    <td>91</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>20.01</td>
    <td>0.9300</td>
    <td>91</td>
    <td>91</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>17.57</td>
    <td>0.9179</td>
    <td>90</td>
    <td>90</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>9.39</td>
    <td>0.7787</td>
    <td>82.5</td>
    <td>82.5</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>8.07</td>
    <td>0.7502</td>
    <td>71</td>
    <td>70.9</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>7.81</td>
    <td>0.4743</td>
    <td>51.5</td>
    <td>51.4</td>
  </tr>
  <tr>
    <td>1</td>
    <td>5.92</td>
    <td>0.1324</td>
    <td>53.5</td>
    <td>52.2</td>
  </tr>
</table>

Table 12: The Inversion and Utility Performance on Classification Tasks on SST2 dataset with WET, Shuffling, Guassian Noise Insertion. From a defender’s perspective, \( \uparrow \) means higher are better, \( \downarrow \) means lower are better.
Figure 6: Inversion Performance vs. Leakage Data (Alignment) Sizes. (Top) shows the cosine similarities for embeddings of alignment data (dashed) and for embeddings of test data by the size of alignment data. (Bottom) shows the Rouge-L scores for the reconstructed texts compared to the original texts.
<table>
  <tr>
    <th>Victim</th>
    <th>Defense</th>
    <th>Rouge-L↓</th>
    <th>COS↓</th>
    <th>ACC↑</th>
    <th>F1↑</th>
  </tr>
  <tr>
    <td rowspan="3">RANDOM</td>
    <td>-</td>
    <td>5.01</td>
    <td>0.0275</td>
    <td>48.5</td>
    <td>48.13</td>
  </tr>
  <tr>
    <td>-</td>
    <td>23.04</td>
    <td>0.9219</td>
    <td>71.5</td>
    <td>70.37</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>19.86</td>
    <td>0.9186</td>
    <td>69</td>
    <td>67.42</td>
  </tr>
  <tr>
    <td rowspan="7">T5</td>
    <td>Shuffling</td>
    <td>17.56</td>
    <td>0.9245</td>
    <td>71</td>
    <td>70.03</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>22.05</td>
    <td>0.9230</td>
    <td>71.5</td>
    <td>70.37</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>21.11</td>
    <td>0.9188</td>
    <td>70.5</td>
    <td>69.45</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>18.29</td>
    <td>0.9078</td>
    <td>69</td>
    <td>67.84</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>8.85</td>
    <td>0.7561</td>
    <td>68</td>
    <td>66.8</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>7.6</td>
    <td>0.6901</td>
    <td>59.5</td>
    <td>58.86</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>4.97</td>
    <td>0.2678</td>
    <td>46</td>
    <td>45.95</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.85</td>
    <td>0.1101</td>
    <td>50.5</td>
    <td>50.47</td>
  </tr>
  <tr>
    <td>-</td>
    <td>13.22</td>
    <td>0.8585</td>
    <td>70.5</td>
    <td>68.45</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>12.15</td>
    <td>0.8861</td>
    <td>71.5</td>
    <td>69.35</td>
  </tr>
  <tr>
    <td rowspan="7">GTR</td>
    <td>Shuffling</td>
    <td>11.69</td>
    <td>0.8599</td>
    <td>70</td>
    <td>68</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>13.59</td>
    <td>0.8594</td>
    <td>69.5</td>
    <td>67.38</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>12.86</td>
    <td>0.8515</td>
    <td>70</td>
    <td>68.17</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>12.11</td>
    <td>0.8260</td>
    <td>71</td>
    <td>69.23</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>7.92</td>
    <td>0.7055</td>
    <td>70.5</td>
    <td>69.21</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>5.8</td>
    <td>0.6137</td>
    <td>64</td>
    <td>63.28</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>4.6</td>
    <td>0.3075</td>
    <td>56.5</td>
    <td>56.47</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.23</td>
    <td>0.0582</td>
    <td>53</td>
    <td>52.83</td>
  </tr>
  <tr>
    <td>-</td>
    <td>19.82</td>
    <td>0.9212</td>
    <td>68</td>
    <td>66.8</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>18.4</td>
    <td>0.9219</td>
    <td>63</td>
    <td>61.61</td>
  </tr>
  <tr>
    <td rowspan="7">mT5</td>
    <td>Shuffling</td>
    <td>16.51</td>
    <td>0.9215</td>
    <td>66.5</td>
    <td>65.44</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>20.4</td>
    <td>0.9217</td>
    <td>67.5</td>
    <td>66.47</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>18.82</td>
    <td>0.9173</td>
    <td>67</td>
    <td>65.89</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>16.48</td>
    <td>0.9037</td>
    <td>65.5</td>
    <td>64.28</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>8.09</td>
    <td>0.7625</td>
    <td>58.5</td>
    <td>57.03</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>7.02</td>
    <td>0.6852</td>
    <td>60</td>
    <td>59.6</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>5.13</td>
    <td>0.3770</td>
    <td>55.5</td>
    <td>55.31</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.21</td>
    <td>0.1505</td>
    <td>42</td>
    <td>41.99</td>
  </tr>
  <tr>
    <td>-</td>
    <td>17.88</td>
    <td>0.9070</td>
    <td>64.5</td>
    <td>64.18</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>16.83</td>
    <td>0.9151</td>
    <td>63</td>
    <td>62.63</td>
  </tr>
  <tr>
    <td rowspan="7">mBERT</td>
    <td>Shuffling</td>
    <td>13.8</td>
    <td>0.9062</td>
    <td>63.5</td>
    <td>63.29</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>17.83</td>
    <td>0.9077</td>
    <td>64</td>
    <td>63.77</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>17.01</td>
    <td>0.9020</td>
    <td>64.5</td>
    <td>64.24</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>15.44</td>
    <td>0.8901</td>
    <td>63.5</td>
    <td>63.17</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>8.47</td>
    <td>0.7498</td>
    <td>60.5</td>
    <td>60.21</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>7.26</td>
    <td>0.6876</td>
    <td>52</td>
    <td>50.39</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>5.25</td>
    <td>0.2904</td>
    <td>50</td>
    <td>49.68</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.34</td>
    <td>0.1619</td>
    <td>55.5</td>
    <td>55.31</td>
  </tr>
  <tr>
    <td>-</td>
    <td>17.13</td>
    <td>0.9224</td>
    <td>71.5</td>
    <td>70.12</td>
  </tr>
  <tr>
    <td>WET</td>
    <td>14.19</td>
    <td>0.9237</td>
    <td>69.5</td>
    <td>67.55</td>
  </tr>
  <tr>
    <td rowspan="7">OPENAI (ADA-2)</td>
    <td>Shuffling</td>
    <td>15.97</td>
    <td>0.9229</td>
    <td>71</td>
    <td>69.53</td>
  </tr>
  <tr>
    <td>0.001</td>
    <td>17.12</td>
    <td>0.9225</td>
    <td>71</td>
    <td>69.53</td>
  </tr>
  <tr>
    <td>0.005</td>
    <td>17.19</td>
    <td>0.9208</td>
    <td>72.5</td>
    <td>71.17</td>
  </tr>
  <tr>
    <td>0.01</td>
    <td>14.8</td>
    <td>0.9100</td>
    <td>71.5</td>
    <td>70.12</td>
  </tr>
  <tr>
    <td>0.05</td>
    <td>7.4</td>
    <td>0.7974</td>
    <td>74</td>
    <td>73.13</td>
  </tr>
  <tr>
    <td>0.1</td>
    <td>6.42</td>
    <td>0.7691</td>
    <td>67.5</td>
    <td>67.4</td>
  </tr>
  <tr>
    <td>0.5</td>
    <td>5.36</td>
    <td>0.4271</td>
    <td>53.5</td>
    <td>53.16</td>
  </tr>
  <tr>
    <td>1</td>
    <td>5.27</td>
    <td>0.1753</td>
    <td>55.5</td>
    <td>54.09</td>
  </tr>
</table>

Table 13: The Inversion and Utility Performance on Classification Tasks on S140 dataset with WET, Shuffling, Guassian Noise Insertion. From a defender’s perspective, ↑ means higher are better, ↓ means lower are better.
<table>
  <tr>
    <th>Victim Model</th>
    <th>&epsilon;</th>
    <th></th>
    <th colspan="6">Rouge-L</th>
    <th colspan="4">COS</th>
    <th colspan="6">Other Metrics (ACC, F1)</th>
  </tr>
  <tr>
    <td rowspan="2"></td>
    <td rowspan="2"></td>
    <td rowspan="2"></td>
    <th colspan="6">LapMech</th>
    <th colspan="4"></th>
    <th colspan="6">PurMech</th>
  </tr>
  <tr>
    <th>COS</th>
    <th>ACC</th>
    <th>F1</th>
    <th>Rouge-L</th>
    <th>COS</th>
    <th>ACC</th>
    <th>F1</th>
  </tr>
  <tr>
    <td rowspan="4">T5</td>
    <td>-.1</td>
    <td>25.06</td>
    <td>0.9359</td>
    <td>89.5</td>
    <td>89.5</td>
    <td>23.04</td>
    <td>0.9219</td>
    <td>71.5</td>
    <td>70.37</td>
  </tr>
  <tr>
    <td>1</td>
    <td>6.84</td>
    <td>0.0103</td>
    <td>54.5</td>
    <td>54.5</td>
    <td>4.19</td>
    <td>-0.0235</td>
    <td>55</td>
    <td>54.93</td>
  </tr>
  <tr>
    <td>4</td>
    <td>5.94</td>
    <td>-0.0660</td>
    <td>76</td>
    <td>75.96</td>
    <td>4.48</td>
    <td>0.0322</td>
    <td>63.5</td>
    <td>63.39</td>
  </tr>
  <tr>
    <td>8</td>
    <td>6.53</td>
    <td>0.0526</td>
    <td>84.5</td>
    <td>84.5</td>
    <td>4.29</td>
    <td>-0.1135</td>
    <td>61</td>
    <td>70.03</td>
  </tr>
  <tr>
    <td>12</td>
    <td>6.78</td>
    <td>0.0551</td>
    <td>89.5</td>
    <td>89.49</td>
    <td>4.29</td>
    <td>-0.0210</td>
    <td>71</td>
    <td>70.03</td>
  </tr>
  <tr>
    <td rowspan="4">GTR</td>
    <td>.1</td>
    <td>18.14</td>
    <td>0.8823</td>
    <td>85.5</td>
    <td>85.5</td>
    <td>13.22</td>
    <td>0.8585</td>
    <td>70.5</td>
    <td>68.45</td>
  </tr>
  <tr>
    <td>1</td>
    <td>5.86</td>
    <td>-0.0213</td>
    <td>55.5</td>
    <td>55.5</td>
    <td>4.29</td>
    <td>-0.0079</td>
    <td>50</td>
    <td>49.82</td>
  </tr>
  <tr>
    <td>4</td>
    <td>6.64</td>
    <td>0.0232</td>
    <td>73</td>
    <td>72.98</td>
    <td>4.55</td>
    <td>-0.0066</td>
    <td>61</td>
    <td>58.4</td>
  </tr>
  <tr>
    <td>8</td>
    <td>6.75</td>
    <td>0.0172</td>
    <td>83</td>
    <td>82.99</td>
    <td>4.82</td>
    <td>-0.0179</td>
    <td>67</td>
    <td>65.16</td>
  </tr>
  <tr>
    <td>12</td>
    <td>7.05</td>
    <td>0.0157</td>
    <td>84</td>
    <td>84</td>
    <td>4.85</td>
    <td>0.0439</td>
    <td>70</td>
    <td>68.75</td>
  </tr>
  <tr>
    <td rowspan="4">mT5</td>
    <td>.1</td>
    <td>21.83</td>
    <td>0.9320</td>
    <td>79.5</td>
    <td>79.47</td>
    <td>17.13</td>
    <td>0.9224</td>
    <td>71.5</td>
    <td>70.12</td>
  </tr>
  <tr>
    <td>1</td>
    <td>7.18</td>
    <td>-0.0850</td>
    <td>54</td>
    <td>53.98</td>
    <td>3.89</td>
    <td>-0.0560</td>
    <td>55</td>
    <td>54.93</td>
  </tr>
  <tr>
    <td>4</td>
    <td>6.78</td>
    <td>0.0471</td>
    <td>69.5</td>
    <td>69.49</td>
    <td>4.09</td>
    <td>-0.0255</td>
    <td>66.5</td>
    <td>65.03</td>
  </tr>
  <tr>
    <td>8</td>
    <td>6.75</td>
    <td>-0.0008</td>
    <td>78</td>
    <td>78</td>
    <td>4.9</td>
    <td>-0.0166</td>
    <td>68.5</td>
    <td>66.66</td>
  </tr>
  <tr>
    <td>12</td>
    <td>6.71</td>
    <td>0.0638</td>
    <td>81</td>
    <td>80.95</td>
    <td>5.3</td>
    <td>0.1235</td>
    <td>69.5</td>
    <td>67.72</td>
  </tr>
  <tr>
    <td rowspan="4">mBERT</td>
    <tdchtsied
    <td>1</td>
    <td>.20.44</td>
    <td>0.9211</td>
    <td>76.5</td>
    <td>76.06</td>
    <td>17.88</td>
    <td>0.9070</td>
    <td>64.5</td>
    <td>64.18</td>
  </tr>
  <tr>
    <td>4.</td>
    <td>6.59</td>
    <td>0.0182</td>
    <td>50.5</td>
    <td>50.5</td>
    <td>4.23</td>
    <td>0.0215</td>
    <td>49.5</td>
    <td>49.5</td>
  </tr>
  <tr>
    <td>8</td>
    <td>6.11</td>
    <td>-0.1486</td>
    <td>70</td>
    <td>69.97</td>
    <td>4.6</td>
    <td>-0.0190</td>
    <td>63.5</td>
    <td>63.46</td>
  </tr>
  <tr>
    <td>12</td>
    <td>6.76</td>
    <td>-0.0680</td>
    <td>76</td>
    <td>75.8</td>
    <td>4.26</td>
    <td>0.0942</td>
    <td>63</td>
    <td>62.91</td>
  </tr>
  <tr>
    <td>12</td>
    <td>6.55</td>
    <td>0.0483</td>
    <td>78</td>
    <td>77.68</td>
    <td>4.66</td>
    <td>-0.0340</td>
    <td>62</td>
    <td>61.69</td>
  </tr>
  <tr>
    <td></td>
    <td>20.15</td>
    <td>0.9109</td>
    <td>92</td>
    <td>92</td>
    <td>19.82</td>
    <td>0.9212</td>
    <td>68</td>
    <td>66.8</td>
  </tr>
  <tr>
    <td rowspan="4">OpenAI (ADA-2)<</td>
    <td>1</td>
    <td>6.06</td>
    <td>0.0289</td>
    <td>50.5</td>
    <td>50.47</td>
    <td>4.52</td>
    <td>0.0507</td>
    <td>53</td>
    <td>52.98</td>
  </tr>
  <tr>
    <td>4</td>
    <td>6.56</td>
    <td>0.0336</td>
    <td>79</td>
    <td>79</td>
    <td>4.14</td>
    <td>-0.0377</td>
    <td>63.5</td>
    <td>62.6</td>
  </tr>
  <tr>
    <td>8</td>
    <td>6.65</td>
    <td>0.1389</td>
    <td>90.5</td>
    <td>90.5</td>
    <td>4.31</td>
    <td>0.0997</td>
    <td>67</td>
    <td>65.76</td>
  </tr>
  <tr>
    <td>12</td>
    <td>6.01</td>
    <td>-0.0267</td>
    <td>94.5</td>
    <td>94.5</td>
    <td>4.24</td>
    <td>0.0022</td>
    <td>66</td>
    <td>64.99</td>
  </tr>
</table>

Table 14: The Inversion and Utility Performance on Classification Tasks on SST2 dataset with local DP. From a defender’s perspective, ↑ means higher are better, ↓ means lower are better.

<table>
  <tr>
    <th>Victim Model</th>
    <th>&epsilon;</th>
    <th></th>
    <th colspan="6">Rouge-L</th>
    <th colspan="4">Other Metrics (ACC, F1)</th>
  </tr>
  <tr>
    <td rowspan="2"></td>
    <td rowspan="2"></td>
    <td rowspan="2"></td>
    <th colspan="6">LapMech</th>
    <th colspan="4"></th>
    <th colspan="6">PurMech</th>
  </tr>
  <tr>
    <th>COS</th>
    <th>ACC</th>
    <th>F1</th>
    <th>Rouge-L</th>
    <th>COS</th>
    <th>ACC</th>
    <th>F1</th>
  </tr>
  <tr>
    <td rowspan="4">T5</td>
    <td>-.1</td>
    <td>23.04</td>
    <td>0.9219</td>
    <td>71.5</td>
    <td>70.37</td>
    <td>23.04</td>
    <td>0.9219</td>
    <td>71.5</td>
    <td>70.37</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.23</td>
    <td>0.0109</td>
    <td>52.5</td>
    <td>52.49</td>
    <td>4.19</td>
    <td>-0.0235</td>
    <td>55</td>
    <td>54.93</td>
  </tr>
  <tr>
    <td>4</td>
    <td>4.23</td>
    <td>-0.0526</td>
    <td>61.5</td>
    <td>60.67</td>
    <td>4.48</td>
    <td>0.0322</td>
    <td>63.5</td>
    <td>63.39</td>
  </tr>
  <tr>
    <td>8</td>
    <td>4.19</td>
    <td>0.0457</td>
    <td>65.5</td>
    <td>67.5</td>
    <td>4.29</td>
    <td>-0.1135</td>
    <td>71</td>
    <td>70.03</td>
  </tr>
  <tr>
    <td>12</td>
    <td>4.33</td>
    <td>0.0082</td>
    <td>72</td>
    <td>71.06</td>
    <td>4.29</td>
    <td>-0.0210</td>
    <td>71</td>
    <td>70.03</td>
  </tr>
  <tr>
    <td rowspan="4">GTR</td>
    <td>.1</td>
    <td>13.22</td>
    <td>0.8585</td>
    <td>70.5</td>
    <td>68.45</td>
    <td>13.22</td>
    <td>0.8558</td>
    <td>70.5</td>
    <td>68.45</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.54</td>
    <td>-0.0107</td>
    <td>51</td>
    <td>50.82</td>
    <td>4.29</td>
    <td>-0.0079</td>
    <td>50</td>
    <td>49.82</td>
  </tr>
  <tr>
    <td>4</td>
    <td>4.89</td>
    <td>0.0035</td>
    <td>61.5</td>
    <td>59.81</td>
    <td>4.55</td>
    <td>-0.0066</td>
    <td>61</td>
    <td>58.4</td>
  </tr>
  <tr>
    <td>8</td>
    <td>4.55</td>
    <td>0.0415</td>
    <td>67</td>
    <td>65.48</td>
    <td>4.82</td>
    <td>-0.0179</td>
    <td>67</td>
    <td>65.16</td>
  </tr>
  <tr>
    <td>12</td>
    <td>4.64</td>
    <td>0.0673</td>
    <td>70.5</td>
    <td>68.93</td>
    <td>4.85</td>
    <td>0.0439</td>
    <td>70</td>
    <td>68.75</td>
  </tr>
  <tr>
    <td rowspan="4">mT5</td>
    <td>.1</td>
    <td>19.82</td>
    <td>0.9212</td>
    <td>68</td>
    <td>66.8</td>
    <td>19.82</td>
    <td>0.9212</td>
    <td>68</td>
    <td>66.8</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.54</td>
    <td>-0.0600</td>
    <td>47</td>
    <td>46.99</td>
    <td>4.52</td>
    <td>0.0507</td>
    <td>53</td>
    <td>52.98</td>
  </tr>
  <tr>
    <td>4</td>
    <td>4.31</td>
    <td>0.0432</td>
    <td>61.5</td>
    <td>60.67</td>
    <td>4.14</td>
    <td>-0.0377</td>
    <td>63.5</td>
    <td>62.6</td>
  </tr>
  <tr>
    <td>8</td>
    <td>4.85</td>
    <td>0.0386</td>
    <td>65.5</td>
    <td>64.86</td>
    <td>4.31</td>
    <td>0.0997</td>
    <td>67</td>
    <td>65.76</td>
  </tr>
  <tr>
    <td>12</td>
    <td>4.62</td>
    <td>0.1038</td>
    <td>66</td>
    <td>64.99</td>
    <td>4.24</td>
    <td>0.0022</td>
    <td>66</td>
    <td>64.99</td>
  </tr>
  <tr>
    <td rowspan="4">mBERT</td>
    <td>.1</td>
    <td>17.88</td>
    <td>0.9070</td>
    <td>64.5</td>
    <td>64.18</td>
    <td>4.66</td>
    <td>-0.0340</td>
    <td>62</td>
    <td>61.69</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.6</td>
    <td>0.0153</td>
    <td>54</td>
    <td>54</td>
    <td>17.88</td>
    <td>0.9070</td>
    <td>64.5</td>
    <td>64.18</td>
  </tr>
  <tr>
    <td>4</td>
    <td>5</td>
    <td>0.1196</td>
    <td>59</td>
    <td>58.9</td>
    <td>4.23</td>
    <td>0.0215</td>
    <td>49.5</td>
    <td>49.5</td>
  </tr>
  <tr>
    <td>8</td>
    <td>4.4</td>
    <td>0.0156</td>
    <td>60.5</td>
    <td>60.28</td>
    <td>4.6</td>
    <td>-0.0190</td>
    <td>63.5</td>
    <td>63.46</td>
  </tr>
  <tr>
    <td>12</td>
    <td>4.76</td>
    <td>0.0117</td>
    <td>61.5</td>
    <td>61.45</td>
    <td>4.26</td>
    <td>0.0942</td>
    <td>63</td>
    <td>62.91</td>
  </tr>
  <tr>
    <td rowspan="4">OpenAI(ADA-2)</td>
    <td>.1</td>
    <td>17.13</td>
    <td>0.9223</td>
    <td>71.5</td>
    <td>70.12</td>
    <td>17.13</td>
    <td>0.9224</td>
    <td>71.5</td>
    <td>70.12</td>
  </tr>
  <tr>
    <td>1</td>
    <td>4.45</td>
    <td>0.0041</td>
    <td>53</td>
    <td>52.83</td>
    <td>3.89</td>
    <td>-0.0560</td>
    <td>55</td>
    <td>54.93</td>
  </tr>
  <tr>
    <td>4</td>
    <td>4.84</td>
    <td>0.0572</td>
    <td>63</td>
    <td>62.46</td>
    <td>4.09</td>
    <td>-0.0255</td>
    <td>66.5</td>
    <td>65.03</td>
  </tr>
  <tr>
    <td>8</td>
    <td>4.66</td>
    <td>-0.0191</td>
    <td>68.5</td>
    <td>66.97</td>
    <td>4.9</td>
    <td>0.0166</td>
    <td>68.5</td>
    <td>66.66</td>
  </tr>
  <tr>
    <td>12</td>
    <td>4.84</td>
    <td>0.0782</td>
    <td>71.5</td>
    <td>69.83</td>
    <td>5.3</td>
    <td>0.1235</td>
    <td>69.5</td>
    <td>67.72</td>
  </tr>
</table>

Table 15: The Inversion and Utility Performance on Classification Tasks on S140 dataset with local DP. From a defender’s perspective, ↑ means higher are better, ↓ means lower are better.

Reviewer paper summaries: This paper investigates Few-shot Textual Embedding Inversion Attacks, demonstrating that even minimal leaked data can be used to reconstruct private text from embeddings. The authors propose ALGEN, a novel attack framework that aligns victim embeddings to an attacker’s space and generates text using a pretrained model. Experiments on multiple victim models, including T5, MT5, and OpenAI’s ADA-2, reveal the effectiveness of ALGEN in black-box settings. The study also evaluates various defense mechanisms, showing their limited success in preventing inversion attacks, highlighting significant privacy risks in embedding-based applications.

This paper proposes a simple yet effective textual embedding inversion method. Specifically, the authors first train a model on an easily accessible dataset. After training, they focus on aligning it with the embedding space of the targeted models. Comprehensive experiments are conducted to verify the effectiveness of the proposed method.

The authors introduce an inversion attack (ALGEN) which is able to reconstruct sensitive information from intercepted encoded embeddings. ALGEN learns to decode embeddings first, then learns to map intercepted embeddings to its own embedding space where it can then decode the information. Even with a limited amount of compromised embeddings, ALGEN is able to extract some information. This could prove a threat to publically available vector databases which are often leveraged by LLMs. Through experimentation, the authors demonstrate ALGEN’s effectiveness in its attack goals.
Summary of strengths: This paper presents a novel and effective few-shot inversion attack method, ALGEN, achieving high reconstruction accuracy with minimal data. It provides thorough experimental validation across multiple models and languages, along with qualitative analyses using Named Entity Recognition (NER) to assess privacy risks. Additionally, the study systematically evaluates defense mechanisms, demonstrating their weaknesses and emphasizing the need for stronger privacy safeguards in embedding-based systems.

1. The proposed method is simple and easy to follow. The alignment process does not require a large amount of training data. In fact, as mentioned in the paper, fewer than 1,000 samples are sufficient. Moreover, the alignment is explainable, providing insights into the rationale behind the attack method.

2. The experiments are comprehensive. The authors conduct a wide range of experiments, covering various models, languages, and transferability aspects. They also evaluate their attacks against defense methods. These experiments sufficiently demonstrate the effectiveness of their approach.

- The proposed attack is straight-forward and easy to understand. 
- The authors show the strength of the proposed attack using 6 LLM models and showing it outperforms a previous inversion attack method Vec2Text.
- The authors investigate several questions via ablation studies to further expand on and strengthen their results.
Summary of weaknesses: We appreciate the authors' efforts; the paper is well-written and easy to understand, with almost no flaws. The method is very simple, essentially calculating a static W matrix to map the embeddings of the victim model and the attack model. The paper points out that only one piece of data is needed to compute the matrix to achieve certain results. We are skeptical of such a simple method, as previous research has required the addition of regularization terms to prevent overfitting and to generalize from small datasets to large datasets. Therefore, we have lowered our confidence and leave it to other reviewers to decide.

In addition, we raise the following minor issues:
1. The related work on Embedding Alignment literature needs to be updated.
2. When computing W, has the tendency of different label mappings been considered? For example, using label A to compute W, would it ultimately tend to obtain data with label A during the attack?
3. If possible, we would like an explanation of why a static matrix, without adding regularization terms, can achieve good attack/generalization effects with just one computation.

1.	I recommend that the authors provide more detailed captions for their tables. When I first read the table, I found it confusing until I read the main text.

2.  The compared baselines are insufficient; I hope the authors can include comparisons with more methods, such as [1]. However, given the impressive performance demonstrated in this work, I consider this a minor issue.


[1] Li, H., Xu, M., & Song, Y. (2023, July). Sentence Embedding Leaks More Information than You Expect: Generative Embedding Inversion Attack to Recover the Whole Sentence. In Findings of ACL 2023.

- Some additional discussion details are missing which would strengthen the paper:
    - The cosine similarities for even 1 alignment sample are very high for ALGEN compared to Vec2Text. Some additional insights on this would be good. What makes ALGEN much more effective at this step compared to the previous baseline. This would help highlight the additional strength of the attack.
    - An explicit threat model which details the exact knowledge an attacker has access to, would help future readers/researchers to replicate/extend the current work. Some of the needed information already exists in Methodology (line 214).
Comments, suggestions and typos: See Summary Of Weaknesses

Vec2Text seems to have their pre-trained inversion models, do you perform vec2text with their model weights? The results of Vec2Text reported in their original paper seem impressive (BLEU score is even greater than 90). However, your reported results of Vec2Text have no more than 30 BLEU-1 score.

Typos:
- Line 267 “black-box viticm” 
- Line 325 “alignment metrix” 
- Line 357 “multi-layer perception”

Minor layout suggestion:
- Define Vec2Text earlier before the results, otherwise the reader has to go search for this since the table of results appears a full page before you first talk about the method.
Overall assessment scores: 3

3.5

3.5