Text Embedding Inversion Security for Multilingual Language Models (2024)

Abstract: Textual data is often represented as realnumbered embeddings in NLP, particularly with the popularity of large language models (LLMs) and Embeddings as a Service (EaaS). However, storing sensitive information as embeddings can be susceptible to security breaches, as research shows that text can be reconstructed from embeddings, even without knowledge of the underlying model. While defence mechanisms have been explored, these are exclusively focused on English, leaving other languages potentially exposed to attacks. This work explores LLM security through multilingual embedding inversion. We define the problem of black-box multilingual and crosslingual inversion attacks, and explore their potential implications. Our findings suggest that multilingual LLMs may be more vulnerable to inversion attacks, in part because English-based defences may be ineffective. To alleviate this, we propose a simple masking defense effective for both monolingual and multilingual models. This study is the first to investigate multilingual inversion attacks, shedding light on the differences in attacks and defenses across monolingual and multilingual settings.

heading: 1 Introduction
text: Industrial applications of natural language processing (NLP) typically utilize language models (LMs) and often rely on vector databases via frameworks such as Embeddings as a Service (EaaS). In this context, sentence embeddings are stored in a remote database, as opposed to raw text, allowing end-users to efficiently search across condensed representations. As embeddings are not humanreadable, security of the encoded information may be naively assumed, however recent works have demonstrated that embeddings are no safer than raw text; they are susceptible to inversion attacks, whereby a malicious actor can train models to decode embeddings, thus exposing private information (Song and Raghunathan, 2020; Morris et al.,
2023; Zhou et al., 2023). Concretely, after gaining access to embeddings and the black-box embedder via the EaaS API, the malicious actor can train an external model, which approximates the inversion function that reconstructs the text from the embeddings. As such, there is a substantial threat to privacy if malicious actors are able to eavesdrop on communication channels between EaaS providers and customers, as illustrated in Figure 2.
Previous work has shown that an exact match for data recreation can be obtained in specific settings, albeit with the limitation of assuming monolingual English models and embeddings (Morris et al., 2023). However, in real-world scenarios, eavesdroppers may not know the source language of the encoded text, as EaaS providers can have international clientele. Thus to assess the current level of risk posed to multilingual LMs, we introduce multilingual inversion attacks. As the first ever study in this direction, we focus specifically on exact text reconstruction, assuming that the lan-
7808
guage of a target embedding is unknown. Leveraging a state-of-the-art multilingual black-box encoder, we find that the trained model can reconstruct texts in certain languages more effectively than monolingual counterparts. Additionally, we also introduce cross-lingual inversion attacks, to ascertain whether inversion attacks can be successful when the target language is unknown by the attacker. We thus attempt cross-lingual text reconstruction (i.e., reconstructing German text with a model not trained on German reconstruction), introducing an Ad hoc Translation method to overcome the evaluation limitation of current string-matching metrics in this cross-lingual scenario. Finally, we assess the efficacy of an existing defense method by Morris et al. (2023), ultimately finding that defenses intended for monolingual models fall short in protecting multilingual models. To this end, we introduce simple masking defense, which proves effective for both monolingual and multilingual models, and which also does not require additional model training. All our trained inversion models 1 and code 2 are open source, encouraging the research community to engage in development of defenses for vulnerable multilingual models.

heading: 2 Related Work
text: Models are well known to memorize training data, and are therefore susceptible to leaking private information (Shokri et al., 2016; Carlini et al., 2018; Nasr et al., 2019). As such, there is increased research interest in exploring this vulnerability to inversion attacks from the perspective of cybersecurity, simulating attacks against models to recreate sensitive training data. Work in this direction has been conducted across various domains of machine learning, such as computational genetics (Fredrikson et al., 2014), computer vision (Fredrikson et al., 2015), and more recently NLP (Song and Raghunathan, 2020). Generally, such works at the intersection of machine learning and cyber-security (e.g., on inversion attacks or adversarial attacks) make assumptions about the imagined attacker’s levels of access to the victim model. White-box scenarios assume attacker access to the full model (Wallace et al., 2019; Tsymboi et al., 2023), resulting in many possible attack surfaces. Previous works in NLP have shown that it is possible to retrieve sensitive training data by attacking models
1https://huggingface.co/yiyic/ 2https://github.com/siebeniris/MultiVec2Text/
directly (Fredrikson et al., 2014, 2015), attacking gradients (Zhu et al., 2019; Deng et al., 2021), as well as through leveraging leaked hidden states (Li et al., 2022). Meanwhile, black-box attacks assume an attacker has no knowledge of the underlying model itself, and can only interact with models at the most abstracted level (e.g., provide input and register output through an API). For example, Carlini et al. (2020) are able to extract sensitive training data (e.g., names and phone numbers) from GPT2 (Radford et al., 2019a), by first generating data from the model and then using membership inference attacks to filter utterances likely to be part of the original training data.
In embedding inversion attacks, an imagined attacker aims to recreate text from the distributed representations. As opposed to a machine translation setting, this scenario assumes no access to a source text x to condition on, and the goal is not to decode a translation of x, but rather to recreate the exact text of x — with no input other than the embedding ϕ(x), given ϕ as an encoder. Song and Raghunathan (2020) showed that 50%–70% percent of tokens could be recovered in such a setting. Subsequent attacks have further improved over this metric, with newer approaches now able to retrieve entire sentences of encoded text (Höhmann et al., 2021; Hayet et al., 2022; Morris et al., 2023; Li et al., 2023). Existing defense mechanisms include randomly perturbing embeddings (Zhou et al., 2023) and parameter-efficient finetuning (Zhang et al., 2023). Other methods for securing embeddings include encryption (Huang et al., 2020; Xie and Hong, 2021) and differential privacy (Lyu et al., 2020). However, until embedding privacy is ensured, inversion attacks will remain a threat, necessitating further investigation.
Finally, previous works on embedding inversion have been confined to monolingual settings concerning English (Song and Raghunathan, 2020; Lyu et al., 2020; Hayet et al., 2022; Parikh et al., 2022; Kim et al., 2022; Morris et al., 2023; Zhou et al., 2023; Li et al., 2023). This leaves defenses for non-English languages and multilingual models unexplored, potentially compromising model security for those languages. As a result, the vulnerability of multilingual models and non-English models remains an open question.

heading: 3 Methodology
text: In this work, we consider a scenario where a malicious actor has illegitimately obtained both embeddings and API access to the black-box encoder, as shown in Figure 1. To gauge the vulnerability of multilingual models against black-box embedding inversion attacks, we build upon previous work by Morris et al. (2023), extending their attack method to a multilingual setting, aiming to invert sentence embeddings produced by a multilingual model. We define the attack scenario formally as follows: given a sensitive text sequence x and a black-box encoder ϕ, the goal is to recover x from the embedding obtained via ϕ(x) using an external attacker model ψ. However, we can only access ϕ through an EaaS API, and its architecture and parameters are inaccessible. To this end, we explore the efficacy of existing defenses in this scenario, and introduce a novel defense mechanism.
We approach embedding inversion attacks in the context of text generation, considering the generation models’ efficacy in such attacks (Li et al., 2023; Morris et al., 2023). In this scenario, the generation model ψ conditions what information can be encoded and decoded, with consequences for text reconstruction. For example, if ψ is solely pre-trained on Latin script, it cannot handle Cyrillic or Devanagari scripts. Consequently, reconstructing text in unknown scripts is presently infeasible, and whether text in unknown scripts can be reconstructed remains unexplored. Hence, our study investigates text reconstruction in unknown languages within the same script (i.e., Latin).
Multilingual Inversion Attacks Compared to monolingual embedding inversion, investigating
multilingual inversion attacks introduces significant complexity, as each language space of ψ, ϕ, x, and training data is crucial. For instance, the training scale for attacker models increases with the number of languages and controlled parameters, such as maximal sequence length (cf. Section 4).
We explore the potential of multilingual embedding inversion assuming unlimited queries can be sent to the black-box ϕ, obtaining embeddings ϕ(x) for x ∈ D, where D is the training dataset. Following the approximation approach from Morris et al. (2023), we search for text x̂ closest to the target embedding e under ϕ using the formula:
x̂ = argmax x cos(ϕ(x), e) (1)
In particular, as illustrated in Figure 2, the training and inference of the inversion model are conditioned on the previous output. At correction step t+ 1, the model takes the concatenation of the previous output x̂(t), hypothesis embedding ê(t), and target embedding e. With this context noted, the multilingual embedding inversion attack is composed of the following steps:
• Base model Model Training: Develop an attacker model ψ based on a text generation model pre-trained on the same language scripts; • Correction Model Training: Train ψ by querying the black-box embedding model ϕ with text x ∈ D, resulting in x̂ optimized using Eq. 1 (correction step 1). • Inference: Execute embedding inversion attacks on texts in the target language lt using the trained inversion model ψ. Further optimization (correction steps > 1) is performed
with Eq.1, combined with beam search at sequence level.
Cross-Lingual Inversion Attacks In a multilingual setting we assume that the inversion model is trained on several languages, including the target text language lt. However, this is an unrealistic setting which requires immense computational resources. We therefore investigate a cross-lingual setting, in which the aggressor does not know the true language of the target text lt. Concretely, we investigate the extent it is possible to execute inversion attacks leveraging a monolingual inversion model trained on a different source language ls than the target lt, thus introducing a cross-lingual attack. As the text generated by the monolingual inversion model will be in ls, current string-matching metrics for evaluating inversion attacks, such as BLEU, are not applicable here, as there will be little or no overlap between the ls and lt strings, even when the underlying meaning of the two is the same. In order to evaluate the success of the cross-lingual inversion model, we propose a post-intervention strategy Ad hoc Translation (AdTrans), as shown in Figure 2. In this setup, the generated text is first translated from ls in lt using EasyNMT 3. Then the translated text is evaluated against the target text, to verify whether the inverted text in ls can indeed uncover the target text in unknown lt (cf. Section 5.2). As AdTrans hinges upon the availability of a reliable machine translation model for the pertinent languages, this use case highlights the existing limitations in current evaluation metrics for assessing the threat posed by cross-lingual inversion attacks, and the need for continued research in this space.

heading: 4 Experimental Setup
text: English Embeddings We reproduce the results from Morris et al. (2023) by training inversion models on GTR-base (Ni et al., 2022) 4 on English dataset. Full results can be found in Appendix B.
Multilingual Embeddings We use T5-base (Raffel et al., 2023) as our generation model. For the multilingual inversion models ψ, we train on a state-of-the-art multilingual encoder ϕ: multilingual-e5-base (ME5-base)5 (Wang et al., 2022), which is a pre-trained transformer based
3https://github.com/UKPLab/EasyNMT 4Huggingface: sentence-transformers/gtr-t5-base 5Huggingface: intfloat/multilingual-e5-base
on XLM-R (Conneau et al., 2020), and noted to be one of the best performing multilingual models according to MTEB (Muennighoff et al., 2023).
Datasets Previous research (Morris et al., 2023) trains inversion models on natural questions and question-answer pairs, such as MSMarco (Bajaj et al., 2018) and Natural Questions (NQ) (Kwiatkowski et al., 2019). While these datasets are advantageously large, they are limited to English. Thus for our experiments, we train and evaluate the multilingual inversion models on MTG, a benchmark suite tailored for multilingual text generation training and evaluation (Chen et al., 2022), with parallel samples across languages. MTG is curated from different domains, including news, daily life, and Wikipedia. In order to ensure the validity of our experiments, and test generalizability, we exclude the data curated from Wikipedia, as this domain data was already used to train both T5-base and ME5-base models. For each language, this results in 123k passages (i.e., paragraphs or sections of a document) available for training data. We obtain 3-5M sentences for training and 2k each for validation and test in each language using NLTK (Bird and Loper, 2004) sentence tokenization. This is considerably fewer training samples as compared to Morris et al. (2023), where their GTR-base model was trained on 5M passages from NQ6. Meanwhile, we train and evaluate on data in English, French, German and Spanish, noted as MTG-EN, MTG-FR, MTG-DE, and MTG-ES, respectively. We also compose a 5Msentence multilingual dataset for training including 1.25M sentences from each language, noted as MTG-MULTI. We note that to reproduce the findings presented by Morris et al. (2023), a test set comprising 500 samples was utilized. All reconstruction results are therefore based on 500 samples from the regarding test data.
Metrics To be comparable with Morris et al. (2023), we assess model performance using two types of metrics. First, for text reconstruction, we employ the following word-match metrics: BLEU (Post, 2018), measuring n-gram similarities between the true and reconstructed text;
6The models truncate texts into 32 tokens and 64 tokens, to evaluate how sequence length affects the performance of embeddings inversion. Each passage in NQ is significantly longer than 32 and 64 tokens. To obtain more training data samples from MTG, we implement NLTK sentence tokenization on MTG dataset, resulting in sentences with uneven distribution of tokens length (cf. Appendix A).
ROUGE (Lin, 2004), reporting the recall of overlapping words of reconstructed text; Token F1, which calculates the multi-class F1 scores between predicted tokens and true tokens, considering each word as a class; and Exact-match, representing the percentage of perfectly matching reconstructed texts to the true texts. We also compute the cosine similarity between the true embedding and the embedding of the reconstructed text in the embedding space of the trained ϕ. However, such metrics fall short in terms of evaluating the recovery of the semantic content, especially regarding specific private information. The limitation is particularly evident in cross-lingual settings, for example, where the generated German text conveys similar meaning as the input English text, a nuance that word-match metrics fail to capture (see Figure 2).
Evaluation In text generation, exploring the vast space of possible sequences exhaustively is infeasible. Hence, we employ beam search at the sequence level to approximate the sum of immediate text generations. Following Morris et al. (2023), the inference is conducted greedily at the token level and beam search is employed at the sequence level. At every stage of correction, a set number b of potential corrections is evaluated. For each potential correction, the top b feasible continuations are decoded. From the pool of b · b potential continuations, the b unique ones are selected based on their embedding space distance from the reference embedding e.
In this study, we analyze inference using varying numbers of correction steps (1, 20, 50, and 100) along with sequence beam widths (sbeam) of 4 and 8. We explore the impact of evaluation steps in comparison to runtime and observe that evaluation runtime doubles from 50 to 100 steps with sbeam, while the additional performance gains are negligible (see Figure 6 in Appendix C). Thus, we report the evaluation results until 50 steps with 8 sbeam.
Experiments We train an inversion base model and Vec2Text corrector model, as described in Section 3. To determine the potential of multilingual embedding inversion attacks, we train base models and Vec2Text models specifically for MTGMULTI; for cross-lingual attacks, we train these models for each language. In comparison with previous research, we train and evaluate ME5-based inversion models on NQ, i.e., ME5_NQ.
We use the Adam optimizer with the learning
rate of 2e−5, epsilon of 1e−6, and 1000 warm-up steps at a constant warm-up schedule. Each base and corrector model is trained for 100 epochs. Due to the prohibitive computational resources needed for training inversion models, we limit each model to a single training run. For inversion models, we use a batch size of 512, while corrector models, trained on data with 32 tokens, have a batch size of 256. Batch sizes are halved for models trained on data truncated to 64 tokens 7. All models are trained on 4 AMD MI250 GPUs with distributed training. Under these circumstances, training our slowest model takes about 8 days.

heading: 5 Attacking Multilingual Language Models
text: To explore the potential of multilingual embedding inversion, we train ME5-base embedder on MTG data in English, German, French, and Spanish, i.e., ME5_EN, ME5_FR, ME5_DE and ME5_ES, respectively, and the composed multilingual dataset of four languages, i.e., ME5_MULTI, and test on each language for both settings, see results in Table 1. To simulate more realistic attacks, we conduct thorough cross-domain evaluation (cf. Appendix G).

heading: 5.1 Multilingual Text Reconstruction

heading: Monolingual Text Reconstruction in Multiple
text: Languages We observe that the BLEU score for each language peaks by 50 steps correction with 8 sbeam. Moreover, Spanish models outperform the others in terms of the word-match metrics across correction steps, achieving 80.02 on BLEU with 65% of exact match. Despite having a larger volume of data compared to other languages, the English model unexpectedly performs the worst across various metrics, as illustrated by the training data distribution in Appendix A Figure 5. However, we show in Appendix E, the evaluation of round-trip translated English test data indicates no evidence of translationese effect. Additionally, experiments and results for embedding inversion over Finnish and Hungarian can be found in Appendix D, providing additional insights to the problem of multilingual Vec2Tex, beyond high-resource Romance and Germanic languages. There, we observe sub-par performance for text reconstruction (see: Table 6 of Appendix D), highlighting the need to study a wider variety of languages in the future.
7The more detailed settings for hyper-parameters are illustrated in the GitHub repository.

heading: MTG-EN
text: Multilingual Text Reconstruction Without Prior Knowledge of Language To evaluate the potential of multilingual text inversion without prior knowledge of the target language, we train inversion models on MTG-MULTI. As shown in Table 1, ME5_MULTI base model outperforms (underlined) or matches the performance of monolingual base models across languages. Despite each language in MTG-MULTI having a quarter of the data volume compared to its monolingual counterpart, overall performance remains comparable, particularly evident for French and Spanish. For Spanish, ME5_MULTI slightly outperforms in word-match metrics than ME5_ES also for Vec2Text model by 1 step correction. Across languages, the initial (base model) cosine similarities of the ME5_MULTI exceed those of its monolingual counterparts, except for English.
Moreover, we conduct qualitative analysis on text reconstruction using ME5_MULTI on parallel samples, in Table 2 and 11 (cf. Appendix H). Overall, the lower the cosine similarity of Step 1, the fewer steps the model needs to generate the exact match. These phenomena suggest that (i) high monolingual data volume is not the sole determi-
nant of high-performing base and 1-step Vec2Text models in both monolingual and multilingual settings, (ii) multilingual training yields closer embeddings of reconstructed and target texts in the embedding space, and (iii) the optimization approach utilizing cosine similarity is not as effective for multilingual training compared to monolingual.

heading: 5.2 Cross-lingual Text Reconstruction
text: Cross-lingual text reconstruction assumes no prior knowledge of the target language, and thus the embedder ϕ is trained on a different source language than the target text for evaluation. To investigate the potential of this scenario, we conduct crosslingual evaluation on all the monolingual models, the results on in-domain MTG are reported in Table 3.
We observe that ME5-base models trained on both NQ and MTG datasets have a tendency to decode texts, for example x̂, in the language of training data, e.g., ls, given the target text x which is in a different language, e.g., lt. However, x̂ could convey the same information in another language, but current word-match metrics are not able to capture this. Thus the privacy leakage still exists.
sions. The colored boxes indicate misplaced tokens , wrong tokens , and exact matches . The best results for metrics are in bold. Initial cosine similarity is underlined.
For example, the ME5_DE model inverts the following German sentence into English:
• Generated German report: trump einmal fragte damals fbi director andrew mccabe während seiner 2016-vote • AdTrans English report: trump once asked fbi director andrew mccabe during his 2016- vote • Target English report: trump once asked thenacting fbi director andrew mccabe about his 2016 vote
In this case, the model incorrectly generates “während” (during) rather than “about”; otherwise, the generated text is close in meaning with the target English text. The information leakage would not be properly captured with the current metrics evaluated on the German text. Appendix H Table 12 shows further qualitative examples for adding AdTrans to aid evaluation in cross-lingual settings.
Finally, for in-domain evaluation, performance improves across cross-lingual settings, as demonstrated in Table 3. Moreover, as shown in Appendix G Table 10, performance is enhanced across models across domains for each language, except for the GTR-base model. Notably, the AdTrans strategy proves particularly effective for multilingual based LMs.

heading: 6 Defending against Inversion Attacks
text: To explore defenses against inversion attacks for LMs and compare strategies between monolingual and multilingual models, we investigate the tradeoff between retrieval and reconstruction performance. Specifically, we apply noise insertion and masking defense to GTR-base and ME5-base using the correction model with 10 steps. Evaluation is conducted on both BEIR (Thakur et al., 2021) (English) and CLIRMatrix (Sun and Duh, 2020) (cross-lingual), observing the mean NDCG@10 measures retrieval across 12 tasks (full results in Appendix I).
Inserting Noise Simple noise insertion (detailed in Appendix I.1) effectively guards monolingual LMs against inversion attacks (Morris et al., 2023), which is confirmed by our experiments, demonstrating that adding noise can defend against such attacks while preserving embedding utility, as depicted in Figure 3.
With a noise level of λ = 10−3, retrieval performance is preserved for both GTR and ME5 across BEIR and CLIRMatrix. While there is a drop on reconstruction with GTR and ME5_NQ on BEIR by 20%, there is no change with ME5_EN on BEIR and ME5_MULTI on both BEIR and CLIRMatrix.
At the noise level 10−2, reconstruction performance with GTR drastically drops to 16% of the original BLEU on BEIR and 36% on CLIRMatrix. In contrast, reconstruction with multilingual LMs consistently maintains over 70% of the original BLEU, particularly with ME5 trained on MTG over 85%. Additional noise (λ ≥ 10−1) damages significantly both retrieval and reconstruction performances. This notable disparity between retrieval and reconstruction performance on GTR (λ = 10−2) implies the efficacy of the noise inser-
tion defense primarily on monolingual LMs rather than multilingual ones.

heading: A Frustratingly Simple Masking Defense To
text: enhance the security of LMs, we propose a simple defense method, achieved by masking the first dimension of the embeddings with the encoding of the target language lt. We use an iterator to encode each language as an identifier, denoted as idt ∈ R. The masked embedding model is defined as following:
ϕmasking(x) = vec([idt, vec(ϕi(x))1≤i≤n]) (2)
given ϕ(x) = vec(ϕi(x))0≤i≤n where x is the input text, n is the dimension of the embedding ϕ(x) and n ∈ N.
We implement this simple masking defense on both GTR-base and ME5-base models. As depicted in Figure 4, while retrieval performance remains unaffected8 across all models, reconstruction markedly declines for both monolingual and multilingual LMs across the retrieval benchmarks, with a notable drop by 92% with GTR on BEIR and 79%
8The performance of text reconstruction on CLIRMatrix dataset with GTR is largely conflated by its superiority in reconstructing English documents (details in Appendix I).
on CLIRMatrix, and over 64% drop for all multilingual models. The is a simple yet effective defense against inversion attacks for both monolingual and multilingual LMs, while fully preserving utility in retrieval tasks.

heading: 7 Conclusion
text: While previous works on embedding inversion attacks focus exclusively on English, we present the first work on multilingual and cross-lingual embedding inversion. Notably, we uncover that multilingual models can be more vulnerable than monolingual models, under certain conditions. Importantly, traditional defense tailored for monolingual models prove ineffective in guarding multilingual models. Thus we propose a more robust defense applicable to both monolingual and multilingual ones. Additionally, our preliminary experiments over moderately-resourced Uralic languages further stresses the importance of expanding the scope of future works in embedding inversion studies, to include a more diverse set of languages. In summary, our work advocates for a multilingual approach to LLM and NLP security as an entirety.

heading: Limitations
text: Computing Resources A core limitation of this work is the computationally intense experiments, requiring in the area of 25,000 GPU computing hours. While expanding this research direction to more languages will further increase this expense, we advocate for ensuring that languages other than English are not left behind in terms of NLP security.
Data Contamination Pre-trained LMs are often trained on massive web-based datasets, resulting in a high likelihood that a given model has already seen commonly used benchmark datasets (Dodge et al., 2021a). Indeed, most wide-used LMs are trained on massive datasets like the C4 Common Crawl 9 web scrape, including OpenAI’s GPT models (Radford et al., 2019b; Brown et al., 2020), Meta AI’s RoBERTa (Liu et al., 2019) and LLaMAs (Touvron et al., 2023), Google AI’s BERT (Devlin et al., 2018), and EleutherAI’s GPTNeo (Black et al., 2022) and GPT-J (Wang, 2021). In this work, we utilize models including T5-base, ME5-base and GTR-base, which are all trained on massive public domain datasets, resulting in a
9https://commoncrawl.org
likely overlap of training data. For example, initialized from T5, GTR-base is trained on NQ dataset, which is again used as training data for text reconstruction by Morris et al. (2023); ME5-base and T5-base overlaps in C4 and Wikipedia. In an attempt to mitigate data contamination, we exclude Wikipedia from the MTG dataset. However, staving off data contamination entirely is nearly infeasible when utilizing open-sourced pre-trained large LMs. This limitation is the focus of several previous works (Brown et al., 2020; Dodge et al., 2021b; Magar and Schwartz, 2022; Jacovi et al., 2023).
Number and Diversity of Languages In this study, we extensively experiment on multilingual and cross-lingual inversion security focused on four Romance and Germanic languages, which are also high-resource languages in NLP. Still, this means that this work lacks the extensive linguistic diversity needed to understand how embedding inversion attacks affect massively multilingual models, or lower-resourced languages. To this end, we include some preliminary experiments for inverting multilingual sentence BERT in two Uralic languages, i.e., Finnish and Hungarian. Ultimately, we advocate for more extensive research with a wider sample of languages in various language families.

heading: Ethics Statement
text: This work explores attacks on multilingual embedding models. Our intent with this research is to shed light on the vulnerabilities of languages other than English, aiming to encourage the community to include more languages in NLP security work. While there is potential for misuse by malicious actors, as with many works in NLP security, we mitigate harm by including an effective countermeasure to the attack presented in the paper. Still, it is important to stress that embedding inversion presently represents a substantial threat. To this end, the LMs examined in this paper are opensource models, and such that this work does not constitute an imminent threat to EaaS providers, who are likely using private models. Finally, we do not knowingly experiment with any truly sensitive data, ensuring that no real-world harm is caused by the work carried out in this paper.

heading: Acknowledgements
text: All authors of this paper are funded by the Carlsberg Foundation, under the Semper Ardens: Ac-
celerate programme (project nr. CF21-0454). We are furthermore grateful to the support of the AAU AI Cloud, and to DeiC for allocating us computing resources on the LUMI cluster (project nr. DeiCAAU-S5-412301). We thank Sighvatur Sveinn Davidsson for setting us up with this access, and for his diligence in assisting with the problems in the experimental infrastructure, in addition to the LUMI user support for their very prompt answers and competence, especially Jing Gong. We further thank Esther Ploeger for her assistance in testing translationese effect for the under-performance of multilingual inversion model in English and Marcell Richard Fekete for his insightful input in proofreading the paper.

heading: A Training Data Distribution
text: 4 14 24 32 0
1M
2M
3M
4M
5M
NQ MTG_EN MTG_FR MTG_DE MTG_ES MTG_MULTI
Token Lengths
N r.
o f
S am
pl es
Figure 5: The Distribution of the training data for models with the maximal token length of 32.
In the MTG datasets, English texts are sourced from various origins, while German, Spanish, and French texts are translated from English using machine translation and manually validated (Chen et al., 2022). These languages exhibit diverse morphologies, leading to variations in sentence lengths and the number of sentences post-tokenization across languages. Additionally, the NQ dataset is included to reproduce findings from prior research (Morris et al., 2023) and to assess the crossdomain and cross-lingual performance of the text reconstruction task. The NQ dataset predominantly comprises English data, with Wikipedia passages included without tokenization, resulting in all training data from NQ having 32 tokens.

heading: B Monolingual English Text Reconstruction
text: To have a proof of concept, we successfully reproduce and replicate the experiment from Morris et al. (2023), by training inversion models using GTR-base and ME5-base as embedders on the NQ dataset, noted as GTR and ME5_NQ.
The results for reconstructing English texts are shown in Table 4, evaluated with correction steps (1, 20, 50, 100) combined with beam search (4 and 8 sbeam). The base and 1-Step Vec2Text model trained on ME5-base have a performance on par with GTR-base. Moreover, the text embeddings trained on ME5-base are closer in embedding space than embeddings trained on GTR-base, i.e., with higher cosine similarities.
While, with more steps of correction and sbeam, the performance is boosted to 92.45 on BLEU with
82% exact match for GTR, while the best performance for ME5_NQ is 80.86 on BLEU with 35% exact match. The performance difference could be due to the fact that the underlying GTR-base is t5based model, the same structure as the generation model ψ.
However, utilizing ME5-base sets up a more realistic attack scenario of black-box embedding inversion, as the structure of the embedder ϕ is unknown. Both models are furthermore evaluated with crossdomain English text reconstruction. Similarly, GTR outperforms ME5 after 50 correction steps with sbeam 8, see Table 9 in Appendix G.

heading: C Runtime vs. BLEU scores
text: The evaluation of Vec2Text models is expensive in terms of time and computation. In order to search for the optimal runtime and performance trade-off, Figure 6 shows BLEU scores at each step and the lines represent the trend for runtime for the monolingual models. The best trade-off points are at the correction step of 50 with 8 sbeam for all the models, while 100 steps takes more than double the time achieving similar performance. The full results are in Table 1 and 5. Until correction step 50 with 8 sbeam, performance increases steadily, and the trend is generally aligned with cosine similarity. As a result, we evaluate the subsequent models until correction step 50 with 8 sbeam.
D Inverting Multilingual Sentence BERT Embeddings
We additionally experiment on inverting multilingual sentence BERT in Finnish and Hungarian. The inversion models are trained using the encoderdecoder multilingual T5 (Wang et al., 2024) as generation model, and multilingual sentence BERT 10 is used as the encoder ϕ. We train models on randomly extracted 1M data samples from CulturaX (Nguyen et al., 2024) 11, validated and evaluated on 500 samples, respectfully. The detailed evaluation results are reported in Table 6. Interestingly, the corrector model, which converges embeddings with cosine similarity, did not improve text reconstruction for Finnish texts, while it did provide marginal improvement for Hungarian texts. The notably poorer performance in this experiment highlights the complexity of inverting textual embeddings, where model affinity and datasets play
10huggingface: sentence-transformers/distiluse-basemultilingual-cased-v2
11huggingface: uonlp/CulturaX
crucial roles. For future work, we plan to investigate more extensively how different model architectures and language families influence embedding inversion performance.

heading: E No Evidence for Translationese Effect
text: In machine translation, there is clear evidence that the presence of translationese in test sets may result in inflated human evaluation scores for MT systems (Zhang and Toral, 2019). To investigate whether our multilingual inversion model’s sub-par performance in English is due to the characteristics of translationese in other languages, we implement round trip translation on MTG-EN test data using Spanish as the pivot language with EasyNMT, the translation path is thus English → Spanish → English. Then the evaluation of the multilingual inversion model is done on the round-trip translated English test set, the result is shown as in Table 7. Compared to evaluation on MTG-EN test set, as shown in Table 1, the performance of translated English test set is about 30 on BLEU worse at each stage of corrections. The hypothesis of the translationese effect on the difference of the performances can therefore be rejected.

heading: F Text Construction on Tokens Length 64
text: We train ME5-base inversion models on MTG datasets with token lengths of 64 in English, French, German, and Spanish, in comparison to 32-token length models. Results in Table 8 indicate a performance degradation; for instance, the BLEU score for the Spanish inversion model drops by approximately 15 while doubling the number of tokens. This highlights the challenges in this line of research.

heading: G Cross-Domain Text Reconstruction
text: Cross-Domain English Text Reconstruction To evaluate the performance of embedding inversion attacks on out-of-domain dataset in English, the models trained on NQ and MTG-EN are crossevaluated on both datasets, respectively, as shown in Table 9. The results on MTG-EN are similar on BLEU for both base models trained on GTR-Base and ME5-Base, while GTR model outperforms ME5 by more than 12 on BLEU, and the cosine similarity of reconstructed and true text embeddings are boosted by over 0.24 . In comparison, the cosine similarity for ME5 models are not much varied and
constantly high (≥ 0.88) across stages of evaluations and across domains. Additionally, ME_EN outperforms ME_MULTI tested on NQ.
Cross-domain Cross-lingual Text Reconstruction Cross-lingual, cross-domain text reconstruction is one of the most challenging scenarios, yet it also represents the most realistic context, with both domain and target language unknown. As shown in Table 10a, while the AdTrans strategy does not enhance the performance of the GTR-Base inversion model, there is a consistent improvement in performance across datasets when using ME5Base inversion models. Particularly noteworthy is the significant performance boost observed, especially evident when evaluating NQ-trained ME5base model ME_NQ on MTG-DE, resulting in a remarkable 128.11% performance gain.
It is interesting that multilingual LMs reconstruct texts in the language of training data, while monolingual language model (GTR) reconstruct texts mostly in the target language. This highlights the differences of monolingual and multilingual LMs, and warrants further research for future work.

heading: H Qualitative Analysis

heading: H.1 Multilingual Text Reconstruction
text: We conduct qualitative analysis on multilingual text reconstruction using parallel samples. Table 11 shows the French and Spanish samples, in comparison to Table 2, samples in English and German. The samples are evaluated on ME5_MULTI. By Step 2, French sentence is already reconstructed with one word mismatch, however, the whole sentence is only fully reconstructed by correction step 50 + 4 sbeam. The cosine similarity is high from
(b) Cross-lingual cross-domain evaluation on NQ with monolin-
step 1, i.e., 0.9892, compared to the sample in English, i.e., 0.8056 and in German, i.e., 0.8704. While English and German samples are fully reconstructed by step 6 and 7. As argued, the approximation approach with cosine similarity seems to be more effective for models rendering lower cosine similarity from initial steps. However, from observations, ME5 models reconstructs closer embeddings across languages from the start.

heading: H.2 Cross-lingual Text Reconstruction
text: We further conduct qualitative analysis on crosslingual text reconstruction, aided by AdTrans. As shown in Table 12, the four way multilingual samples are used, all represent the same meaning. Each sample is evaluated by ME5-base inversion models trained on other three languages separately.
Consistent with previous quantitative analysis, the cross-lingual reconstruction is difficult, and the BLEU scores are consistently low. With AdTrans, the BLEU scores are overly boosted, with an exception of evaluating Spanish sample with ME5_EN. In this example, the highest performance gain is adding AdTrans for evaluating English sample with ME5_DE.
The intention of adding AdTrans is to improve the utility of current string-matching metrics in cross-lingual attack setting, while also expose the
inadequacy of such metrics in terms of LLMSec. With this example, there is essential information leakage in each evaluation that can not be captured even after applying AdTrans.

heading: I Full Defense Results

heading: I.1 Noise Insertion Defense
text: Following (Morris et al., 2023), the noisy embedding model is defined as following:
ϕnoisy(x) = ϕ(x) + λ · ϵ, ϵ ∈ N(0, 1) (3) where λ is a hyperparameter controlling the amount of noise injected.

heading: I.2 Language Neutrality of Inversion Models
text: Drawing inspiration from Libovický et al. (2020), we delve into the impact of language-agnostic embeddings on retrieval and reconstruction performance. This is achieved by isolating the languagespecific component, represented by the mean of the embeddings, which serves to identify the language of the representations. Conversely, we extract the language-agnostic component by subtracting the mean embeddings, thereby capturing the essence of the text in a language-independent manner.
We present the performance of languageagnostic component on GTR-base and ME5-base models across BEIR and CLIRMatrix benchmarks in Table 13, 14, 15, and 16, 17, 18.
Consistently, our findings demonstrate that language-agnostic embeddings either outperform or perform equally well compared to the original embeddings in retrieval tasks. However, while there is only a slight degradation in performance for text reconstruction on the CLIRMatrix benchmark and with ME5-base models on the BEIR benchmark, the reconstruction performance experiences a notable 20% decline with the GTR-base model on the BEIR benchmark. This indicate that the distinction of language-specific and language-agnostic component is more salient for multilingual models.

heading: I.3 Results on BEIR Benchmark
text: We reproduce the retrieval and reconstruction on GTR-base models across 12 BEIR tasks from (Morris et al., 2023), excluding the four private datasets. Moreover, we implement retrieval on ME5-base models. The full defense results for retrieval performance and reconstruction tasks are shown in Table 13, 14 and 15.
correct inversions. The colored boxes indicate misplaced tokens , wrong tokens , and exact matches . The best results for metrics are in bold. Initial cosine similarity is underlined.

heading: I.4 Results on CLIRMatrix Benchmark
text: To evaluate the cross-lingual scenario in retrieval and reconstruction on monolingual and multilingual models, we implement cross-lingual retrieval and text reconstruction across 12 cross-lingual datasets constructed from MULTI-8 of CLIRMatrix (Sun and Duh, 2020).
Let q be a query in language Lquery and d be a document in language Ldoc. In our scenario, the cross-lingual retrieval task involves retrieving the document in language Ldoc when presented with a query in language Lquery within the nearest neighbor retrieval framework. For our evaluation, the cross-lingual datasets are constructed with the triple (qLquery , dLdoc), where Lquery ∈ {en, fr, de, es} and Ldoc ∈ {en, fr, de, es}, and Lquery ̸= Ldoc. We implement retrieval and reconstruction both on GTR-base and ME5-base models.
The full defense results for retrieval performance and reconstruction tasks are shown in Table 16, 17 and 18.
colored boxes indicate matched tokens and information leakages .

heading: Future Work
text: This highlights the differences of monolingual and multilingual LMs, and warrants further research for future work