Text Embedding Inversion Security for Multilingual Language Models (2024)

Abstract: Textual data is often represented as real-numbered embeddings in NLP, particularly with the popularity of large language models (LLMs) and Embeddings as a Service (EaaS). However, storing sensitive information as embeddings can be susceptible to security breaches, as research shows that text can be reconstructed from embeddings, even without knowledge of the underlying model. While defence mechanisms have been explored, these are exclusively focused on English, leaving other languages potentially exposed to attacks. This work explores LLM security through multilingual embedding inversion. We define the problem of black-box multilingual and crosslingual inversion attacks, and explore their potential implications. Our findings suggest that multilingual LLMs may be more vulnerable to inversion attacks, in part because English-based defences may be ineffective. To alleviate this, we propose a simple masking defense effective for both monolingual and multilingual models. This study is the first to investigate multilingual inversion attacks, shedding light on the differences in attacks and defenses across monolingual and multilingual settings.

## introduction industrial applications of natural language processing (nlp) typically utilize language models (lms) and often rely on vector databases via frameworks such as embeddings as a service (eaas). in this context, sentence embeddings are stored in a remote database, as opposed to raw text, allowing end-users to efficiently search across condensed representations. as embeddings are not humanreadable, security of the encoded information may be naively assumed, however recent works have demonstrated that embeddings are no safer than raw text; they are susceptible to inversion attacks, whereby a malicious actor can train models to decode embeddings, thus exposing private information @xcite figure 1 : schematic overview of a text embedding inversion attack. a user accesses an eaas provider, while an attacker is eavesdropping. although the attacker has no direct access to the embedding model, they can reliably decode the information stored in the embeddings. 2023; @xcite . concretely, after gaining access to embeddings and the black-box embedder via the eaas api, the malicious actor can train an external model, which approximates the inversion function that reconstructs the text from the embeddings. as such, there is a substantial threat to privacy if malicious actors are able to eavesdrop on communication channels between eaas providers and customers, as illustrated in figure 2 . previous work has shown that an exact match for data recreation can be obtained in specific settings, albeit with the limitation of assuming monolingual english models and embeddings @xcite . however, in real-world scenarios, eavesdroppers may not know the source language of the encoded text, as eaas providers can have international clientele. thus to assess the current level of risk posed to multilingual lms, we introduce multilingual inversion attacks. as the first ever study in this direction, we focus specifically on exact text reconstruction, assuming that the lan-guage of a target embedding is unknown. leveraging a state-of-the-art multilingual black-box encoder, we find that the trained model can reconstruct texts in certain languages more effectively than monolingual counterparts. additionally, we also introduce cross-lingual inversion attacks, to ascertain whether inversion attacks can be successful when the target language is unknown by the attacker. we thus attempt cross-lingual text reconstruction (i.e., reconstructing german text with a model not trained on german reconstruction), introducing an ad hoc translation method to overcome the evaluation limitation of current string-matching metrics in this cross-lingual scenario. finally, we assess the efficacy of an existing defense method by @xcite , ultimately finding that defenses intended for monolingual models fall short in protecting multilingual models. to this end, we introduce simple masking defense, which proves effective for both monolingual and multilingual models, and which also does not require additional model training. all our trained inversion models foot_0 and code foot_1 are open source, encouraging the research community to engage in development of defenses for vulnerable multilingual models. ## related work models are well known to memorize training data, and are therefore susceptible to leaking private information @xcite @xcite . as such, there is increased research interest in exploring this vulnerability to inversion attacks from the perspective of cybersecurity, simulating attacks against models to recreate sensitive training data. work in this direction has been conducted across various domains of machine learning, such as computational genetics @xcite , and more recently nlp @xcite . generally, such works at the intersection of machine learning and cyber-security (e.g., on inversion attacks or adversarial attacks) make assumptions about the imagined attacker's levels of access to the victim model. white-box scenarios assume attacker access to the full model @xcite , resulting in many possible attack surfaces. previous works in nlp have shown that it is possible to retrieve sensitive training data by attacking models directly @xcite , attacking gradients @xcite , as well as through leveraging leaked hidden states @xcite . meanwhile, black-box attacks assume an attacker has no knowledge of the underlying model itself, and can only interact with models at the most abstracted level (e.g., provide input and register output through an api). for example, @xcite are able to extract sensitive training data (e.g., names and phone numbers) from gpt-2 @xcite , by first generating data from the model and then using membership inference attacks to filter utterances likely to be part of the original training data. in embedding inversion attacks, an imagined attacker aims to recreate text from the distributed representations. as opposed to a machine translation setting, this scenario assumes no access to a source text x to condition on, and the goal is not to decode a translation of x, but rather to recreate the exact text of x -with no input other than the embedding ϕ(x), given ϕ as an encoder. @xcite showed that 50%-70% percent of tokens could be recovered in such a setting. subsequent attacks have further improved over this metric, with newer approaches now able to retrieve entire sentences of encoded text @xcite @xcite . existing defense mechanisms include randomly perturbing embeddings @xcite and parameter-efficient finetuning @xcite . other methods for securing embeddings include encryption @xcite and differential privacy @xcite . however, until embedding privacy is ensured, inversion attacks will remain a threat, necessitating further investigation. finally, previous works on embedding inversion have been confined to monolingual settings concerning english @xcite @xcite @xcite @xcite . this leaves defenses for non-english languages and multilingual models unexplored, potentially compromising model security for those languages. as a result, the vulnerability of multilingual models and non-english models remains an open question. @xcite with ad hoc translation and masking defense mechanism (outlined in the green dashed line frame). given access to a target embedding e and query access to the embedder ϕ via an eaas api, the inversion model ψ iteratively generates hypotheses ê to attain the target. the generated text x is in german, and translated to english (adtrans(x)), to be compared with the target text x. the masking defense serves as an effective defense against inversion attacks while preserving utility in nlp tasks such as retrieval. ## methodology in this work, we consider a scenario where a malicious actor has illegitimately obtained both embeddings and api access to the black-box encoder, as shown in figure 1 . to gauge the vulnerability of multilingual models against black-box embedding inversion attacks, we build upon previous work by @xcite , extending their attack method to a multilingual setting, aiming to invert sentence embeddings produced by a multilingual model. we define the attack scenario formally as follows: given a sensitive text sequence x and a black-box encoder ϕ, the goal is to recover x from the embedding obtained via ϕ(x) using an external attacker model ψ. however, we can only access ϕ through an eaas api, and its architecture and parameters are inaccessible. to this end, we explore the efficacy of existing defenses in this scenario, and introduce a novel defense mechanism. we approach embedding inversion attacks in the context of text generation, considering the generation models' efficacy in such attacks @xcite . in this scenario, the generation model ψ conditions what information can be encoded and decoded, with consequences for text reconstruction. for example, if ψ is solely pre-trained on latin script, it cannot handle cyrillic or devanagari scripts. consequently, reconstructing text in unknown scripts is presently infeasible, and whether text in unknown scripts can be reconstructed remains unexplored. hence, our study investigates text reconstruction in unknown languages within the same script (i.e., latin). ## experimental setup english embeddings we reproduce the results from @xcite by training inversion models on gtr-base @xcite foot_3 on english dataset. full results can be found in appendix b. ## attacking multilingual language models to explore the potential of multilingual embedding inversion, we train me5-base embedder on mtg data in english, german, french, and spanish, i.e., me5_en, me5_fr, me5_de and me5_es, respectively, and the composed multilingual dataset of four languages, i.e., me5_multi, and test on each language for both settings, see results in to simulate more realistic attacks, we conduct thorough cross-domain evaluation (cf. appendix g). ## defending against inversion attacks to explore defenses against inversion attacks for lms and compare strategies between monolingual and multilingual models, we investigate the tradeoff between retrieval and reconstruction performance. specifically, we apply noise insertion and masking defense to gtr-base and me5-base using the correction model with 10 steps. evaluation is conducted on both beir @xcite (english) and clirmatrix (sun and duh, 2020) (cross-lingual), observing the mean ndcg@10 measures retrieval across 12 tasks (full results in appendix i). inserting noise simple noise insertion (detailed in appendix i.1) effectively guards monolingual lms against inversion attacks @xcite , which is confirmed by our experiments, demonstrating that adding noise can defend against such attacks while preserving embedding utility, as depicted in figure 3 . with a noise level of λ = 10 -3 , retrieval performance is preserved for both gtr and me5 across beir and clirmatrix. while there is a drop on reconstruction with gtr and me5_nq on beir by 20%, there is no change with me5_en on beir and me5_multi on both beir and clirmatrix. at the noise level 10 -2 , reconstruction performance with gtr drastically drops to 16% of the original bleu on beir and 36% on clirmatrix. in contrast, reconstruction with multilingual lms consistently maintains over 70% of the original bleu, particularly with me5 trained on mtg over 85%. additional noise (λ ≥ 10 -1 ) damages significantly both retrieval and reconstruction performances. this notable disparity between retrieval and reconstruction performance on gtr (λ = 10 -2 ) implies the efficacy of the noise insertion defense primarily on monolingual lms rather than multilingual ones. a frustratingly simple masking defense to enhance the security of lms, we propose a simple defense method, achieved by masking the first dimension of the embeddings with the encoding of the target language l t . we use an iterator to encode each language as an identifier, denoted as id @xmath0. the masked embedding model is defined as following: we implement this simple masking defense on both gtr-base and me5-base models. as depicted in figure 4 , while retrieval performance remains unaffected 8 across all models, reconstruction markedly declines for both monolingual and multilingual lms across the retrieval benchmarks, with a notable drop by 92% with gtr on beir and 79% on clirmatrix, and over 64% drop for all multilingual models. the is a simple yet effective defense against inversion attacks for both monolingual and multilingual lms, while fully preserving utility in retrieval tasks. ## conclusion while previous works on embedding inversion attacks focus exclusively on english, we present the first work on multilingual and cross-lingual embedding inversion. notably, we uncover that multilingual models can be more vulnerable than monolingual models, under certain conditions. importantly, traditional defense tailored for monolingual models prove ineffective in guarding multilingual models. thus we propose a more robust defense applicable to both monolingual and multilingual ones. additionally, our preliminary experiments over moderately-resourced uralic languages further stresses the importance of expanding the scope of future works in embedding inversion studies, to include a more diverse set of languages. in summary, our work advocates for a multilingual approach to llm and nlp security as an entirety.