有限查詢存取下的文本嵌入逆推攻擊

Abstract

本研究調查了與文本嵌入相關的隱私風險，重點關注於攻擊者無法訪問原始嵌入模型的情境。我們的方法與過去需要直接訪問模型的研究不同，我們通過開發一種轉移攻擊方法，探索了更為現實的威脅模型。此方法使用一個代理模型來模仿目標嵌入模型的行為，使攻擊者在不需要直接訪問目標嵌入模型的情況下從文本嵌入中推斷出敏感信息。我們在各種嵌入模型和一個臨床數據集上的實驗表明，我們的轉移攻擊方法顯著優於傳統方法，揭示了嵌入技術潛在的隱私漏洞，並強調了加強安全措施的必要性。

This study investigates the privacy risks associated with text embeddings, focusing on the scenario where attackers cannot access the original embedding model. Contrary to previous research requiring direct model access, we explore a more realistic threat model by developing a transfer attack method. This approach uses a surrogate model to mimic the victim model’s behavior, allowing the attacker to infer sensitive information from text embeddings without direct access. Our experiments across various embedding models and a clinical dataset demonstrate that our transfer attack significantly outperforms traditional methods, revealing the potential privacy vulnerabilities in embedding technologies and emphasizing the need for enhanced security measures.