Back to #artificial intelligence

Denoising-Aware Inversion: Revealing Privacy Risks in Noise-Protected Text Embeddings

Yubo Wang Shujie Cui James Bailey Hongzhi Yin Wenyu Liang Min Tang Shiyue Qin Weiqing Wang
Aug 2026
Artificial Intelligence Machine Learning Cybersecurity

Abstract

Dense text embeddings are widely used in data mining, retrieval, and downstream machine learning systems due to their compact and semantically rich representations, but recent embedding inversion attacks have shown that they can expose substantial information about the original text, leading to serious privacy leakage risks. A common defense is to release perturbed embeddings by adding Gaussian noise, which is simple yet effective against standard inversion attacks and does not significantly degrade embedding utility for downstream tasks. However, it remains unclear whether such noise-protected embeddings are sufficiently safe against adaptive attackers that explicitly account for the perturbation process. In this paper, we study text embedding inversion in a noise-protected setting, where the attacker can observe only noisy embeddings and has no access to clean embedding targets. We first analyze why existing generative inversion methods fail under this setting and identify a "Double Noise Trap", which fundamentally prevents standard generative inversion models from achieving high-quality reconstruction. To address this challenge, we propose DAEI, a denoising-aware embedding inversion pipeline that combines a residual denoising autoencoder with generative text inversion where the denoiser is trained in an unsupervised manner using Stein's unbiased risk estimate to enable denoising from noisy observations alone. Extensive experiments show that DAEI achieves approximately 154\% relative improvement in BLEU over the existing generative inversion baseline, while also improving token-level F1 and ROUGE-L by 32--60\%. The promising inversion performance of DAEI challenges the prevailing assumption that simple Gaussian perturbation is sufficient to prevent sensitive information leakage from embedding representations.

View source

Similar papers

Spikformer V2: Join the High Accuracy Club on ImageNet with an SNN Ticket

This work introduces a pioneering exploration of Self-Supervised Learning (SSL) within the SNN, and proposes a novel Spiking Self-Attention (SSA) and Spiking Transformer (Spikformer) that achieves 80+% accuracy on ImageNet.

Zhaokun Zhou, Kaiwei Che, Wei Fang et al. · 69 citations · ⚡10
#machine learning Conference Open access Feb 2023

EquiPocket: an E(3)-Equivariant Geometric Graph Neural Network for Ligand Binding Site Prediction

EquiPocket is proposed, an E(3)-equivariant Graph Neural Network for binding site prediction, which comprises three modules: the first one to extract local geometric information for each surface atom, the second one to model both the chemical and spatial structure of protein and the last one to capture the geometry of the surface via equivariant message passing over the surface atoms.

Yang Zhang, Wenbing Huang, Zhewei Wei et al. · 43 citations · ⚡4
#artificial intelligence Review Dec 2025

Professional Software Developers Don't Vibe, They Control: AI Agent Use for Coding in 2025

Investigating how experienced developers use agents in building software, including their motivations, strategies, task suitability, and sentiments finds that while experienced developers value agents as a productivity boost, they retain their agency in software design and implementation out of insistence on fundamental software quality attributes.

Ruanqianqian Huang, Avery Reyna, Sorin Lerner et al. · 19 citations · ⚡1

The Optimal Sample Complexity of Multiclass and List Learning

It is shown that the maximum hypergraph density of any multiclass hypothesis class is upper-bounded by its DS dimension, which proves a longstanding conjecture of Daniely and Shalev-Shwartz (2014) and determines the optimal dependence of the sample complexity on the DS dimension for multiclass as well as list learning.

Chirag Pabbaraju · 7 citations · ⚡4

Fermi-Dirac thermal measurements: A framework for quantum hypothesis testing and semidefinite optimization

Quantum measurements are the means by which we recover messages encoded into quantum states. They are at the forefront of quantum hypothesis testing, wherein the goal is to perform an optimal measurement for arriving at a correct conclusion. Mathematically, a measurement operator is Hermitian with eigenvalues in [0,1]. By noticing that this constraint on each eigenvalue is the same as that imposed on fermions by the Pauli exclusion principle, we interpret every eigenmode of a measurement operator as an independent effective fermionic mode. Under this perspective, various objective functions in quantum hypothesis testing can be viewed as the total expected energy associated with these fermionic occupation numbers. By instead fixing a temperature and minimizing the total expected fermionic free energy, we find that optimal measurements for these modified objective functions are Fermi-Dirac thermal measurements, wherein their eigenvalues are specified by Fermi-Dirac distributions. In the low-temperature limit, their performance closely approximates that of optimal measurements for quantum hypothesis testing, and we show that their parameters can be learned by classical or hybrid quantum-classical optimization algorithms. This leads to a new quantum machine-learning model, termed Fermi-Dirac machines, consisting of parameterized Fermi-Dirac thermal measurements-an alternative to quantum Boltzmann machines based on thermal states. Beyond hypothesis testing, we show how general semidefinite optimization problems can be solved using this approach, leading to a novel paradigm for semidefinite optimization on quantum computers, in which the goal is to implement thermal measurements rather than prepare thermal states. Finally, we propose quantum algorithms for implementing Fermi-Dirac thermal measurements, and we also propose second-order hybrid quantum-classical optimization algorithms.

Nana Liu, Mark M. Wilde · 6 citations
#artificial intelligence Review Open access Jan 2026

A systematic review of machine learning techniques to address diagnosis and treatment of autism: challenges and opportunities

This systematic review evaluates 55 studies from 2017 to 2023 on the application of machine learning techniques to ASD, highlighting key challenges and opportunities, particularly the need for models that can integrate complex data to improve diagnostic accuracy and treatment outcomes.

Rafael Muñoz-Terol, Jesús Peral, Sandra Amador et al. · 4 citations · ⚡1

Related blog posts