HackerPapers

arXiv:2310.06816cs.CL

Text Embeddings Reveal (Almost) As Much As Text

John X. Morris, Volodymyr Kuleshov, Vitaly Shmatikov, Alexander M. Rush

Abstract

How much private information do text embeddings reveal about the original text? We investigate the problem of embedding \textit{inversion}, reconstructing the full text represented in dense text embeddings. We frame the problem as controlled generation: generating text that, when reembedded, is close to a fixed point in latent space. We find that although a naïve model conditioned on the embedding performs poorly, a multi-step method that iteratively corrects and re-embeds text is able to recover $92\%$ of $32\text{-token}$ text inputs exactly. We train our model to decode text embeddings from two state-of-the-art embedding models, and also show that our model can recover important personal information (full names) from a dataset of clinical notes. Our code is available on Github: \href{https://github.com/jxmorris12/vec2text}{github.com/jxmorris12/vec2text}.

arXiv comments
Accepted at EMNLP 2023
Journal reference
DOI
Subjects
cs.CLComputation and Language cs.LGMachine Learning

On Hacker News

Linked by 5 identifiable commenters in 6 comments across 6 threads, from Nov 2023 to Jan 2025. Found in 1 HN submission from Oct 2023 to Oct 2023. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments6 threads

  1. Let's talk about AI and end-to-end encryption 1 comment

    • No, the original text can largely be recovered from embeddings[0] if you know which embedding model was used. [0] https://arxiv.org/abs/2310.06816

      hallhView on HNParent context

  2. Vision language models are blind 1 comment

    • I remembered about a paper that sheds light on this issue. An embedding can store/recover exactly a short sentence: > a multi step method that iteratively corrects and re embeds text is able to recover 92% of 32-token text inputs exactly https://arxiv.org/abs/2310.06816 So it's…

      visargaView on HNParent context

  3. CryptGPT: A Simple Approach to Privacy-Preserving LLMs Using Vigenere Cipher 1 comment

    • Text embeddings should not be used as a form of encryption. They are optimized to contain as much information as possible from the text they represent and can often be decoded into their input: https://arxiv.org/abs/2310.06816

      tripplyonsView on HNParent context

  4. Launch HN: Greptile (YC W24) - RAG on codebases that actually works 1 comment

    • You might be interested in "Text Embeddings Reveal (Almost) As Much As Text": > We train our model to decode text embeddings from two state-of-the-art embedding models, and also show that our model can recover important personal information (full names) from a dataset of…

      jncratonView on HNParent context

  5. Embeddings, vectors, and arithmetic 1 comment

    • A recent paper [1] shows that what you're describing is possible to some degree - you can reproduce text from its embeddings. The paper provides the code implementing the reversal process, so you could quickly hack together a prototype :) I also recommend a video by Yannic…

      wint3rmuteView on HNParent context

  6. Phind Model beats GPT-4 at coding, with GPT-3.5 speed and 16k context 1 comment

    • Phrase embeddings could bring a 32x reduction in sequence length because: > Text Embeddings Reveal (Almost) As Much As Text. ... We find that although a naïve model conditioned on the embedding performs poorly, a multi step method that iteratively corrects and re embeds text is…

      visargaView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.