Aug 2026· Proceedings of the 32nd ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2· 0 citations· 10 references
TL;DR
A novel black-box image embedding inversion attack that reconstructs high-fidelity images using only query access to the embedding model or API, and introduces an embedding-guided cross-attention mechanism, where image embeddings serve as conditional signals to steer the generation process.
Abstract
Vector databases that index and serve dense embeddings have become central to modern data science applications. Embeddings are often regarded as privacy-preserving surrogates for raw data, motivating practitioners to outsource vector databases to third-party services for scalability. However, recent studies show that even text embeddings alone can leak sensitive information, raising serious privacy concerns. Existing attacks on image embeddings, meanwhile, typically assume access to model architecture or parameters, which does not hold in outsourced settings. In this paper, we propose a novel black-box image embedding inversion attack that reconstructs high-fidelity images using only query access to the embedding model or API. Our approach leverages an in-distribution auxiliary dataset to train a conditional diffusion model, capturing domain-aligned knowledge of the data owner's private images. We introduce an embedding-guided cross-attention mechanism, where image embeddings serve as conditional signals to steer the generation process. To improve efficiency, we perform diffusion in the latent space of a pretrained VQGAN with deterministic decoding, which reduces the computational cost while preserving both structural and perceptual fidelity in reconstructed images. Extensive experiments on three real-world datasets and three popular embedding models demonstrate that our approach significantly outperforms four state-of-the-art baselines. These findings reveal that image embeddings can expose sensitive visual information, highlighting the need for stronger privacy protections in outsourced vector databases.
DAEI is proposed, a denoising-aware embedding inversion pipeline that combines a residual denoising autoencoder with generative text inversion where the denoiser is trained in an unsupervised manner using Stein's unbiased risk estimate to enable denoising from noisy observations alone.
Yubo Wang, Shujie Cui, James Bailey et al.· 0 citations
This paper studies embedding-space privacy as a representation-level learning problem. Rather than altering raw records directly, the proposed framework applies embeddingspace transformation to full-record representations through Gaussian perturbation and adversarial representation sanitization. The method is evaluated through ablation across utility metrics, linkage attacks, attribute-inference attacks, and membership-inference tests. The primary empirical evaluation uses a synthetic fusion recommendation benchmark built from MovieLens [1], [2] 32M behavior and Adult-derived demographics [3], while a secondary synthetic medical benchmark is used to examine cross-domain transferability under more constrained conditions. The strongest results appear in the recommendation experiments. Under grouped demographic privacy evaluation, the combined condition preserves recommendation utility with $N D C G {@} K=0.6312$ while reducing exact and entity linkage from 0.7090/0.7204 to 0.0001/0.0000. Sensitive-target attacker performance remains near the majority baseline, supporting the claim of empirical privacy improvement without visible ranking degradation in that benchmark. The healthcare experiments also demonstrate meaningful embedding transformation and linkage reduction, though the current benchmark remains datalimited and therefore less conclusive for utility-focused evaluation. Overall, the findings support the conclusion that embeddingspace transformation can preserve downstream utility while substantially reducing linkage risk and sensitive-information recoverability under explicit attacker evaluation. The findings support embedding-space transformation as a practical privacypreserving strategy for embedding-driven AI systems under explicit attacker evaluation.
D. Panagoulias, Evangelia-Aikaterini Tsichrintzi, E. Sakkopoulos· International Conference on...· 0 citations
GradLock is introduced, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters and employs dynamic gradient locking to prevent payload degradation during the optimization process.
Jin-Seong Kim, Han-Ju Lee, Seok-Won Hong et al.· 0 citations
Cloud-based language model services routinely process prompts containing sensitive information. Obfuscation-based defenses---including ObfusLM, SentinelLMs, TextObfuscator, and DPNR---mitigate this risk by transforming prompt representations before transmission, offering a lightweight alternative to cryptographic solutions. We show these defenses provide far less protection than previously believed. We present DeepInvert, a semi-supervised embedding inversion attack that recovers original tokens from obfuscated representations with higher accuracy than prior methods. The key insight is that unlabeled obfuscated embeddings retain exploitable semantic structure despite perturbation. DeepInvert combines supervised training on labeled shadow data with a novel unsupervised consistency objective over unlabeled target embeddings, alternating between the two via a mixed training pipeline. Defense-aware adaptations further extend the attack to diverse obfuscation mechanisms across encoder-based and autoregressive architectures. Experiments on nine defenses, five tasks, and four model architectures show that DeepInvert outperforms prior attacks on most defenses. Against ObfusLM, DeepInvert achieves 73.5\% top-1 token recovery versus 26.2\% for the previous best. Our results reveal a task-dependent tension: obfuscation schemes preserving enough signal for utility also retain sufficient structure for inversion, while schemes resisting inversion collapse utility. On simpler classification tasks, some DP-based defenses can maintain both. We call for a re-evaluation of this defense class.