DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models

• URL: http://arxiv.org/abs/2608.04477v1
• Date: Wed, 05 Aug 2026 06:02:51 GMT
• Title: DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models
• Abstract summary: Cloud-based language model services process prompts containing sensitive information.<n>Obfuscation-based defenses transform prompt representations before transmission, offering a lightweight alternative to cryptographic solutions.<n>We show these defenses provide far less protection than previously believed.<n>We present DeepInvert, a semi-supervised embedding inversion attack that recovers original tokens from obfuscated representations with higher accuracy than prior methods.
• Score: 8.719976368689826
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Cloud-based language model services routinely process prompts containing sensitive information. Obfuscation-based defenses---including ObfusLM, SentinelLMs, TextObfuscator, and DPNR---mitigate this risk by transforming prompt representations before transmission, offering a lightweight alternative to cryptographic solutions. We show these defenses provide far less protection than previously believed. We present DeepInvert, a semi-supervised embedding inversion attack that recovers original tokens from obfuscated representations with higher accuracy than prior methods. The key insight is that unlabeled obfuscated embeddings retain exploitable semantic structure despite perturbation. DeepInvert combines supervised training on labeled shadow data with a novel unsupervised consistency objective over unlabeled target embeddings, alternating between the two via a mixed training pipeline. Defense-aware adaptations further extend the attack to diverse obfuscation mechanisms across encoder-based and autoregressive architectures. Experiments on nine defenses, five tasks, and four model architectures show that DeepInvert outperforms prior attacks on most defenses. Against ObfusLM, DeepInvert achieves 73.5\% top-1 token recovery versus 26.2\% for the previous best. Our results reveal a task-dependent tension: obfuscation schemes preserving enough signal for utility also retain sufficient structure for inversion, while schemes resisting inversion collapse utility. On simpler classification tasks, some DP-based defenses can maintain both. We call for a re-evaluation of this defense class.

Related papers

• A Novel Semantic Manifold Alignment Attack against Embedding-to-Embedding Obfuscation in Privacy-Preserving LLMs [15.442449185301072]
  We propose Proxy Manifold Alignment (PMA) as a novel attack against E2EO in privacy-preserving language models.<n>PMA consistently achieves higher plaintext recovery than other state-of-the-art attack methods.
  arXiv  Detail & Related papers  (2026-09-06T17:45:18Z)
• DEFUSE: Generalizable Backdoor Defense for Self-Supervised Encoders with Generative Priors [40.98521902229488]
  Self-supervised learning (SSL) encoders are vulnerable to backdoor attacks.<n>DEFUSE is a generalizable backdoor detection framework for SSL encoders.
  arXiv  Detail & Related papers  (2026-08-26T14:24:05Z)
• Recover, Decode, Reguard: Guard-Agnostic Defense Amplification againstEncoded VLM Jailbreaks [7.287314790466206]
  We build a guard-agnostic recover-and-decode amplifier for vision-language models.<n>We evaluate it against an ensemble of eleven attacks, scoring a behavior as broken if any succeeds.<n>This exposes our central finding: an empirical safety-utility ceiling for the non-iterative recovery defenses we evaluate.
  arXiv  Detail & Related papers  (2026-07-29T07:53:35Z)
• The Platonic Defense: Backdoor Defense for Self-Supervised Encoders in the Era of Large Scale Pre-training [41.266464913728335]
  Self-supervised learning (SSL) pretrained models have become a dominant paradigm for visual representation learning, but they are vulnerable to backdoor attacks.<n>We propose a new attack-agnostic, model-agnostic, and modality-agnostic black-box test-time defense paradigm, called emphPlatonic Representation Defense.<n>We demonstrate the effectiveness of our method on multiple self-supervised encoders and more than 10 attacks.
  arXiv  Detail & Related papers  (2026-06-28T15:16:08Z)
• Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack [78.02110947708535]
  Adversarial images pose a severe security threat to multimodal large language models through prompt injection.<n>We show that successful adversarial attacks do not rely on the entire image uniformly but instead depend on a small subset of critical image tokens.<n>We propose Gradient Token Masking (GTM), which localizes these tokens via gradient analysis and neutralizes them through masking.
  arXiv  Detail & Related papers  (2026-05-24T17:51:34Z)
• TwinGate: Stateful Defense against Decompositional Jailbreaks in Untraceable Traffic via Asymmetric Contrastive Learning [60.68349524623048]
  Decompositional jailbreaks pose a critical threat to large language models.<n>We present TwinGate, a stateful dual-encoder defense framework.<n>We construct a comprehensive dataset of over 3.62 million instructions spanning 8,600 distinct malicious intents.
  arXiv  Detail & Related papers  (2026-04-30T13:44:01Z)
• DeepGuard: Secure Code Generation via Multi-Layer Semantic Aggregation [22.14448091276763]
  A common strategy for security hardening is to fine-tune models using supervision derived from the final transformer layer.<n>This design may suffer from a final-layer bottleneck: vulnerability-discriminative cues can be distributed across layers and become less detectable near the output representations optimized for next-token prediction.<n>We introduce DeepGuard, a framework that leverages distributed security-relevant cues by aggregating representations from multiple upper layers via an attention-based module.
  arXiv  Detail & Related papers  (2026-04-10T08:19:48Z)
• Reverse-Engineering Model Editing on Language Models [13.281350510944383]
  We propose a two-stage reverse-engineering attack named textitKSTER (textbfKeytextbfSpaceReconstextbfTruction-then-textbfEntropytextbfReduction)<n>Our attacks can recover edited data with high success rates.
  arXiv  Detail & Related papers  (2026-02-07T08:35:59Z)
• Securing Transfer-Learned Networks with Reverse Homomorphic Encryption [0.764671395172401]
  We show that differentially private (DP) training can defend against training-data reconstruction attacks.<n>We propose a novel homomorphic encryption (HE) method that protects training data without degrading model's accuracy.
  arXiv  Detail & Related papers  (2025-05-20T13:09:22Z)
• Reformulation is All You Need: Addressing Malicious Text Features in DNNs [53.45564571192014]
  We propose a unified and adaptive defense framework that is effective against both adversarial and backdoor attacks.<n>Our framework outperforms existing sample-oriented defense baselines across a diverse range of malicious textual features.
  arXiv  Detail & Related papers  (2025-02-02T03:39:43Z)
• Improving Adversarial Robustness via Decoupled Visual Representation Masking [65.73203518658224]
  In this paper, we highlight two novel properties of robust features from the feature distribution perspective. We find that state-of-the-art defense methods aim to address both of these mentioned issues well. Specifically, we propose a simple but effective defense based on decoupled visual representation masking.
  arXiv  Detail & Related papers  (2024-06-16T13:29:41Z)
• Hidden Backdoor Attack against Semantic Segmentation Models [60.0327238844584]
  The emphbackdoor attack intends to embed hidden backdoors in deep neural networks (DNNs) by poisoning training data. We propose a novel attack paradigm, the emphfine-grained attack, where we treat the target label from the object-level instead of the image-level. Experiments show that the proposed methods can successfully attack semantic segmentation models by poisoning only a small proportion of training data.
  arXiv  Detail & Related papers  (2021-03-06T05:50:29Z)
• A Self-supervised Approach for Adversarial Robustness [105.88250594033053]
  Adversarial examples can cause catastrophic mistakes in Deep Neural Network (DNNs) based vision systems. This paper proposes a self-supervised adversarial training mechanism in the input space. It provides significant robustness against the textbfunseen adversarial attacks.
  arXiv  Detail & Related papers  (2020-06-08T20:42:39Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.