John X. Morris, Volodymyr Kuleshov, Vitaly Shmatikov, Alexander M. Rush
2023 · arXiv
How much private information do text embeddings reveal about the original text? We investigate the problem of embedding \textit{inversion}, reconstructing the full text represented in dense text embeddings. We frame the problem as controlled generation: generating text that, when reembedded, is close to a fixed point in latent space. We find that although a naïve model conditioned on the embedding performs poorly, a multi-step method that iteratively corrects and re-embeds text is able to recover $92\%$ of $32\text{-token}$ text inputs exactly. We train our model to decode text embeddings from two state-of-the-art embedding models, and also show that our model can recover important personal information (full names) from a dataset of clinical notes. Our code is available on Github: \href{https://github.com/jxmorris12/vec2text}{github.com/jxmorris12/vec2text}.
Metadata: arXiv. Abstracts retain their original authors’ rights.
Original HN comments, with labels from simple text rules. A label describes the whole comment and may miss context or irony. Read the discussion to make up your own mind. About the labels
6 selected excerpts · 6 total mentions
A recent paper [1] shows that what you're describing is possible to some degree - you can reproduce text from its embeddings. The paper provides the code implementing the reversal process, so you could quickly hack together a prototype :) I also recommend a video by Yannic Kilcher [2], explaining the paper. [1] https://arxiv.org/abs/2310.06816 [2] https://www.youtube.com/watch?v=FY5j3P9tCeA
No, the original text can largely be recovered from embeddings[0] if you know which embedding model was used. [0] https://arxiv.org/abs/2310.06816
I remembered about a paper that sheds light on this issue. An embedding can store/recover exactly a short sentence: > a multi step method that iteratively corrects and re embeds text is able to recover 92% of 32-token text inputs exactly https://arxiv.org/abs/2310.06816 So it's probably 1 sentence == 1 embedding
Text embeddings should not be used as a form of encryption. They are optimized to contain as much information as possible from the text they represent and can often be decoded into their input: https://arxiv.org/abs/2310.06816
You might be interested in "Text Embeddings Reveal (Almost) As Much As Text": > We train our model to decode text embeddings from two state-of-the-art embedding models, and also show that our model can recover important personal information (full names) from a dataset of clinical notes. https://arxiv.org/pdf/2310.06816.pdf There's certainly information loss, but there is also a lot of information still present.
Phrase embeddings could bring a 32x reduction in sequence length because: > Text Embeddings Reveal (Almost) As Much As Text. ... We find that although a naïve model conditioned on the embedding performs poorly, a multi step method that iteratively corrects and re embeds text is able to recover 92% of 32-token text inputs exactly. We train our model to decode text embeddings from two state of the art embedding models, and also show that our model can recover important personal information (full names) from a dataset of clinical notes. https://arxiv.org/abs/2310.06816
More from the same topics.
Scott Aaronson
Can NP-complete problems be solved efficiently in the physical universe?
Purna Mukherjee, Zachary M. Augur, Mingyi Li +10
AbstractGlioblastoma (GBM) is an aggressive primary human brain tumour that has resisted effective therapy for decades.
Jackson S. Turner, Wooseob Kim, Elizaveta Kalaidina +10
Joel Lehman, Jeff Clune, Dusan Misevic +50
Biological evolution provides a creative fount of complex and subtle adaptations, often surprising the scientists who discover them.