Mitigating Privacy Risks in LLM Embeddings from Embedding Inversion

Tiantian Liu,Hongwei Yao,Tong Wu,Zhan Qin,Feng Lin,Kui Ren,Chun Chen

2024-11-06

Abstract:Embeddings have become a cornerstone in the functionality of large language models (LLMs) due to their ability to transform text data into rich, dense numerical representations that capture semantic and syntactic properties. These embedding vector databases serve as the long-term memory of LLMs, enabling efficient handling of a wide range of natural language processing tasks. However, the surge in popularity of embedding vector databases in LLMs has been accompanied by significant concerns about privacy leakage. Embedding vector databases are particularly vulnerable to embedding inversion attacks, where adversaries can exploit the embeddings to reverse-engineer and extract sensitive information from the original text data. Existing defense mechanisms have shown limitations, often struggling to balance security with the performance of downstream tasks. To address these challenges, we introduce Eguard, a novel defense mechanism designed to mitigate embedding inversion attacks. Eguard employs a transformer-based projection network and text mutual information optimization to safeguard embeddings while preserving the utility of LLMs. Our approach significantly reduces privacy risks, protecting over 95% of tokens from inversion while maintaining high performance across downstream tasks consistent with original embeddings.

Cryptography and Security,Artificial Intelligence,Computation and Language

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the potential privacy leakage risks that may be brought about during the use of embedding vector databases in large - language models (LLMs). Specifically, embedding vector databases are vulnerable to embedding inversion attacks, that is, attackers can use embedding vectors for reverse - engineering to extract sensitive information from the original text data. This type of attack poses a serious threat to users' privacy, especially when embedding vector databases are widely used in online LLMs such as the ChatGPT platform.

To meet this challenge, the paper proposes a new defense mechanism - Eguard. Eguard aims to reduce the correlation between text and its embedding vectors by using Transformer - based projection networks and text mutual - information optimization techniques, thereby effectively resisting embedding inversion attacks while maintaining the performance of LLMs in downstream tasks. The paper proves through experiments that Eguard can protect more than 95% of tokens from reverse attacks, and the consistency with the original embedding in four downstream tasks exceeds 98%.

In summary, the main contribution of this paper lies in systematically analyzing the privacy risks in the inference stage of LLMs, especially the threats posed by embedding inversion attacks, and proposing an innovative defense mechanism, Eguard, to balance the requirements of privacy protection and model functionality.