defense arXiv Sep 22, 2025 · Sep 2025
Duoxun Tang, Xinhang Jiang, Jiajun Niu · Tsinghua University · The Chinese University of Hong Kong
Defends text embeddings against inversion attacks using RL-learned, geometry-aware orthogonal noise with PII signal guidance
Model Inversion Attack nlp
Text embedding inversion attacks reconstruct original sentences from latent representations, posing severe privacy threats in collaborative inference and edge computing. We propose TextCrafter, an optimization-based adversarial perturbation mechanism that combines RL learned, geometry aware noise injection orthogonal to user embeddings with cluster priors and PII signal guidance to suppress inversion while preserving task utility. Unlike prior defenses either non learnable or agnostic to perturbation direction, TextCrafter provides a directional protective policy that balances privacy and utility. Under strong privacy setting, TextCrafter maintains 70 percentage classification accuracy on four datasets and consistently outperforms Gaussian/LDP baselines across lower privacy budgets, demonstrating a superior privacy utility trade off.
llm transformer Tsinghua University · The Chinese University of Hong Kong
ML Security Papers