Pith. sign in

REVIEW 2 major objections 6 minor 76 references

DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models

T0 review · 2 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Obfuscation-based defenses for cloud language models protect far less than claimed: a semi-supervised embedding-inversion attack recovers 73.5% of tokens from the leading defense, and defenses that resist inversion collapse utility.

desk verdict Genuinely new semi-supervised inversion attack that likely breaks several obfuscation defenses, but the pseudocode contradicts its own threat model and the headline number is transductive; still deserves a serious referee. read the letter →

arxiv 2608.04477 v1 pith:RY45W6TO submitted 2026-08-05 cs.CR cs.CLcs.LG

Zhicong Huang , Cheng Hong , Tao Wei This is my paper · ORCID
classification cs.CRcs.CLcs.LG
keywords embeddinginversionobfuscationdefensessemi-supervisedlearningdifferentialprivacylanguagemodelpromptrecoveryconsistencyregularizationtoken
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that the main class of lightweight defenses for cloud language models, which obfuscate prompts before transmission, protects far less than their papers suggest. It introduces DeepInvert, a semi-supervised attack that trains an inversion model on both labeled shadow embeddings and unlabeled obfuscated embeddings captured from the target service. The attack recovers 73.5% of tokens with its single best guess against the strongest tested defense, versus 26.2% for the previous best attack. If the claim holds, any obfuscation that preserves enough signal for token-level or generative tasks also preserves enough structure to be inverted, while defenses that successfully resist inversion destroy task utility.

What carries the argument

The argument turns on two mechanisms. First, a semi-supervised consistency objective: unlabeled obfuscated embeddings are viewed under weak and strong masking; an exponential-moving-average teacher produces soft top-$k$ targets for the weak view, and the student minimizes a top-$k$ KL divergence to those targets on the strong view, while a supervised loss on shadow embeddings anchors the mapping. Second, for noise-adding defenses, a linear denoising step uses PCA projection, whose effect is captured by the identity $\mathbb{E}\|PP^{T}g\|^{2}/\mathbb{E}\|g\|^{2}=K/H$ for isotropic zero-mean noise $g$, so projecting to $K$ of $H$ dimensions amplifies the signal-to-noise ratio roughly by $H/K$.

What would settle it

Reproduce the ObfusLM experiments in the strictly non-transductive setting, excluding the evaluation split from the unlabeled pool as in Figure 7; if the top-1 recovery on SST-2 does not exceed the supervised-only InvBert baseline of 0.262 under matched hyperparameters, then the advertised unsupervised advantage is an artifact of transductive leakage rather than a general property of obfuscated embeddings.

Watch

Extended reading notes

Core claim

The central discovery is that obfuscation perturbs individual token embeddings but preserves enough relative semantic geometry for a semi-supervised training loop to reconstruct the original tokens. DeepInvert uses labeled shadow embeddings for a supervised cross-entropy loss and unlabeled target embeddings for a consistency loss between a weakly augmented view, scored by an exponential-moving-average teacher, and a strongly augmented view, scored by the student, with soft top-k targets to avoid committing to unreliable pseudo-labels. Alternating the two objectives by epoch prevents gradient conflict. Under previously recommended privacy parameters, the strongest tested defense yields 0.735 top-1 token recovery on SST-2, 0.818 on AG News, and 0.852 on a 27B-parameter autoregressive model in medical question answering at epsilon=1; on token-level NER and generation, defenses that resist recovery collapse utility to near random.

Load-bearing premise

The headline numbers assume the adversary can collect the very prompts it will later be judged on into its unlabeled training pool; when those prompts are held out, recovery on the leading defense drops from 73.5% to 54.5%.

Editorial extensions

If this is right

  • Under recommended privacy settings, the strongest tested defense loses its claimed protection: DeepInvert achieves 73.5% top-1 token recovery on SST-2 versus 26.2% for the previous best attack, with similar gains at epsilon=1 on generation tasks.
  • For token-level and generation workloads, no evaluated scheme simultaneously preserves utility and limits recovery; defenses that resist inversion, CAPE and DP-Forward, drive task utility to near random, for example an F1 of 0 on CoNLL-2003.
  • On sentence-level classification, some DP-based defenses can maintain both accuracy and low token recovery, so the privacy-utility tension is task-dependent rather than universal.
  • Attack performance degrades gracefully without transductive access: excluding the evaluation target from the unlabeled pool still yields 54.5% top-1 recovery on the strongest tested defense, and out-of-domain shadow data leaves most defenses above 70% recovery.
  • The attack transfers to large autoregressive generation models at 8B and 27B parameter scales, indicating the finding is not limited to small encoder models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if the transductive-versus-held-out gap seen in Figure 7 generalizes, then a server-side adversary with continuous access to a target's prompts should be modeled as operating near the transductive curve, making the practical threat larger than the non-transductive numbers suggest.
  • Beyond the paper: the revealed task-dependent tension suggests a design rule that could be tested directly: any obfuscation that preserves token-level utility on NER or generation is likely invertible, so defenses should be evaluated on whether they can mask token identities while preserving only sentence-level statistics.
  • Beyond the paper: the same consistency-based inversion objective could be adapted to pooled representations in retrieval-augmented pipelines, where the transmitted vector is one summary embedding rather than per-token states; the consistency target would need to shift from token IDs to span-level pseudo-labels.
  • Beyond the paper: the PCA denoising lemma implies that, for a fixed privacy budget, increasing embedding dimension while keeping sensitivity bounded may make DP-based defenses more invertible rather than less, an empirically testable inversion of the usual high-dimensional-privacy intuition.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper proposes DeepInvert, a semi-supervised embedding inversion attack that combines supervised training on labeled shadow obfuscated embeddings with an unsupervised consistency objective (soft top-k KL divergence between an EMA teacher and a student on masked augmented views) over unlabeled target embeddings. The training alternates between supervised and unsupervised steps via a linear schedule. Defense-aware additions include multiple shadow models, renormalization, and PCA denoising. The attack is evaluated against nine obfuscation defenses (ObfusLM, SentinelLMs, TextObfuscator, DPNR, CAPE, DP-Forward, Santext, Custext, Datamix), five tasks, and four models (BERT, RoBERTa, LLaMA3-8B, Qwen3.5-27B). The headline result is 73.5% top-1 token recovery against ObfusLM (epsilon=0.1) on RoBERTa/SST-2 versus 26.2% for InvBert. The paper concludes that obfuscation defenses provide far less protection than previously believed on token-level and generation tasks, with a task-dependent privacy-utility tension.

Significance. If the empirical claims hold, DeepInvert represents a substantial advance in embedding inversion: it is, to my knowledge, the first attack to show that unlabeled obfuscated embeddings from the target deployment can be exploited through a semi-supervised objective, and the improvement over InvBert on ObfusLM is large. The evaluation is broad (nine defenses, five tasks, four architectures) and the paper includes a thoughtful analysis of why some DP-based defenses survive (CAPE, DP-Forward) and why DPNR's behavior is model-dependent (Appendix F). The PCA denoising lemma is correctly proved. The central privacy-utility tension finding is useful, though partly a restatement of the empirical pattern. The weakest point is the unresolved data-access ambiguity in Algorithm 1 and the reliance on a transductive evaluation for the headline number; both need to be fixed before the strong advertised claims are taken at face value.

major comments (2)
  1. [§4.2, Algorithm 1] The unsupervised branch (lines 14-15) samples a prompt from D_real and computes x <- extract(d_theta_real, prompt, l), meaning the adversary runs the real target model on the victim's plaintext prompts. This directly contradicts the threat model in Section 3.1, which states that the adversary observes only transmitted obfuscated embeddings and never has access to the victim's plaintext prompts. If the attack actually proceeds this way, it is circular and the advertised 73.5% recovery does not measure inversion under the stated adversary model. Appendix D describes the 'real split' as the full source of unlabeled embeddings available to the attacker, which suggests the implementation uses a precomputed store of observed obfuscated embeddings; in that case Algorithm 1 is simply wrong and should be corrected. Because no code is released, this ambiguity is unresolved and load-bearing; please clarify and fix, and release the code.
  2. [§6.4.6, Figure 7, Abstract/Conclusion] The headline number 73.5% (vs 26.2%) is obtained in the transductive setting, where the evaluation target is included in the unlabeled training pool. The paper's own ablation shows that excluding the target from the unlabeled set drops top-1 to 0.545, which is still a meaningful improvement over InvBert but a much smaller margin. The abstract and conclusion advertise 73.5% without mentioning the transductive protocol. Since the transductive setting is not a realistic description of an adversary attacking future prompts, the main claims should be restated to report both numbers and the abstract should qualify the headline.
minor comments (6)
  1. [Appendix: Open Science] The Open Science appendix states only that datasets and models are open-source; no code or reproduction instructions are provided. Given the Algorithm 1 ambiguity, releasing the code (or a precise data-flow diagram) is necessary.
  2. [§6.2/§6.4] No error bars or multiple-seed variance are reported for any table or figure; please report at least 3 seeds for the headline numbers and key ablations.
  3. [§6.1.6] The text states the transductive setting is 'consistent with prior prompt-inversion works [18], [30]' but cites no specifics; please justify that the transductive setting is a meaningful adversary model.
  4. [§6.4.1, Table 5] The first row of Table 5 is described as 'an approximate upper bound for InvBert with 7 shadow models,' but this configuration uses the unlabeled FixMatch objective, which InvBert does not have; it is a semi-supervised baseline, not an upper bound for InvBert. Please rephrase.
  5. [§4.2, Algorithm 1 input list] The input list uses 'Victim's prompt dataset D_real'; rename this to 'observed obfuscated embeddings' to match the threat model and Appendix D.
  6. [§6.4.5, Table 7] The sentence 'both attacks suffer a larger (relative) performance drop' is ambiguous; the table shows DeepInvert drops from 0.735 to 0.471 and InvBert from 0.262 to 0.184, so please specify which comparison is meant.

Circularity Check

1 steps flagged · score 5.0 of 10

Headline transductive recovery is undermined by Algorithm 1's unsupervised branch consuming victim plaintext prompts through the real target model.

  1. self definitional [Section 4.2, Algorithm 1 lines 13–15; Section 3.1]
    "Sample a prompt from D_real; // Extract an unlabeled x∈R^{L×H} x←extract(d_theta_real,prompt,l); ... The adversary observes all transmitted obfuscated embeddings, which are not labeled with their original token IDs."

    The unsupervised branch defines unlabeled x as extract(d_theta_real,prompt,l) for a prompt sampled from the victim's plaintext dataset D_real. Under the threat model the adversary never sees plaintext prompts, only transmitted obfuscated embeddings. Literally, the adversary uses the real model on the target prompts to create the 'unlabeled' training embeddings, so the 73.5% transductive recovery is not inversion from observed obfuscated embeddings alone; the input already contains the target plaintexts. The paper never acknowledges or corrects this, and no code is released. Figure 7's inductive 0.545 result is independent evidence, but it does not validate the headline transductive number.

full rationale

No other circular step was found. The attack is evaluated against external baselines on standard datasets; the semi-supervised losses, EMA teacher, multi-shadow training, renormalization, and PCA denoising are standard techniques with external citations and are not derived from the target result. The privacy–utility tension is a quantified empirical observation rather than a tautological derivation. The only load-bearing circularity concern is the Algorithm 1 data-access contradiction: if the unsupervised branch really consumes victim plaintext prompts via the real model, the headline transductive attack is circular with respect to the threat model. Because the paper's own ablation shows a non-transductive recovery of 0.545 and the appendix describes the real split as unlabeled embeddings, the central qualitative claim retains independent content; however, the unresolved ambiguity affects the strongest advertised number and is never addressed. The score reflects a partial, unresolved circularity in the main experimental pipeline, not a fully forced derivation.

Assumptions & free parameters 9 free parameters · 4 assumptions · 0 invented entities

The central claim relies on several chosen hyperparameters and domain assumptions about adversary capabilities and obfuscation structure. No novel entities are introduced.

free parameters (9)
  • Masking probabilities p_m (weak 0.2, strong 0.4) = 0.2, 0.4
    Hyperparameters for masked augmented views in Eq. (6)-(7); chosen by the authors and reported in Appendix C, affecting the unsupervised consistency loss.
  • Augmentation noise sigma (weak 0.2, strong 0.4) = 0.2, 0.4
    Gaussian noise added to views during augmentation; tuned per defense.
  • EMA smoothing coefficient alpha = 0.998
    Controls the teacher update in Eq. (9); a chosen constant from the semi-supervised learning literature.
  • Unsupervised ratio schedule (tau_0, tau_{n-1}) = (0.3, 0.7)
    Controls alternation between supervised and unsupervised training in Eq. (10).
  • KL divergence top-k size = 500
    Truncation of the KL loss in Eq. (4); chosen to balance compute and performance.
  • PCA projection dimension K = 384 (from 768)
    Dimension for denoising in Section 5.2; the paper notes K=256 yields worse performance, so it is tuned.
  • Number of shadow models = 7 for ObfusLM, 1 otherwise
    Multi-shadow strategy in Section 5.1; ASR increases with the number of shadows (Figure 6a), so this is a tuned resource that boosts the headline result.
  • Target layer l = 3
    Layer at which embeddings are extracted and obfuscated; chosen as a common choice in prior work, not prescribed by the defenses.
  • DP epsilon settings = epsilon=3 for DP schemes, ObfusLM 0.1/1
    Privacy budget choices; the paper uses epsilon=3 for all epsilon-DP schemes for fair comparison, though some defenses may recommend other values.
assumptions (4)
  • domain assumption The adversary knows the task model architecture and can train shadow models on public data.
    Stated in Section 3.1 threat model; necessary to generate labeled obfuscated embeddings for supervised training.
  • domain assumption Shadow obfuscated embeddings are sufficiently similar in distribution to real obfuscated embeddings for the inversion model to transfer.
    The attack's supervised component depends on this; Section 5.1 introduces multi-shadow to mitigate distribution shift, implicitly assuming it is manageable.
  • domain assumption Obfuscated embeddings retain enough semantic structure to allow token-level inversion when utility is preserved.
    Central to the attack; motivated in Section 3.3 and empirically verified, but not proven.
  • standard math PCA concentrates most signal energy in top-K components, so the SNR improvement argument holds (standard result from [38]).
    Used in Lemma 1 and Section 5.2 for denoising.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models." pith.science (2026). https://pith.science/paper/RY45W6TO

@misc{pith2026260804477,
  author       = {Pith},
  title        = {Pith review of: DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RY45W6TO}},
  note         = {Machine review of arXiv:2608.04477}
}
read the original abstract

Cloud-based language model services routinely process prompts containing sensitive information. Obfuscation-based defenses---including ObfusLM, SentinelLMs, TextObfuscator, and DPNR---mitigate this risk by transforming prompt representations before transmission, offering a lightweight alternative to cryptographic solutions. We show these defenses provide far less protection than previously believed. We present DeepInvert, a semi-supervised embedding inversion attack that recovers original tokens from obfuscated representations with higher accuracy than prior methods. The key insight is that unlabeled obfuscated embeddings retain exploitable semantic structure despite perturbation. DeepInvert combines supervised training on labeled shadow data with a novel unsupervised consistency objective over unlabeled target embeddings, alternating between the two via a mixed training pipeline. Defense-aware adaptations further extend the attack to diverse obfuscation mechanisms across encoder-based and autoregressive architectures. Experiments on nine defenses, five tasks, and four model architectures show that DeepInvert outperforms prior attacks on most defenses. Against ObfusLM, DeepInvert achieves 73.5\% top-1 token recovery versus 26.2\% for the previous best. Our results reveal a task-dependent tension: obfuscation schemes preserving enough signal for utility also retain sufficient structure for inversion, while schemes resisting inversion collapse utility. On simpler classification tasks, some DP-based defenses can maintain both. We call for a re-evaluation of this defense class.

Figures

Figures reproduced from arXiv: 2608.04477 by the authors.

Figure 1
Figure 1. Obfuscated LM Defense and Threat Model. Obfuscated embeddings (without original token IDs) are sent from [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. (a) The original embedding of “audience” ( [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Test accuracy of supervised attacks. Attacker [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Distribution of shadow and real embeddings for [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Task and attack performance on embedding-level DP based schemes. Attack performance is aligned with the left [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: (a) ASR increases with the number of shadow [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Effect of unlabeled data volume on top-1 ASR [PITH_FULL_IMAGE:figures/full_fig_p014_7.png]
Figure 8
Figure 8. Figure 8: Comparison of hidden state magnitudes and [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

76 extracted references · 65 canonical work pages

  1. [1]

    BERT: pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M. Chang, K. Lee, and K. Toutanova, “BERT: pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2019, Minneapolis, MN, USA, pp. 4171– 4186, 2019

    work page 2019

  2. [2]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat,et al., “Gpt-4 technical report,”arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  3. [3]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale,et al., “Llama 2: Open foundation and fine-tuned chat models,”arXiv preprint arXiv:2307.09288, 2023

    arXiv 2023

  4. [4]

    The llama 3 herd of models,

    A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al- Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan,et al., “The llama 3 herd of models,”arXiv preprint arXiv:2407.21783, 2024

    arXiv 2024

  5. [5]

    Qwen2.5 technical report,

    A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Xia, X. Ren, X. Ren, Y . Fan, Y . Su, Y . Zhang, Y . Wan, Y . Liu, Z. Cui, Z. Zhang, and Z. Qiu, “Qwen2...

    arXiv 2024

  6. [6]

    Information leakage in embedding models,

    C. Song and A. Raghunathan, “Information leakage in embedding models,” inCCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, USA, pp. 377–390, 2020

    work page 2020

  7. [7]

    Privacy risks of general- purpose language models,

    X. Pan, M. Zhang, S. Ji, and M. Yang, “Privacy risks of general- purpose language models,” in2020 IEEE Symposium on Security and Privacy, SP 2020, San Francisco, CA, USA, pp. 1314–1331, 2020

    work page 2020

  8. [8]

    Sentinellms: Encrypted input adaptation and fine-tuning of language models for private and secure inference,

    A. Mishra, M. Li, and S. S. Deo, “Sentinellms: Encrypted input adaptation and fine-tuning of language models for private and secure inference,” inThirty-Eighth AAAI Conference on Artificial Intelli- gence, AAAI 2024, Vancouver, Canada, pp. 21403–21411, 2024

    work page 2024

Show all 76 references
  1. [9]

    Obfuslm: Privacy-preserving language model service against embedding inversion attacks,

    Y . Lin, R. Yang, Y . Mao, Q. Zhang, J. Hong, Q. Cai, Y . Wu, H. Liu, Z. Chen, B. Duan, and S. Zhong, “Obfuslm: Privacy-preserving language model service against embedding inversion attacks,” in Proceedings of the 63rd Annual Meeting of the Association for Com- putational Ling...

    2025

  2. [10]

    Datamix: Efficient privacy-preserving edge-cloud inference,

    Z. Liu, Z. Wu, C. Gan, L. Zhu, and S. Han, “Datamix: Efficient privacy-preserving edge-cloud inference,” inComputer Vision - ECCV 2020 - 16th European Conference, Glasgow, UK, August 23-28, vol. 12356, pp. 578–595, 2020

    2020

  3. [11]

    Differen- tial privacy for text analytics via natural text sanitization,

    X. Yue, M. Du, T. Wang, Y . Li, H. Sun, and S. S. M. Chow, “Differen- tial privacy for text analytics via natural text sanitization,” inFindings of the Association for Computational Linguistics: ACL/IJCNLP 2021, August 1-6, pp. 3853–3866, 2021

    2021

  4. [12]

    Differentially private representation for NLP: formal guarantee and an empirical study on privacy and fair- ness,

    L. Lyu, X. He, and Y . Li, “Differentially private representation for NLP: formal guarantee and an empirical study on privacy and fair- ness,” inFindings of the Association for Computational Linguistics: EMNLP 2020, pp. 2355–2365, 2020

    2020

  5. [13]

    Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass,

    M. Du, X. Yue, S. S. M. Chow, T. Wang, C. Huang, and H. Sun, “Dp-forward: Fine-tuning and inference on language models with differential privacy in forward pass,” inProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, CCS 2023, Copenhagen, Den...

    2023

  6. [14]

    Secure transformer inference made non- interactive,

    J. Zhang, X. Yang, L. He, K. Chen, W. Lu, Y . Wang, X. Hou, J. Liu, K. Ren, and X. Yang, “Secure transformer inference made non- interactive,” in32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24- 28, 2025, 2025

    2025

  7. [15]

    THOR: secure transformer inference with homomorphic encryption,

    J. Moon, D. Yoo, X. Jiang, and M. Kim, “THOR: secure transformer inference with homomorphic encryption,” inProceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Secu- rity, CCS 2025, Taipei, Taiwan, October 13-17, 2025, pp. 3765–3779, 2025

    2025

  8. [16]

    Bumblebee: Secure two-party inference framework for large transformers,

    W. Lu, Z. Huang, Z. Gu, J. Li, J. Liu, C. Hong, K. Ren, T. Wei, and W. Chen, “Bumblebee: Secure two-party inference framework for large transformers,” in32nd Annual Network and Distributed System Security Symposium, NDSS 2025, San Diego, California, USA, February 24-28, 2025, 2025

    2025

  9. [17]

    BOLT: privacy-preserving, accurate and efficient inference for transformers,

    Q. Pang, J. Zhu, H. M ¨ollering, W. Zheng, and T. Schneider, “BOLT: privacy-preserving, accurate and efficient inference for transformers,” inIEEE Symposium on Security and Privacy, SP 2024, San Francisco, CA, USA, May 19-23, 2024, pp. 4753–4771, 2024

    2024

  10. [18]

    Depth gives a false sense of privacy: LLM internal states inversion,

    T. Dong, Y . Meng, S. Li, G. Chen, Z. Liu, and H. Zhu, “Depth gives a false sense of privacy: LLM internal states inversion,” in34th USENIX Security Symposium, pp. 1629–1648, 2025

    2025

  11. [19]

    Invbert: Text reconstruc- tion from contextualized embeddings used for derived text formats of literary works,

    J. H ¨ohmann, A. Rettinger, and K. Kugler, “Invbert: Text reconstruc- tion from contextualized embeddings used for derived text formats of literary works,”CoRR, vol. abs/2109.10104, 2021

    2021 arXiv

  12. [20]

    Natural language understanding with privacy-preserving BERT,

    C. Qu, W. Kong, L. Yang, M. Zhang, M. Bendersky, and M. Najork, “Natural language understanding with privacy-preserving BERT,” in CIKM ’21: The 30th ACM International Conference on Information and Knowledge Management, Queensland, Australia, pp. 1488–1497, 2021

    2021

  13. [21]

    Textobfuscator: Making pre-trained language model a privacy protector via obfuscating word representations,

    X. Zhou, Y . Lu, R. Ma, T. Gui, Y . Wang, Y . Ding, Y . Zhang, Q. Zhang, and X. Huang, “Textobfuscator: Making pre-trained language model a privacy protector via obfuscating word representations,” inFindings of the Association for Computational Linguistics: ACL 2023, Toronto, ...

    2023

  14. [22]

    A survey of large language models,

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y . Hou, Y . Min, B. Zhang, J. Zhang, Z. Dong, Y . Du, C. Yang, Y . Chen, Z. Chen, J. Jiang, R. Ren, Y . Li, X. Tang, Z. Liu, P. Liu, J. Nie, and J. Wen, “A survey of large language models,”arXiv preprint arXiv: 2303.18223, 2023

    2023 arXiv

  15. [23]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and I. Polosukhin, “Attention is all you need,” in Conference on Neural Information Processing Systems, PMLR, 2017

    2017

  16. [24]

    A survey of transformers,

    T. Lin, Y . Wang, X. Liu, and X. Qiu, “A survey of transformers,” arXiv preprint arXiv: 2106.04554, 2021

    2021 arXiv

  17. [25]

    A customized text sanitization mechanism with differential privacy,

    S. Chen, F. Mo, Y . Wang, C. Chen, J. Nie, C. Wang, and J. Cui, “A customized text sanitization mechanism with differential privacy,” inFindings of the Association for Computational Linguistics: ACL 2023, Toronto, Canada, July 9-14, 2023, pp. 5747–5758, 2023

    2023

  18. [26]

    Textmixer: Mixing multiple inputs for privacy-preserving inference,

    X. Zhou, Y . Lu, R. Ma, T. Gui, Q. Zhang, and X. Huang, “Textmixer: Mixing multiple inputs for privacy-preserving inference,” inFindings of the Association for Computational Linguistics: EMNLP 2023, Singapore, December 6-10, 2023, pp. 3749–3762, 2023

    2023

  19. [27]

    CAPE: context-aware private embeddings for private language learning,

    R. Plant, D. Gkatzia, and V . Giuffrida, “CAPE: context-aware private embeddings for private language learning,” inProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, EMNLP 2021, pp. 7970–7978, 2021

    2021

  20. [28]

    Mechanism design via differential pri- vacy,

    F. McSherry and K. Talwar, “Mechanism design via differential pri- vacy,” in48th Annual IEEE Symposium on Foundations of Computer Science, FOCS 2007, Providence, RI, USA, October 20-23, 2007, Proceedings, pp. 94–103, 2007

    2007

  21. [29]

    An inversion attack against obfuscated embedding matrix in language model inference,

    Y . Lin, Q. Zhang, Q. Cai, J. Hong, W. Ye, H. Liu, and B. Duan, “An inversion attack against obfuscated embedding matrix in language model inference,” inProceedings of the 2024 Conference on Empiri- cal Methods in Natural Language Processing, EMNLP 2024, Miami, FL, USA, pp. 21...

    2024

  22. [30]

    Prompt inversion attack against collaborative inference of large language models,

    W. Qu, Y . Zhou, Y . Wu, T. Xiao, B. Yuan, Y . Li, and J. Zhang, “Prompt inversion attack against collaborative inference of large language models,” inIEEE Symposium on Security and Privacy, pp. 1695–1712, 2025

    2025

  23. [31]

    Exploiting unintended feature leakage in collaborative learning,

    L. Melis, C. Song, E. D. Cristofaro, and V . Shmatikov, “Exploiting unintended feature leakage in collaborative learning,” in2019 IEEE Symposium on Security and Privacy, SP 2019, San Francisco, CA, USA, pp. 691–706, 2019

    2019

  24. [32]

    Fixmatch: Simplifying semi- supervised learning with consistency and confidence,

    K. Sohn, D. Berthelot, N. Carlini, Z. Zhang, H. Zhang, C. Raffel, E. D. Cubuk, A. Kurakin, and C. Li, “Fixmatch: Simplifying semi- supervised learning with consistency and confidence,” inAdvances in Neural Information Processing Systems 33: Annual Conference on Neural Informat...

    2020

  25. [33]

    Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning results,

    A. Tarvainen and H. Valpola, “Mean teachers are better role models: Weight-averaged consistency targets improve semi-supervised deep learning results,” inAdvances in Neural Information Processing Sys- tems, vol. 30, 2017

    2017

  26. [34]

    Bootstrap your own latent - A new approach to self-supervised learning,

    J. Grill, F. Strub, F. Altch ´e, C. Tallec, P. H. Richemond, E. Buchatskaya, C. Doersch, B. ´A. Pires, Z. Guo, M. G. Azar, B. Piot, K. Kavukcuoglu, R. Munos, and M. Valko, “Bootstrap your own latent - A new approach to self-supervised learning,” inAdvances in Neural Informatio...

    2020

  27. [35]

    Gradient surgery for multi-task learning,

    T. Yu, S. Kumar, A. Gupta, S. Levine, K. Hausman, and C. Finn, “Gradient surgery for multi-task learning,” inAdvances in Neural Information Processing Systems 33: NeurIPS 2020, 2020

    2020

  28. [36]

    Curriculum learning,

    Y . Bengio, J. Louradour, R. Collobert, and J. Weston, “Curriculum learning,” inProceedings of the 26th Annual International Confer- ence on Machine Learning, ICML 2009, Montreal, Quebec, Canada, vol. 382, pp. 41–48, 2009

    2009

  29. [37]

    Curriculum learning: A survey,

    P. Soviany, R. T. Ionescu, P. Rota, and N. Sebe, “Curriculum learning: A survey,”CoRR, vol. abs/2101.10382, 2021

    2021 arXiv

  30. [38]

    C. M. Bishop,Pattern Recognition and Machine Learning. Springer, 2006

    2006

  31. [39]

    Lora: Low-rank adaptation of large language models,

    E. J. Hu, Y . Shen, P. Wallis, Z. Allen-Zhu, Y . Li, S. Wang, L. Wang, and W. Chen, “Lora: Low-rank adaptation of large language models,” inThe Tenth International Conference on Learning Representations, ICLR 2022, Virtual Event, April 25-29, 2022, OpenReview.net, 2022

    2022

  32. [40]

    PyTorch: An imperative style, high-performance deep learning library,

    A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. K ¨opf, E. Z. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, “PyTorch: An imperative style, hi...

    2019

  33. [41]

    Roberta: A robustly optimized BERT pretraining approach,

    Y . Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V . Stoyanov, “Roberta: A robustly optimized BERT pretraining approach,”CoRR, vol. abs/1907.11692, 2019

    1907 arXiv

  34. [42]

    Qwen3.5-27b

    Q. Team, “Qwen3.5-27b.” https://huggingface.co/Qwen/Qwen3. 5-27B, 2025

    2025

  35. [43]

    Recursive deep models for semantic compositionality over a sentiment treebank,

    R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y . Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” inProceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, EMNLP 2013, pp. 1631–1642, 2013

    2013

  36. [44]

    Introduction to the conll- 2003 shared task: Language-independent named entity recognition,

    E. F. T. K. Sang and F. D. Meulder, “Introduction to the conll- 2003 shared task: Language-independent named entity recognition,” inProceedings of the Seventh Conference on Natural Language Learning, CoNLL 2003, Held in cooperation with HLT-NAACL 2003, Edmonton, Canada, pp. 14...

    2003

  37. [45]

    Character-level convolutional networks for text classification,

    X. Zhang, J. J. Zhao, and Y . LeCun, “Character-level convolutional networks for text classification,” inAdvances in Neural Information Processing Systems 28: Annual Conference on Neural Information Processing Systems 2015, pp. 649–657, 2015

    2015

  38. [46]

    What disease does this patient have? a large-scale open domain question answering dataset from medical exams,

    D. Jin, E. Pan, N. Oufattole, W.-H. Weng, H. Fang, and P. Szolovits, “What disease does this patient have? a large-scale open domain question answering dataset from medical exams,”arXiv preprint arXiv:2009.13081, 2020

    2009 arXiv

  39. [47]

    Medical meadow medqa dataset

    “Medical meadow medqa dataset.” https://huggingface.co/datasets/ medalpaca/medical meadow medqa. Accessed: 2026-05-08

    2026

  40. [48]

    Enron emails dataset

    “Enron emails dataset.” https://huggingface.co/datasets/corbt/ enron-emails. Accessed: 2026-05-08

    2026

  41. [49]

    seqeval: A python framework for sequence labeling evaluation,

    H. Nakayama, “seqeval: A python framework for sequence labeling evaluation,” 2018. Software available from https://github.com/chakki- works/seqeval

    2018

  42. [50]

    Sentence-level privacy for document embeddings,

    C. Meehan, K. Mrini, and K. Chaudhuri, “Sentence-level privacy for document embeddings,” inProceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2022, Dublin, Ireland, pp. 3367–3380, 2022

    2022

  43. [51]

    Stanford alpaca: An instruction- following llama model

    R. Taori, I. Gulrajani, T. Zhang, Y . Dubois, X. Li, C. Guestrin, P. Liang, and T. Hashimoto, “Stanford alpaca: An instruction- following llama model.” https://github.com/tatsu-lab/stanford alpaca,

  44. [52]

    Textfusion: Privacy-preserving pre-trained model inference via token fusion,

    X. Zhou, J. Lu, T. Gui, R. Ma, Z. Fei, Y . Wang, Y . Ding, Y . Cheung, Q. Zhang, and X. Huang, “Textfusion: Privacy-preserving pre-trained model inference via token fusion,” inProceedings of the 2022 Confer- ence on Empirical Methods in Natural Language Processing, EMNLP 2022,...

    2022

  45. [53]

    Towards privacy-preserving LLM inference via covariant obfuscation (technical report),

    Y . Lin, Q. Zhang, W. Ruan, D. Zhang, J. Hong, Y . Wu, H. Xia, Y . Mao, and S. Zhong, “Towards privacy-preserving LLM inference via covariant obfuscation (technical report),”CoRR, vol. abs/2603.01499, 2026

    2026

  46. [54]

    Eguard: Defending LLM embeddings against inversion attacks via text mutual information optimization,

    T. Liu, H. Yao, F. Lin, T. Wu, Z. Qin, and K. Ren, “Eguard: Defending LLM embeddings against inversion attacks via text mutual information optimization,” inFortieth AAAI Conference on Artificial Intelligence, Thirty-Eighth Conference on Innovative Applications of Artificial In...

    2026

  47. [55]

    ALGEN: few-shot inversion at- tacks on textual embeddings using alignment and generation,

    Y . Chen, Q. Xu, and J. Bjerva, “ALGEN: few-shot inversion at- tacks on textual embeddings using alignment and generation,”CoRR, vol. abs/2502.11308, 2025

    2025 arXiv

  48. [56]

    Pleak: Prompt leaking attacks against large language model applications,

    B. Hui, H. Yuan, N. Gong, P. Burlina, and Y . Cao, “Pleak: Prompt leaking attacks against large language model applications,” inPro- ceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 3600–3614, 2024

    2024

  49. [57]

    Prompt obfusca- tion for large language models,

    D. Pape, S. Mavali, T. Eisenhofer, and L. Sch ¨onherr, “Prompt obfusca- tion for large language models,” in34th USENIX Security Symposium, USENIX Security, pp. 2323–2342, 2025. Appendix

    2025

  50. [59]

    Open Science All benchmark datasets and models used in this paper are open-source and made publicly accessible by their original contributors

  51. [60]

    Letz=PP Tg

    PCA-Based Linear Denoising Lemma 2.Supposeg∈R H is a noise vector where each dimension is independent with mean 0 and varianceσ 2, i.e., g∼(0,σ 2IH). Letz=PP Tg. Then E∥z∥2 E∥g∥2 = K H . Proof.We haveE∥g∥ 2 =Hσ 2 andP TP=I K, and: E∥z∥2 =E(g TPP TPP Tg) =E(g TPP Tg) =E[tr(PP T...

    2003

  52. [61]

    Unless otherwise stated, we set(p m,σ) = (0.2,0.2) for weak augmentation views, and(p m,σ) = (0.4,0.4) for strong augmentation views

    Implementation Details We provide detailed hyperparameters forDeepInvert below. Unless otherwise stated, we set(p m,σ) = (0.2,0.2) for weak augmentation views, and(p m,σ) = (0.4,0.4) for strong augmentation views. The smoothing coefficient for the EMA teacher is set to 0.998. ...

  53. [62]

    real split

    Dataset Details We provide dataset statistics in Table 8. The “real split” is the full source of unlabeled embeddings available to the attacker; the “real target split” is the evaluation subset. Below we describe each dataset. SST-2 [43].Movie review sentences with binary sent...

    2003

  54. [63]

    As before, we focus on RoBERTa-based models; the corresponding BERT results exhibit the same qualitative trends and lead to identical conclusions

    Experimental Results on Multi-Class Classifica- tion Tasks We omit SentinelLMs and theϵ= 3configuration of ObfusLM and report only the more informative multi-class classification results in Table 9. As before, we focus on RoBERTa-based models; the corresponding BERT results ex...

    2003

  55. [64]

    Under DPNR (ϵ= 15), LLaMA3-8B hidden states have an ab- solute mean of 0.3661 while Qwen3.5-27B’s are 0.0843; the injected noise (mean 0.0562) is model-independent

    Distribution of Hidden States and Noise Figure 8 illustrates why the same defense can lead to different inversion performance across architectures. Under DPNR (ϵ= 15), LLaMA3-8B hidden states have an ab- solute mean of 0.3661 while Qwen3.5-27B’s are 0.0843; the injected noise ...

  56. [65]

    These approaches remain far too expensive for practical deployment

    Performance of Cryptographic Solutions To illustrate the current status of cryptographic defenses, Table 10 reports the cost of a single BERT inference (sequence length 128) for several state-of-the-art schemes. These approaches remain far too expensive for practical deployment

  57. [66]

    In most cases, InvBert fails to reconstruct fluent sentences that preserve the original semantics, whereasDeepInvert recovers the majority of the original content

    Example Attacks on ObfusLM Table 11 presents illustrative attack examples against ObfusLM (ϵ= 0.1) configured with RoBERTa on SST-2. In most cases, InvBert fails to reconstruct fluent sentences that preserve the original semantics, whereasDeepInvert recovers the majority of th...

  58. [67]

    However, whenL s andL (k) u have conflicting gradients, a fixedλyields a compromise update that attenuates use- ful components—a phenomenon known asgradient con- flict[35]

    Mixed Training: Motivation and Interpretation Equation 5 with a fixedλis standard joint optimization. However, whenL s andL (k) u have conflicting gradients, a fixedλyields a compromise update that attenuates use- ful components—a phenomenon known asgradient con- flict[35]. Em...

  59. [68]

    This shares a similar motivation with the projection step in TABLE 9: Attack performance on various defenses of sentence-level and token-level multi-class classification tasks

    The two gradients never appear in the same update step, so per-step destructive interference is avoided. This shares a similar motivation with the projection step in TABLE 9: Attack performance on various defenses of sentence-level and token-level multi-class classification ta...

  60. [69]

    This resemblescurriculum learningover objectives [36], [37]

    The weighting is non-stationary:τ i increases linearly fromτ 0 toτ n−1, allowing the model to first acquire enough supervised signal before the unsupervised ob- jective begins to dominate. This resemblescurriculum learningover objectives [36], [37]. We therefore view mixed tra...

  61. [70]

    Your task is to identify and annotate sensitive information in English text by wrapping each sensitive span with <sensitive> and </sensitive> tags

    Sensitive Token Tagging Prompt We use the following prompt to annotate sensitive tokens in the Medical QA and Email datasets via GPT-5.6: You are a sensitive information detection agent. Your task is to identify and annotate sensitive information in English text by wrapping ea...

  62. [71]

    Dr. Smith

    Personally Identifiable Information (PII) - Full names, partial names with titles (e.g., "Dr. Smith", "Mr. John") - Phone numbers, email addresses, physical addresses - Government IDs: SSN, passport numbers, driver's license numbers - Date of birth, age combined with gender or...

  63. [72]

    major depressive disorder

    Medical & Health Information (PHI) - Diagnoses and psychiatric conditions (e.g., "major depressive disorder") - Prescription drugs and dosages (e.g., "fluoxetine", "20mg Lisinopril") - Vital signs and lab values (e.g., "temperature is 38.9 C", "blood pressure is 152/94 mm Hg")...

  64. [73]

    Financial Information - Credit card numbers, bank account numbers - Transaction amounts, salary figures - Insurance policy numbers

  65. [74]

    Credentials & Secrets - Passwords, API keys, access tokens - Private keys, secret questions and answers

  66. [75]

    Confidential & Proprietary Information - Internal project codenames, unpublished research data - Trade secrets, proprietary algorithms - Confidential business strategies or internal metrics

  67. [76]

    blood pressure is 152/94 mm Hg

    Location Information - Specific office locations, GPS coordinates - Private residential addresses ## Annotation Rules - Wrap each sensitive span inline within the original text. Do not rephrase, reorder, or summarize. - Tag the minimal meaningful span. For example, tag "blood ...

  68. [2023]

    Accessed: 2025-01-08

    2025

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.