{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2608-18610","title":"Denoising-Aware Inversion: Revealing Privacy Risks in Noise-Protected Text Embeddings","arxiv_id":"2608.18610","date":"2026-08-19","proceeding":null,"authors":["Yubo Wang","Shujie Cui","James Bailey","Hongzhi Yin","Wenyu Liang","Min Tang","Shiyue Qin","Weiqing Wang"],"abstract":"Dense text embeddings are widely used in data mining, retrieval, and downstream machine learning systems due to their compact and semantically rich representations, but recent embedding inversion attacks have shown that they can expose substantial information about the original text, leading to serious privacy leakage risks. A common defense is to release perturbed embeddings by adding Gaussian noise, which is simple yet effective against standard inversion attacks and does not significantly degrade embedding utility for downstream tasks. However, it remains unclear whether such noise-protected embeddings are sufficiently safe against adaptive attackers that explicitly account for the perturbation process. In this paper, we study text embedding inversion in a noise-protected setting, where the attacker can observe only noisy embeddings and has no access to clean embedding targets. We first analyze why existing generative inversion methods fail under this setting and identify a \"Double Noise Trap\", which fundamentally prevents standard generative inversion models from achieving high-quality reconstruction. To address this challenge, we propose DAEI, a denoising-aware embedding inversion pipeline that combines a residual denoising autoencoder with generative text inversion where the denoiser is trained in an unsupervised manner using Stein's unbiased risk estimate to enable denoising from noisy observations alone. Extensive experiments show that DAEI achieves approximately 154\\% relative improvement in BLEU over the existing generative inversion baseline, while also improving token-level F1 and ROUGE-L by 32--60\\%. The promising inversion performance of DAEI challenges the prevailing assumption that simple Gaussian perturbation is sufficient to prevent sensitive information leakage from embedding representations.","url_abs":"https://arxiv.org/abs/2608.18610","url_pdf":"https://arxiv.org/pdf/2608.18610","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2608.18610","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2608.18610"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/ChrisWang233/DAEI","reach":null}],"summary":{"ran":8},"by_repo_kind":{"found_in_text":{"samples":8,"ran":8,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":8,"samples":[{"code_sha256_prefix":"1c13cb7bbcec5b37","entry":"args_from_config","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/analyze_utils.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/analyze_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1c13cb7bbcec5b37"}},{"code_sha256_prefix":"5769292b81991eba","entry":"create_omi_ex","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/data_helpers.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/data_helpers.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"5769292b81991eba"}},{"code_sha256_prefix":"765311451bed36b3","entry":"create_yahoo_qa_ex","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/data_helpers.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/data_helpers.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"765311451bed36b3"}},{"code_sha256_prefix":"f834afa092a0807a","entry":"info_nce_loss","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/losses/contrastive.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/losses/contrastive.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f834afa092a0807a"}},{"code_sha256_prefix":"9ce3fa900ab6c176","entry":"load_results_from_folder","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/analyze_utils.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/analyze_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9ce3fa900ab6c176"}},{"code_sha256_prefix":"ef46926fc133cd6e","entry":"mc_sure_loss","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/losses/sure.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/losses/sure.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"ef46926fc133cd6e"}},{"code_sha256_prefix":"9b873d4f2d3e961b","entry":"n2n_loss","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/losses/n2n.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/losses/n2n.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9b873d4f2d3e961b"}},{"code_sha256_prefix":"3573db145e620dca","entry":"rademacher_like","repo":"ChrisWang233/DAEI","repo_kind":"found_in_text","path":"DAEI/losses/sure.py","file_url":"https://github.com/ChrisWang233/DAEI/blob/HEAD/DAEI/losses/sure.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3573db145e620dca"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.LG","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}