Concept-Aware Privacy Mechanisms for Defending Embedding Inversion Attacks
Text embeddings enable numerous NLP applications but face severe privacy risks from embedding inversion attacks, which can expose sensitive attributes or reconstruct raw text. Existing differential privacy defenses assume uniform sensitivity across embedding dimensions, leading to excessive noise and degraded utility. We propose SPARSE, a user-centric framework for concept-specific privacy protection in text embeddings. SPARSE combines (1) differentiable mask learning to identify privacy-sensitive dimensions for user-defined concepts, and (2) the Mahalanobis mechanism that applies elliptical noise calibrated by dimension sensitivity. Unlike traditional spherical noise injection, SPARSE selectively perturbs privacy-sensitive dimensions while preserving non-sensitive semantics. Evaluated across six datasets with three embedding models and attack scenarios, SPARSE consistently reduces privacy leakage while achieving superior downstream performance compared to state-of-the-art DP methods.
698ac44a1b2dc6b37d61b1af
Yu-Che Tsai
698ac44a1b2dc6b37d61b1b0
Hsiang Hsiao
698ac44a1b2dc6b37d61b1b1
Kuan-Yu Chen
698ac44a1b2dc6b37d61b1b2
Shou-De Lin
Concept-Aware Privacy Mechanisms for Defending Embedding Inversion Attacks
Text embeddings enable numerous NLP applications but face severe privacy risks from embedding inversion attacks, which can expose sensitive attributes or reconstruct raw text. Existing differential privacy defenses assume uniform sensitivity across embedding dimensions, leading to excessive noise and degraded utility. We propose SPARSE, a user-centric framework for concept-specific privacy protection in text embeddings. SPARSE combines (1) differentiable mask learning to identify privacy-sensitive dimensions for user-defined concepts, and (2) the Mahalanobis mechanism that applies elliptical noise calibrated by dimension sensitivity. Unlike traditional spherical noise injection, SPARSE selectively perturbs privacy-sensitive dimensions while preserving non-sensitive semantics. Evaluated across six datasets with three embedding models and attack scenarios, SPARSE consistently reduces privacy leakage while achieving superior downstream performance compared to state-of-the-art DP methods.
SPARSE is a user-centric framework that protects text embeddings from privacy leaks by selectively perturbing sensitive dimensions using differentiable masking and Mahalanobis noise calibration.
text embeddings differential privacy embedding inversion attacks concept-specific privacy protection differentiable mask learning Mahalanobis mechanism elliptical noise privacy-sensitive dimensions downstream performance