Extracting Privacy from Text Embeddings: A Model Inversion Attack via Semantic Correction and Low-Frequency Entities Preservation

Model inversion attack (MIAs), a critical privacy threat in artificial intelligence, focuses on reconstructing sensitive original text (such as medical records) from text model output embeddings.Current attacks predominantly rely on AutoRegressive Language Models (ARLMs) but struggle with semantic inconsistency and missing sensitive entities. Specifically, ARLMs’ error-amplifying property exacerbates semantic deviation when relying solely on embeddings. Furthermore, their statistical bias toward high-frequency words prevents the successful extraction of critical low-frequency named entities. To amplify the threat of MIAs against language models, a Semantic Correction and Low-Frequency Entities Preservation Model Inversion Attack method named SEIA is proposed. Rather than naively generating text, our attack actively exploits the embedding space. We introduce a semantic calibration mechanism that minimizes cross-entropy loss against original distributions, enabling the attacker to perform global corrections and effectively bypass the cumulative decoding errors of ARLMs. Furthermore, to maximize the compromise of highly sensitive information, a candidate text queue is implemented through beam search to retain low-frequency entities as much as possible, thereby improving the reconstruction rate of named entities in the text. Experimental results demonstrate that SEIA outperforms existing state-of-the-art methods on mainstream text datasets, confirming that exposing only the embeddings enables accurate inference of the original texts.