DeepInvert: Semi-Supervised Embedding Inversion Against Obfuscated Language Models

2026-08-05

AI Summary

This work addresses the overestimated security of existing obfuscation-based privacy-preserving mechanisms for cloud language models—such as ObfusLM and SentinelLM—which fail to adequately prevent prompt leakage. To this end, we propose DeepInvert, a semi-supervised embedding inversion attack that alternates between optimizing supervised loss on labeled shadow data and a consistency regularization term on unlabeled target embeddings within a unified training pipeline. DeepInvert further incorporates a defense-aware adaptation mechanism to significantly enhance its inversion capability against diverse obfuscation strategies. Extensive experiments across nine defenses, five tasks, and four model architectures demonstrate that DeepInvert substantially outperforms prior attacks; notably, it achieves a 73.5% top-1 token recovery accuracy against ObfusLM, far surpassing the previous best result of 26.2%.

Abstract

Cloud-based language model services routinely process prompts containing sensitive information. Obfuscation-based defenses---including ObfusLM, SentinelLMs, TextObfuscator, and DPNR---mitigate this risk by transforming prompt representations before transmission, offering a lightweight alternative to cryptographic solutions. We show these defenses provide far less protection than previously believed. We present DeepInvert, a semi-supervised embedding inversion attack that recovers original tokens from obfuscated representations with higher accuracy than prior methods. The key insight is that unlabeled obfuscated embeddings retain exploitable semantic structure despite perturbation. DeepInvert combines supervised training on labeled shadow data with a novel unsupervised consistency objective over unlabeled target embeddings, alternating between the two via a mixed training pipeline. Defense-aware adaptations further extend the attack to diverse obfuscation mechanisms across encoder-based and autoregressive architectures. Experiments on nine defenses, five tasks, and four model architectures show that DeepInvert outperforms prior attacks on most defenses. Against ObfusLM, DeepInvert achieves 73.5\% top-1 token recovery versus 26.2\% for the previous best. Our results reveal a task-dependent tension: obfuscation schemes preserving enough signal for utility also retain sufficient structure for inversion, while schemes resisting inversion collapse utility. On simpler classification tasks, some DP-based defenses can maintain both. We call for a re-evaluation of this defense class.

Problem

• embedding inversion
• obfuscated language models
• privacy attack
• semi-supervised learning
• prompt obfuscation

Innovation

• embedding inversion
• semi-supervised learning
• obfuscated language models
• consistency regularization
• model inversion attack