Research map / Adversarial robustness and security / Attacks on text and graphs
Against All Odds: Overcoming Typology, Script, and Language Confusion in Multilingual Embedding Inversion Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies cross-lingual and cross-script embedding inversion attacks on multilingual encoders across 20 languages, finding Arabic/Cyrillic scripts and Indo-Aryan languages most vulnerable and linking language confusion to attack efficacy.
Problem
Embedding inversion attacks on multilingual text encoders have only been studied for a few European Latin-script languages; it is unclear how vulnerability varies across language families, scripts, and language confusion in the inversion output.
Approach
Extends vec2text-style inversion (base model plus iterative corrector with beam search) to 20 languages spanning 8 families and 12 scripts, tests in-script and in-family training, and models language confusion of inverted outputs with Random Forest regression using linguistic features.
Key results
- Corrector with 50 steps and beam width 8 raises Kazakh BLEU from 30.69 (base) to 44.50 and Urdu BLEU from 20.86 to 25.04 with ME5 encoder.
- In-script training with Urdu and Arabic boosts Urdu BLEU by 100.2% (from 25.04 to 50.13 relative to baseline as reported).
- Punjabi inversion fails in cross-lingual Kazakh-Urdu setting (TF1 near 0.2), while Punjabi trained with Gujarati reaches BLEU 52.89 at step 50 with beam 8.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use multilingual mE5 embeddings rather than monolingual embeddings | German embedding inversion · German | BLEU: 15.54 -> 31.35 | Helped |
| add 50 correction steps with beam search width 8 | mE5 inversion model · Arabic | BLEU: 17.31 -> 22.93 | Helped |
| add 50 correction steps with beam search width 8 | mE5 inversion model · Punjabi | BLEU: 31.10 -> 0 | Hurt |
| add training languages that use the same script (ablation) | mT5 inversion model · Urdu | BLEU: +100.20% | Helped |
| add languages from the same family to training (ablation) | mT5 inversion model · Punjabi | BLEU: 0 -> 52.89 | Helped |
| train with a different-family language (Gujarati-Kazakh pairing) (ablation) | mT5 inversion model · Kazakh | BLEU: 26.08 -> 38.20; baseline 44.50 | Hurt |
| train Urdu with Kazakh rather than Indo-Aryan languages (ablation) | mT5 inversion model · Urdu | BLEU: 22.58 -> 0.01 | Hurt |
Surprising findings
- Inverting Punjabi with a Punjabi-only corrector yields near-zero scores (BLEU 0) despite a strong base model, but training with related Indo-Aryan languages restores performance.
- Mixing Kazakh with Urdu or Hindi in training degrades attacks, and language confusion was predicted from script and family features more than from cosine similarity.
Limitations
- Approximately 40,000 GPU hours required, limiting how many languages and models can be explored.
- Defense (masking) from prior work is not studied; only the attack is evaluated.
- Training data reduced by 60-80% relative to previous studies, and some languages evaluated only (no attack training) for ethical reasons.
Experimental setup
Datasets: CulturaX
Benchmarks: CulturaX held-out samples (500 per language)
Metrics: Token F1 BLEU ROUGE cosine similarity language identification probabilities
Baselines: GTR multilingual-e5-base T5 AlephBERT text2vec
Builds on: vec2text T5 CulturaX
Closest papers by meaning
- Multilingual Jailbreak Challenges in Large Language Models (ICLR 2024 · similarity 0.89)
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.89)
- Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation (ICLR 2024 · similarity 0.87)
- CL-Attack: Textual Backdoor Attacks via Cross-Lingual Triggers (AAAI 2025 · similarity 0.87)
- Safety Alignment Should be Made More Than Just a Few Tokens Deep (ICLR 2025 · similarity 0.87)
- Semantic Representation Attack against Aligned Large Language Models (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.