DAEI Breaks the Gaussian-Noise Defense for Text Embeddings With a 154% BLEU Jump Over Prior Inversion

arXiv 2608.18610·high signalXBlueskyLinkedInCopy link

Adding Gaussian noise to released embeddings is the standard cheap defense against embedding inversion, and arXiv 2608.18610 (2026-08-19) shows it does not hold against an attacker who models the perturbation. The paper identifies a 'Double Noise Trap' that explains why existing generative inversion fails on noisy embeddings, then proposes DAEI, pairing a residual denoising autoencoder trained unsupervised via Stein's unbiased risk estimate with generative text inversion, requiring no access to clean embedding targets. DAEI achieves roughly 154% relative BLEU improvement over the generative inversion baseline and 32-60% gains in token-level F1 and ROUGE-L, which is a direct problem for anyone shipping perturbed embeddings from a vector store.