Semantic Leakage from Image Embeddings

TL;DR

Semantic Leakage from Image Embeddings (SLImE) demonstrates that image embeddings optimized for semantic retrieval preserve local semantic neighborhoods, enabling leakage of meaningful semantic content even after lossy mappings. It formalizes semantic preservation under alignment via a one-step linear mapping ${\bm{W}}$ and leverages a lightweight local retriever plus off-the-shelf LLMs/VLMs to recover captions and scene information without pixel reconstruction or task-specific decoders, as captured by the relation ${\bm{W}} = ({\bm{E}}_V^{\top}{\bm{E}}_V)^{-1}{\bm{E}}_V^{\top}{\bm{E}}_A$. Across open and closed models (Gemini, Cohere, Nomic, CLIP) and datasets (COCO, nocaps), SLImE consistently reveals semantic information through multi-stage inference, including text reconstruction, object/relation/scene inference, and cross-domain leakage, underscoring a fundamental privacy risk at the semantic level. These findings imply that privacy protections for embedding-based systems must address semantic content, not just pixel-level detail or decoder access, and motivate development of semantic-aware mitigation strategies. The work contributes a formal framework for semantic leakage, an empirical validation across diverse models, and a practical attack pipeline that leverages alignment, retrieval, and generative models to amplify partial semantic cues into coherent descriptions.

Abstract

Image embeddings are generally assumed to pose limited privacy risk. We challenge this assumption by formalizing semantic leakage as the ability to recover semantic structures from compressed image embeddings. Surprisingly, we show that semantic leakage does not require exact reconstruction of the original image. Preserving local semantic neighborhoods under embedding alignment is sufficient to expose the intrinsic vulnerability of image embeddings. Crucially, this preserved neighborhood structure allows semantic information to propagate through a sequence of lossy mappings. Based on this conjecture, we propose Semantic Leakage from Image Embeddings (SLImE), a lightweight inference framework that reveals semantic information from standalone compressed image embeddings, incorporating a locally trained semantic retriever with off-the-shelf models, without training task-specific decoders. We thoroughly validate each step of the framework empirically, from aligned embeddings to retrieved tags, symbolic representations, and grammatical and coherent descriptions. We evaluate SLImE across a range of open and closed embedding models, including GEMINI, COHERE, NOMIC, and CLIP, and demonstrate consistent recovery of semantic information across diverse inference tasks. Our results reveal a fundamental vulnerability in image embeddings, whereby the preservation of semantic neighborhoods under alignment enables semantic leakage, highlighting challenges for privacy preservation.1

Figures (19)

• Figure 1: An overview of SLImE Framework, consisting of (left) training a local retriever, and (right) inferences and attacks with the help of off-the-shelf models (see details in Section \ref{['sec:framework']} and data example in Appendix \ref{['app:sample']}).
• Figure 2: Semantic Neighborhood Preservation under Alignment. F1 scores across neighborhood size $m$ for aligned Top-$K=30$ retrieval using $10,000$ alignment samples, across victim embeddings, evaluated against $\{t_{gt}\}$ (dotted lines) and $\{t_{A}\}$(solid lines).
• Figure 3: Semantic Leakage of Image Embeddings by Alignment Samples. (Top) Cosine Similarity between Attack and Aligned Embeddings; (Bottom) $\{C_{V\rightarrow A}\}$ evaluated against $\{C_{gt}\}$ (solid lines) and $\{C_{h}\}$ (dotted lines) against at $K=10$ in Rouge-L.
• Figure 4: Identified Objects with VLMs across Settings in F1.
• Figure 5: Identified Relations across Settings in F1.

Theorems & Definitions (2)

• Definition 3.1: Semantic Neighborhood
• Definition 3.2: Semantic Neighborhood Preservation