@inproceedings{chen-etal-2026-shot,
title = "Few-shot Semantic Recovery Attacks on Image Embeddings",
author = "Chen, Yiyi and
Xu, Qiongkai and
Bjerva, Johannes",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.2368/",
pages = "53745--53767",
ISBN = "979-8-89176-459-0",
abstract = "Image embeddings are an essential commodity in modern AI: stored at scale in vector databases, transferred between edge devices and cloud APIs, and traded as paid services. Image embeddings have been implicitly treated as anonymous{---}an assumption that has not been rigorously tested even as embedding services scale to billions of stored vectors. {\_}We show this assumption breaks.{\_} We propose **C**ross-modal **R**ecovery **A**ttack with **F**ew-shot **T**ransfer (**CRAFT**), a framework that recovers semantic meaning, including free-form captions and sensitive attributes. The attack focuses on the medical domain and facial features, targeting black-box image embeddings without reconstructing a single image in pixels and without any knowledge of the underlying model architecture, training data, or weights. **CRAFT** combines a public dual-encoder, a linear alignment learned from intercepted image-embedding pairs, and a fine-tuned embedding-to-text decoder; we further strengthen recovery with two augmentative techniques: cross-modal reranking against the attacker{'}s text encoder and chain-of-thought prompting on a diffusion-rendered low-fidelity reconstruction of the leaked embedding. Attacks succeed with as few as a single intercepted pair and transfer across five open-source and proprietary embedders. We disclose a privacy surface that current defenses cannot close. Every setting that preserves downstream utility also leaves the attack effective. Black-box image embeddings, as widely deployed in AI systems today, should not be treated as privacy-preserving artifacts.[We open source our code for reproducibility and further research: {\ensuremath{<}}https://github.com/siebeniris/CRAFT{\ensuremath{>}}.]"
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="chen-etal-2026-shot">
<titleInfo>
<title>Few-shot Semantic Recovery Attacks on Image Embeddings</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yiyi</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Qiongkai</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Johannes</namePart>
<namePart type="family">Bjerva</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Image embeddings are an essential commodity in modern AI: stored at scale in vector databases, transferred between edge devices and cloud APIs, and traded as paid services. Image embeddings have been implicitly treated as anonymous—an assumption that has not been rigorously tested even as embedding services scale to billions of stored vectors. _We show this assumption breaks._ We propose **C**ross-modal **R**ecovery **A**ttack with **F**ew-shot **T**ransfer (**CRAFT**), a framework that recovers semantic meaning, including free-form captions and sensitive attributes. The attack focuses on the medical domain and facial features, targeting black-box image embeddings without reconstructing a single image in pixels and without any knowledge of the underlying model architecture, training data, or weights. **CRAFT** combines a public dual-encoder, a linear alignment learned from intercepted image-embedding pairs, and a fine-tuned embedding-to-text decoder; we further strengthen recovery with two augmentative techniques: cross-modal reranking against the attacker’s text encoder and chain-of-thought prompting on a diffusion-rendered low-fidelity reconstruction of the leaked embedding. Attacks succeed with as few as a single intercepted pair and transfer across five open-source and proprietary embedders. We disclose a privacy surface that current defenses cannot close. Every setting that preserves downstream utility also leaves the attack effective. Black-box image embeddings, as widely deployed in AI systems today, should not be treated as privacy-preserving artifacts.[We open source our code for reproducibility and further research: \ensuremath<https://github.com/siebeniris/CRAFT\ensuremath>.]</abstract>
<identifier type="citekey">chen-etal-2026-shot</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.2368/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>53745</start>
<end>53767</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Few-shot Semantic Recovery Attacks on Image Embeddings
%A Chen, Yiyi
%A Xu, Qiongkai
%A Bjerva, Johannes
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F chen-etal-2026-shot
%X Image embeddings are an essential commodity in modern AI: stored at scale in vector databases, transferred between edge devices and cloud APIs, and traded as paid services. Image embeddings have been implicitly treated as anonymous—an assumption that has not been rigorously tested even as embedding services scale to billions of stored vectors. _We show this assumption breaks._ We propose **C**ross-modal **R**ecovery **A**ttack with **F**ew-shot **T**ransfer (**CRAFT**), a framework that recovers semantic meaning, including free-form captions and sensitive attributes. The attack focuses on the medical domain and facial features, targeting black-box image embeddings without reconstructing a single image in pixels and without any knowledge of the underlying model architecture, training data, or weights. **CRAFT** combines a public dual-encoder, a linear alignment learned from intercepted image-embedding pairs, and a fine-tuned embedding-to-text decoder; we further strengthen recovery with two augmentative techniques: cross-modal reranking against the attacker’s text encoder and chain-of-thought prompting on a diffusion-rendered low-fidelity reconstruction of the leaked embedding. Attacks succeed with as few as a single intercepted pair and transfer across five open-source and proprietary embedders. We disclose a privacy surface that current defenses cannot close. Every setting that preserves downstream utility also leaves the attack effective. Black-box image embeddings, as widely deployed in AI systems today, should not be treated as privacy-preserving artifacts.[We open source our code for reproducibility and further research: \ensuremath<https://github.com/siebeniris/CRAFT\ensuremath>.]
%U https://aclanthology.org/2026.emnlp-main.2368/
%P 53745-53767
Markdown (Informal)
[Few-shot Semantic Recovery Attacks on Image Embeddings](https://aclanthology.org/2026.emnlp-main.2368/) (Chen et al., EMNLP 2026)
ACL
- Yiyi Chen, Qiongkai Xu, and Johannes Bjerva. 2026. Few-shot Semantic Recovery Attacks on Image Embeddings. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 53745–53767, Budapest, Hungary. Association for Computational Linguistics.