{"id":"ea3f90ac-773b-4b17-8aff-8532f267dd7f","arxiv_id":"2505.16008","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"LAGO shows that constraining alignment matrices of linguistically similar languages to be close improves few-shot cross-lingual embedding inversion accuracy over independent per-language baselines.","lead":"The paper proposes LAGO, an attack that reconstructs private text from multilingual embeddings by coupling per-language alignment maps through a language-similarity graph. It reports that grouping related languages improves few-shot cross-lingual inversion over the prior ALGEN method, highlighting a privacy risk in AI services that serve many languages.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Missing graph controls leave the causal claim unsupported: coupling/regularization could explain the gains, and the 10-sample 10–20% Rouge-L claim is not visible in Table 1.","rationale":"The reader's CONDITIONAL verdict is appropriate. The central novelty of LAGO is the use of language similarity as a structural prior, and the empirical support for that novelty is incomplete: the paper never compares against a non-similarity graph, so the observed gains cannot be attributed to language similarity rather than to generic coupling or regularization. This is an internal support gap, not a disagreement with external consensus; it is addressable with additional control experiments. The paper also overstates the 10-shot improvement in the abstract relative to its own detailed table, which is a concrete reporting inconsistency. Both issues are correctable, so the verdict should remain CONDITIONAL rather than move to rejection.","tokens_in":12470,"tokens_out":4029,"duration_ms":35226,"concrete_test":"Run LAGO (both variants) on the same seven languages at 10/100/300 samples with three control graphs: a complete graph, a random graph with the same edge density/degree sequence as the ASJP graph, and an anti-similarity graph connecting the least similar pairs. If any control matches or exceeds the ASJP/Lang2vec Rouge-L gains, the similarity topology is not the driver. Independently recompute the relative Rouge-L gains in Table 1 at 10 samples from the released code; if they do not reach 10–20%, the abstract's quantitative claim should be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.1 constructs the graph from ASJP/Lang2vec similarities, and Section 6.2 concludes robustness across two metrics, but no experiment compares LAGO against a graph that does not encode language similarity. All seven test languages are related Indo-European languages, so the ASJP and Lang2vec graphs are dense; the constraints may act mainly as a coupling/regularization mechanism pulling all W_i toward a common solution. If a complete graph or a degree-matched random graph yields the same gains, the \"language similarity-aware\" mechanism is not the active cause, and the contribution reduces to constrained/regularized joint estimation. The paper's own detailed table also undercuts the headline: Table 1 at 10 samples shows French Rouge-L 10.14 (Inequality) and 10.87 (Total Variation) versus ALGEN 10.07, i.e., +0.7% and +7.9%, not the claimed 10–20%; the claimed range appears only at 100–300 samples. The causal claim and the quantitative headline therefore rest on experiments that have not yet been run.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes LAGO, a graph-constrained distributed optimization framework for few-shot cross-lingual embedding inversion attacks. A language similarity graph is constructed from ASJP (lexical) and Lang2vec (typological) distances, and two optimization variants — linear inequality constraints solved via IEQ-PDMM and total variation regularization — jointly estimate per-language alignment matrices W_i. The paper shows that ALGEN is a special case of the framework when constraints are removed (Section 4.3). Experiments on seven Indo-European languages with English as the attack language report improved cosine similarity and Rouge-L over ALGEN across training sizes, and the paper claims a 10–20% Rouge-L improvement in few-shot settings and that language similarity is a critical factor for attack transferability.","tokens_in":12664,"tokens_out":4752,"duration_ms":40802,"significance":"If the empirical claims were fully supported, the work would highlight a real privacy risk for multilingual embedding services and provide a novel application of distributed optimization to inversion attacks. The theoretical reduction of ALGEN to a special case is correct by construction and is a useful unifying perspective. The paper also shares code, which facilitates reproducibility. However, the current evaluation does not include the control experiments needed to attribute the gains to language similarity, and the headline quantitative claim is not backed by the reported table. The core idea is promising, but the significance as stated depends on experiments that have not yet been run.","major_comments":[{"comment":"The claimed '10–20% boost in Rouge-L over ALGEN' in the abstract and Section 6.1 for low-resource settings (e.g., 10 samples) is not supported by the data in Table 1. At 10 French samples, the Inequality variant gives 10.14 versus ALGEN's 10.07 (+0.7%) and the Total Variation variant gives 10.87 (+7.9%). Even compared with the regularized baseline (Reg. λ=0.01, 10.14), the Inequality gain is zero. The 10–20% range appears only at 100–300 samples. The abstract, Section 6.1, and the contribution bullet should be corrected to state the actual improvements and the training sizes at which they occur.","section":"§6.1, Table 1, Abstract"},{"comment":"The causal claim that language similarity is the active mechanism behind the improvements is not tested. The paper never compares LAGO against a random graph, a complete graph, a degree-matched random graph, or a graph with deliberately incorrect language groupings. All seven test languages are related Indo-European languages, and the ASJP/Lang2vec graphs in Fig. 3 are dense, so the constraints may function simply as a coupling or regularization mechanism that pulls all W_i toward a common solution. Without such controls, the conclusion in the abstract and Section 6 that 'language similarity is a critical factor' is unsupported. Adding control graphs (and ideally languages from different families) is essential to substantiate the central contribution.","section":"§4.1, §6.2, Fig. 6"},{"comment":"The experimental results appear to be from a single run per configuration; no standard deviations, confidence intervals, or significance tests are reported. Given the small absolute differences in cosine similarity (e.g., +0.0044 at 10 samples in Table 1) and the moderate Rouge-L differences, the claim that LAGO 'consistently outperforms' the baseline is not yet statistically established. Please provide multiple random seeds (or bootstrap over the few-shot samples) and report error bars, so the reader can assess whether the observed gaps exceed run-to-run noise.","section":"Table 1, Figs. 4–7"}],"minor_comments":[{"comment":"The adjacency formula A = (1 - sign(D - r))/2 yields 0.5 when D = r, which is not a binary adjacency value. Since D values are continuous this may never occur, but a strict indicator A = 1_{D < r} would be cleaner and avoids the edge case.","section":"§4.1, Eq. (Adjacency)"},{"comment":"The acronym 'AJSP' appears in Section 4.1, Figure 3, and elsewhere, but the correct form is 'ASJP' (the database name). Please standardize the spelling throughout.","section":"§4.1, Fig. 3"},{"comment":"A typo: 'Tabel 3' should be 'Table 3'. Also, the Computational Resources section refers to 'ALGO' but the method is LAGO; please correct the notation.","section":"§5, Table 3"},{"comment":"The threshold r for each graph is only given as examples in Fig. 3; please report the exact r values used in the experiments for ASJP and Lang2vec, and the rule used to set them.","section":"§5, Language Graphs"},{"comment":"In the update equations, it would help to explicitly state that the comparison and sign operations are element-wise and that W_i is an m×n matrix, so the dimension of the inequality constraint is clear.","section":"§4.2, Eq. (2)"}],"recommendation":"major_revision","confidential_remarks":"The two main gaps — missing graph controls and lack of variance reporting — are fixable within a revision, and the result would be substantially stronger if the causal claim is re-tested. If the controls cannot be run within the paper's scope, the authors should temper the claims to 'graph-constrained coupling improves transfer' rather than 'language similarity is the critical factor.' The paper is within the scope of the journal, and the theoretical reduction to ALGEN is sound; the main risk is overclaiming based on the current limited evaluation."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a solid, honest extension of ALGEN, and the graph-constrained distributed optimization framing is genuinely new in the embedding inversion literature. The two variants (inequality constraints and total variation) are implemented carefully, and the ALGEN-as-special-case statement is correct by construction. The experimental breadth is decent: multiple target languages, two victim encoders, two similarity metrics, and a Spanish source. I give credit for that.\n\nThe soft spots are real, though. The central claim that language similarity is the active factor is not established. The graph is built from ASJP and Lang2vec similarities, but the paper never compares against a random graph, an all-to-all graph, or a deliberately wrong graph. All seven test languages are closely related Indo-European languages, so the constraints may just be pulling all W_i toward a common solution; any coupling could give similar gains. Without a control graph, \"language similarity is a critical factor\" is an interpretation, not a result.\n\nThere's also a mismatch between the headline and the data. The abstract and Section 6.1 claim a 10–20% Rouge-L boost in the few-shot (10-sample) regime, but Table 1 at 10 samples shows French Rouge-L going from 10.07 (ALGEN) to 10.14 (inequality, +0.7%) and 10.87 (TV, +7.9%). The 10–20% range only appears at 100–300 samples. That's an overstatement that needs correcting.\n\nMinor concerns: no error bars or significance tests anywhere, so even the consistent improvements could be noise, and there are a few typos (AJSP vs ASJP, ALGO vs LAGO). None of this is fatal. The method is plausible, the math is standard distributed optimization applied to a new problem, and the limitations section is refreshingly candid about decoder quality.\n\nWho benefits: researchers working on embedding inversion, multilingual privacy, or cross-lingual transfer. The paper deserves a serious referee but needs major revision: add control graphs, report variance, and recalibrate the quantitative claims. I would not desk-reject it.","headline":"A credible graph-constrained extension of ALGEN with real potential, but the causal claim that language similarity drives the gains is not yet supported and the headline 10–20% boost is overstated.","tokens_in":13217,"tokens_out":2976,"would_cite":false,"duration_ms":25543,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Coupling the alignment matrices of linguistically similar languages improves few-shot embedding inversion attacks by 10-20% over independent baselines.","keywords":["embedding inversion attack","cross-lingual transfer","few-shot learning","language similarity graph","distributed optimization","total variation regularization","privacy-preserving embeddings","multilingual NLP"],"falsifier":"Run the same two LAGO variants with a random graph, an all-to-all graph, and a deliberately wrong graph (for example, connecting only distant languages) while keeping all data, decoders, and hyperparameters fixed; if any of these non-similarity graphs produces the same 10-20% Rouge-L gain over ALGEN, the claim that language similarity drives the transfer is falsified.","tokens_in":12242,"feed_emoji":"🔓","tokens_out":8333,"duration_ms":65884,"temperature":0.7,"pith_summary":"The paper tries to show that a multilingual embedding service is more vulnerable to few-shot inversion attacks than independent per-language attacks suggest, because an attacker can borrow alignment strength from linguistically similar languages. It proposes LAGO, which builds a graph whose nodes are languages and whose edges encode lexical or syntactic similarity, then solves a joint optimization that keeps the per-language alignment matrices of neighboring languages close. With as few as 10 training samples per language, this collaborative alignment improves text reconstruction by 10-20% in Rouge-L over the per-language baseline ALGEN. The paper also argues that prior methods are a special case of this framework, and that language similarity is a critical factor in attack transferability.","feed_headline":"Language similarity boosts few-shot embedding attacks by 10-20%","feed_subtitle":"Tying alignment matrices across related languages beats independent inversion with as few as 10 samples.","key_machinery":"The central object is the language-similarity graph $G=(V,E)$: nodes are languages, and an edge connects two languages when their ASJP lexical distance or Lang2vec typological distance falls below a threshold. This graph carries the argument by coupling the alignment matrices $W_i$ of neighboring languages, so that scarce per-language data is supplemented by parameters learned on related languages. Two optimization updates instantiate the coupling: an inequality-constrained primal-dual update (IEQ-PDMM) and a total-variation-regularized gradient update, both augmented with Frobenius-norm regularization to keep the underdetermined few-shot problem stable.","core_discovery":"The central claim is that constraining the alignment matrix $W_i$ of each language to stay close to the $W_j$ of similar languages improves cross-lingual embedding inversion under data scarcity. The paper formalizes this as a graph-constrained distributed optimization problem over languages: each node minimizes its own reconstruction loss $\\frac{1}{2}\\|E_{A,i}-E_{V,i}W_i\\|_F^2$ with Frobenius regularization, while edges enforce proximity between neighboring $W$'s either as hard inequalities $\\|W_i-W_j\\|_{\\max}\\le\\epsilon$ or as a total-variation penalty $\\eta\\sum_{j\\in N_i}\\|W_i-W_j\\|_{\\text{sum}}$. The hard-constraint variant is solved with a primal-dual method (IEQ-PDMM), and the soft variant with a projected gradient step. When the constraints are relaxed ($\\epsilon\\to\\infty$ or $\\eta=0$), the problem decouples into independent ALGEN-style per-language alignments, which the paper presents as evidence that LAGO generalizes prior work. Empirically, with as few as 10 samples per language, LAGO improves Rouge-L over ALGEN by 10-20% across French, German, Dutch, Spanish, Italian, and Portuguese, using either an English- or Spanish-trained attack decoder.","pith_inferences":["Editorial inference: the same graph-constrained coupling could be turned into a defense: adding noise or perturbation scaled by a language's position in the similarity graph might suppress transfer more efficiently than uniform per-language noise.","Editorial inference: the framework gives attackers a concrete selection rule: train the decoder in the language that is topologically closest to the target, since the paper observes one-hop neighbors transfer better than two-hop ones, as with English-German versus Spanish-German.","Editorial inference: if language similarity is the active cause, related non-Indo-European language clusters should show analogous gains; testing on typologically distant languages would either extend the claim or bound it.","Editorial inference: the paper's Limitations section notes that its decoder reaches only about 25 Rouge-L even in the monolingual 1k-sample case, so the reported 10-20% gains are relative improvements on a modest absolute reconstruction quality."],"forward_implications":["With as few as 10 samples per target language, an attacker can reconstruct text from multilingual embeddings 10-20% better in Rouge-L than ALGEN's independent per-language alignment.","The gain transfers across victim encoders (MT5, E5, and ADA-2) and across attack languages (English and Spanish), so the vulnerability is not specific to one model or source language.","ALGEN and similar per-language inversion methods are a limiting case of LAGO, so the framework is at least as strong as those baselines by construction.","Differential privacy suppresses cross-lingual inversion Rouge-L scores below 2, but at a utility cost that drops model accuracy to 40%, so the privacy-vs-utility tradeoff remains sharp."],"supporting_citations":[{"why":"Defines the embedding inversion attack and supplies the baseline task of recovering input tokens from embeddings.","marker":"Song and Raghunathan (2020)"},{"why":"Introduces decoder-based generative inversion that LAGO's decoder component builds on.","marker":"Li et al. (2023)"},{"why":"ALGEN, the few-shot per-language alignment baseline that LAGO compares against and subsumes as a special case.","marker":"Chen et al., 2025b"},{"why":"Supplies the IEQ-PDMM primal-dual solver used for LAGO's inequality-constrained variant.","marker":"Heusdens and Zhang, 2024b"},{"why":"Source of the total-variation penalty that LAGO adapts for soft cross-language parameter coupling.","marker":"Peng et al., 2021"},{"why":"ASJP lexical-distance data used to construct the language similarity graph.","marker":"Wichmann et al., 2022"},{"why":"Lang2vec typological features used for the alternative similarity graph.","marker":"Littell et al., 2017"},{"why":"Rouge-L, the lexical-overlap metric used to measure attack transferability.","marker":"Lin (2004)"}],"fun_headline_variants":["LAGO: Language-aware graph improves embedding attacks by 20%","Exploiting language similarity for few-shot embedding attacks","Graph-constrained inversion steals embeddings with 10 samples","Language ties boost cross-lingual attack transferability 10-20%","Similarity constraints power few-shot embedding inversion"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The argument stands on the assumption that the language-similarity scores used to build the graph point to the right pairs of languages to share information between, and that the transfer gains come from similarity rather than from coupling itself.","fun_headline_variants_meta":{"raw":{"variants":["LAGO: Language-aware graph improves embedding attacks by 20%","Exploiting language similarity for few-shot embedding attacks","Graph-constrained inversion steals embeddings with 10 samples","Language ties boost cross-lingual attack transferability 10-20%","Similarity constraints power few-shot embedding inversion"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000206,"raw_usage":{"total_tokens":1433,"prompt_tokens":1021,"completion_tokens":412,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":637,"completion_tokens_details":{"reasoning_tokens":329}},"tokens_in":637,"tokens_out":412,"duration_ms":3656,"temperature":1.0,"reasoning_tokens":329,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:08:48.625074+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same two LAGO variants with a random graph, an all-to-all graph, and a deliberately wrong graph (for example, connecting only distant languages) while keeping all data, decoders, and hyperparameters fixed; if any of these non-similarity graphs produces the same 10-20% Rouge-L gain over ALGEN, the claim that language similarity drives the transfer is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Source of the total-variation penalty that LAGO adapts for soft cross-language parameter coupling."},{"cited_title":"ASJP Database","cited_arxiv_id":null,"evidence_quote":"ASJP lexical-distance data used to construct the language similarity graph."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Lang2vec typological features used for the alternative similarity graph."}],"review_version":1}