arXiv:2410.13088cs.LGcs.CL2024-10被引 12

提出无需真实数据的自比较方法,检测大模型是否使用了特定数据集训练。

Self-Comparison for Dataset-Level Membership Inference in Large (Vision-)Language Models

  • 用前缀+改写后缀构造测试序列,通过前后似然变化判断数据归属。
  • 在多个公开、微调和商业模型上均超越传统方法,准确率提升10%以上。
  • 适合隐私安全研究者,尤其关注数据版权与模型训练透明性的人群。

大型语言模型(LLMs)和视觉语言模型(VLMs)在自然语言处理与多模态任务中取得显著进展,其成功依赖于大规模网络数据集。然而,存在未经授权使用受版权保护内容及潜在侵权的风险。现有样本级成员推理攻击(MIA)与基于分布的数据集推断方法,依赖模型对训练数据记忆性强、置信度更高的现象来区分成员与非成员数据。但这些方法在应用于LLMs和VLMs时面临挑战,如需真实成员或同分布非成员数据。本文提出基于自比较的新型数据集级成员推理方法。我们发现:以成员前缀接非成员后缀(由成员后缀改写而来)可进一步激发模型对训练数据的记忆。不直接对比成员与非成员数据,而是对序列后半部分进行改写,评估似然值在改写前后的变化。与以往方法不同,本方法无需真实成员数据或同分布非成员数据,更具实用性。大量实验表明,该方法在多种数据集和模型(包括公开模型、微调模型及基于API的商用模型)上均优于传统MIA与数据集推断技术。

原文摘要 · Abstract (English)

Large Language Models (LLMs) and Vision-Language Models (VLMs) have made significant advancements in a wide range of natural language processing and vision-language tasks. Access to large web-scale datasets has been a key factor in their success. However, concerns have been raised about the unauthorized use of copyrighted materials and potential copyright infringement. Existing methods, such as sample-level Membership Inference Attacks (MIA) and distribution-based dataset inference, distinguish member data (data used for training) and non-member data by leveraging the common observation that models tend to memorize and show greater confidence in member data. Nevertheless, these methods face challenges when applied to LLMs and VLMs, such as the requirement for ground-truth member data or non-member data that shares the same distribution as the test data. In this paper, we propose a novel dataset-level membership inference method based on Self-Comparison. We find that a member prefix followed by a non-member suffix (paraphrased from a member suffix) can further trigger the model's memorization on training data. Instead of directly comparing member and non-member data, we introduce paraphrasing to the second half of the sequence and evaluate how the likelihood changes before and after paraphrasing. Unlike prior approaches, our method does not require access to ground-truth member data or non-member data in identical distribution, making it more practical. Extensive experiments demonstrate that our proposed method outperforms traditional MIA and dataset inference techniques across various datasets and models, including including public models, fine-tuned models, and API-based commercial models.

隐私安全成员推理大模型

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。