发现大模型成员推断攻击在多文档场景下有效，突破了此前认为无效的结论。
Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models
- 通过构建从词元到文档集合的连续测试基准，验证攻击可行性
- 首次实现对预训练与微调大模型的成员推断攻击成功
- 提出聚合段落级特征的方法，提升至文档级攻击能力
成员推断攻击（MIA）旨在判断某数据样本是否属于模型的训练集。随着大语言模型（LLM）的快速发展，该问题日益重要，尤其涉及训练数据版权争议。然而，近期研究普遍认为现有MIA方法在LLM上无效，或因实验设计缺陷导致‘作弊’。本文主张：当测试样本为多个文档时，MIA仍可奏效。为此，我们构建了覆盖从句子（n-gram）到多文档集合（多个token块）的连续评估基准。为验证现有MIA方法在更大尺度下的表现，我们改编近期数据集推断（DI）工作，将段落级MIA特征聚合，实现文档及文档集合级别的二值成员推断。该基线首次成功实现了对预训练与微调大模型的成员推断攻击。
原文摘要 · Abstract (English)
Membership inference attacks (MIA) attempt to verify the membership of a given data sample in the training set for a model. MIA has become relevant in recent years, following the rapid development of large language models (LLM). Many are concerned about the usage of copyrighted materials for training them and call for methods for detecting such usage. However, recent research has largely concluded that current MIA methods do not work on LLMs. Even when they seem to work, it is usually because of the ill-designed experimental setup where other shortcut features enable "cheating." In this work, we argue that MIA still works on LLMs, but only when multiple documents are presented for testing. We construct new benchmarks that measure the MIA performances at a continuous scale of data samples, from sentences (n-grams) to a collection of documents (multiple chunks of tokens). To validate the efficacy of current MIA approaches at greater scales, we adapt a recent work on Dataset Inference (DI) for the task of binary membership detection that aggregates paragraph-level MIA features to enable MIA at document and collection of documents level. This baseline achieves the first successful MIA on pre-trained and fine-tuned LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。