软令牌攻击无法可靠检测大模型是否真正删除数据。
Soft Token Attacks Cannot Reliably Audit Unlearning in Large Language Models
- 用少量软令牌即可诱导模型输出任意信息，无视未学习机制。
- 在强审计环境下，攻击可提取超400字符的随机字符串。
- 提醒研究者：软令牌攻击结果不可靠，需谨慎解读。
大型语言模型（LLMs）使用海量数据训练，其中常包含有害文本、个人信息和受版权保护的内容。为解决此问题，机器去学习旨在从已训练模型中移除相关信息。近期研究表明，软令牌攻击（STA）能成功从LLMs中提取未学习的信息，但本文表明，STA作为审计去学习的工具并不可靠。在常见基准测试如Who Is Harry Potter?和TOFU中，我们证明在强审计设置下，无论部署何种去学习算法或查询内容是否曾存在于训练语料库中，此类攻击均可诱使模型输出任意信息。进一步实验显示，仅使用1-10个软令牌即可诱导模型生成超过400字符的随机字符串，说明使用软令牌攻击进行去学习审计时必须格外谨慎。示例代码见：https://github.com/IntelLabs/LLMart/tree/main/examples/unlearning。
原文摘要 · Abstract (English)
Large language models (LLMs) are trained using massive datasets, which often contain undesirable content such as harmful texts, personal information, and copyrighted material. To address this, machine unlearning aims to remove information from trained models. Recent work has shown that soft token attacks (STA) can successfully extract unlearned information from LLMs, but in this work we show that STAs can be an inadequate tool for auditing unlearning. Using common benchmarks such as Who Is Harry Potter? and TOFU, we demonstrate that in a strong auditor setting such attacks can elicit any information from the LLM, regardless of the deployed unlearning algorithm or whether the queried content was originally present in the training corpus. We further show that STA with just a few soft tokens (1-10) can elicit random strings over 400 characters long, indicating that STAs must be used carefully to effectively audit unlearning. Example code can be found at: https://github.com/IntelLabs/LLMart/tree/main/examples/unlearning
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。