提出win-k攻击方法，有效提升小模型的成员推理攻击成功率。
Win-k: Improved Membership Inference Attacks on Small Language Models
- 基于min-k攻击改进，通过优化候选样本筛选策略提升攻击效果。
- 在8个小型语言模型上实验，各项指标均优于现有攻击方法。
- 特别适合研究小模型隐私漏洞，或评估模型安全性的研究人员。
小型语言模型（SLMs）因其高效性与可部署性，在资源受限环境下的设备端、隐私敏感及边缘计算场景中日益重要。然而，成员推理攻击（MIAs）威胁严重，可能泄露训练数据隐私和知识产权。尽管大语言模型（LLMs）易受攻击，但对新兴的小型语言模型研究较少，且随着模型规模减小，攻击效果下降。为此，本文提出新型攻击方法win-k，基于最先进的min-k攻击。我们通过三个数据集和八个SLMs，对比五种现有MIAs进行实验。结果表明，win-k在AUROC、TPR@1% FPR和FPR@99% TPR等指标上表现更优，尤其在小型模型上优势明显。
原文摘要 · Abstract (English)
Small language models (SLMs) are increasingly valued for their efficiency and deployability in resource-constrained environments, making them useful for on-device, privacy-sensitive, and edge computing applications. On the other hand, membership inference attacks (MIAs), which aim to determine whether a given sample was used in a model's training, are an important threat with serious privacy and intellectual property implications. In this paper, we study MIAs on SLMs. Although MIAs were shown to be effective on large language models (LLMs), they are relatively less studied on emerging SLMs, and furthermore, their effectiveness decreases as models get smaller. Motivated by this finding, we propose a new MIA called win-k, which builds on top of a state-of-the-art attack (min-k). We experimentally evaluate win-k by comparing it with five existing MIAs using three datasets and eight SLMs. Results show that win-k outperforms existing MIAs in terms of AUROC, TPR @ 1% FPR, and FPR @ 99% TPR metrics, especially on smaller models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。