针对小模型聊天机器人泄露个人身份信息问题，提出高效提取方法GEP。
GEP: A GCG-Based method for extracting personally identifiable information from chatbots built on small language models
- 基于贪婪坐标梯度设计新攻击方法GEP，专攻小模型隐私漏洞。
- 相比传统模板法，隐私信息泄露量提升最高达60倍。
- 在复杂语法表达下仍可识别4.53%的隐私泄露，适合安全评估者使用。
小语言模型（SLMs）因在特定领域表现接近大语言模型（LLMs），且训练与推理能耗更低而备受关注。然而，基于SLMs的下游任务如聊天机器人中的个人身份信息（PII）泄露问题尚未被充分研究。本文首先基于BioGPT模型，在Alpaca和HealthCareMagic医疗数据集上微调得到ChatBioGPT，其BERTscore表现与ChatDoctor、ChatGPT相当。在此基础上，我们发现传统基于模板的PII攻击方法在SLM场景下难以有效提取隐私信息。为此，提出GEP（贪婪坐标梯度法），专门用于从小型模型中提取PII。实验表明，GEP相较之前方法最多提升60倍的泄露量。进一步在自由插入场景中验证：当注入的PII采用多种句法形式而非固定模板时，GEP仍能揭示高达4.53%的泄露率，证明其在真实复杂情境下的有效性。
原文摘要 · Abstract (English)
Small language models (SLMs) become unprecedentedly appealing due to their approximately equivalent performance compared to large language models (LLMs) in certain fields with less energy and time consumption during training and inference. However, the personally identifiable information (PII) leakage of SLMs for downstream tasks has yet to be explored. In this study, we investigate the PII leakage of the chatbot based on SLM. We first finetune a new chatbot, i.e., ChatBioGPT based on the backbone of BioGPT using medical datasets Alpaca and HealthCareMagic. It shows a matchable performance in BERTscore compared with previous studies of ChatDoctor and ChatGPT. Based on this model, we prove that the previous template-based PII attacking methods cannot effectively extract the PII in the dataset for leakage detection under the SLM condition. We then propose GEP, which is a greedy coordinate gradient-based (GCG) method specifically designed for PII extraction. We conduct experimental studies of GEP and the results show an increment of up to 60$\times$ more leakage compared with the previous template-based methods. We further expand the capability of GEP in the case of a more complicated and realistic situation by conducting free-style insertion where the inserted PII in the dataset is in the form of various syntactic expressions instead of fixed templates, and GEP is still able to reveal a PII leakage rate of up to 4.53%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。