提出梯度唯一性指标，高效评估大模型训练中数据泄露风险。
Auditing Information Disclosure During LLM-Scale Gradient Descent Using Gradient Uniqueness
- 基于信息论构建梯度唯一性指标，量化单条数据在模型中的暴露程度。
- 设计批量空间幽灵算法，计算效率提升显著，可实时监控训练过程。
- 发现泄露风险集中在少数样本，且能有效预测针对性攻击成功率。
通过发布机器学习模型披露信息会带来严重隐私风险。然而，在大型语言模型（LLMs）训练过程中对每个数据点进行隐私审计计算成本过高。本文提出梯度唯一性（GNQ），一种基于信息论上界、无需依赖攻击方式的指标，用于衡量梯度下降中模型对单个训练样本的信息嵌入量。虽然直接计算GNQ需为每条数据构造并求逆一个P×P矩阵（P为模型参数量），我们引入批量空间幽灵GNQ（BS-Ghost GNQ），将所有计算移至更小的批量空间，并利用幽灵核实现‘运行中’高效计算，仅增加少量开销。实验验证了GNQ能准确反映先验/共知知识的影响。评估表明，GNQ能强预测目标攻击下的序列可提取性，并揭示泄露风险在训练过程中高度集中在特定样本上。
原文摘要 · Abstract (English)
Disclosing information via the publication of a machine learning model poses significant privacy risks. However, auditing this disclosure across every datapoint during the training of Large Language Models (LLMs) is computationally prohibitive. In this paper, we present Gradient Uniqueness (GNQ), a principled, attack-agnostic metric derived from an information-theoretic upper bound on the amount of information embedded in a model about individual training points via gradient descent. While naively computing GNQ requires forming and inverting an $P \times P$ matrix for every datapoint (for a model with $P$ parameters), we introduce Batch-Space Ghost GNQ (BS-Ghost GNQ). This efficient algorithm performs all computations in a much smaller batch-space and leverages ghost kernels to compute GNQ ``in-run'' with minimal computational overhead. We empirically validate that GNQ successfully accounts for prior/common knowledge. Our evaluation demonstrates that GNQ strongly predicts sequence extractability in targeted attacks and reveals how disclosure risk concentrates heterogeneously on specific examples over the course of LLM training.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。