针对大模型推荐系统提出新隐私攻击方法，通过知识蒸馏提升数据成员识别能力。
Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm
- 用知识蒸馏构建参考模型，区分成员与非成员数据
- 融合置信度、熵、损失等特征，攻击准确率超基线20%以上
- 适用于大模型推荐系统，适合关注隐私安全的研究者
会员推理攻击（MIA）旨在判断特定数据样本是否曾被用于目标模型的训练。传统MIA依赖影子模型模拟目标模型行为，但在大规模语言模型（LLM）推荐系统中因训练数据规模和复杂性导致效果下降。本文提出一种专为LLM推荐系统设计的知识蒸馏型MIA新范式。该方法通过蒸馏构建参考模型，并对成员与非成员数据采用不同策略以增强判别能力。从参考模型中提取融合特征（如置信度、熵、损失及隐藏层向量）训练攻击模型，克服单一特征局限性。在扩展数据集（Last.FM、MovieLens、Book-Crossing、Delicious）和多种LLM（T5、GPT-2、LLaMA3）上的大量实验表明，该方法显著优于基于影子模型的MIA和单特征基线。结果证明其在LLM驱动推荐系统中的实际隐私攻击可行性。
原文摘要 · Abstract (English)
Membership Inference Attack (MIA) aims to determine whether a specific data sample was included in the training dataset of a target model. Traditional MIA approaches rely on shadow models to mimic target model behavior, but their effectiveness diminishes for Large Language Model (LLM)-based recommendation systems due to the scale and complexity of training data. This paper introduces a novel knowledge distillation-based MIA paradigm tailored for LLM-based recommendation systems. Our method constructs a reference model via distillation, applying distinct strategies for member and non-member data to enhance discriminative capabilities. The paradigm extracts fused features (e.g., confidence, entropy, loss, and hidden layer vectors) from the reference model to train an attack model, overcoming limitations of individual features. Extensive experiments on extended datasets (Last.FM, MovieLens, Book-Crossing, Delicious) and diverse LLMs (T5, GPT-2, LLaMA3) demonstrate that our approach significantly outperforms shadow model-based MIAs and individual-feature baselines. The results show its practicality for privacy attacks in LLM-driven recommender systems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。