通过多前缀检索检测大模型训练数据泄露，更可靠。
Memories Retrieved from Many Paths: A Multi-Prefix Framework for Robust Detection of Training Data Leakage in Large Language Models
- 用多个不同前缀尝试触发目标文本，判断是否被记忆
- 记忆内容能被超过10种不同前缀激活，非记忆内容则不能
- 适合用于审计对齐模型的数据泄露风险
大型语言模型在海量语料上训练，容易逐字记忆训练数据，带来隐私和版权风险。现有方法对记忆现象的定义不全面，尤其在对齐模型中表现不佳。为此，我们提出多前缀记忆检测框架：核心思想是记忆内容会被大量不同的前缀触发，而非记忆内容则不会。我们正式定义，若一个序列能被外部对抗搜索找到足够数量（如≥10）的独立前缀激活，则视为被记忆。该框架将注意力从单一路径提取转向记忆鲁棒性评估，即检索路径的多样性。在开源与对齐聊天模型上的实验表明，该方法能有效区分记忆与非记忆内容，提供一种稳健且实用的大型语言模型数据泄露审计工具。
原文摘要 · Abstract (English)
Large language models, trained on massive corpora, are prone to verbatim memorization of training data, creating significant privacy and copyright risks. While previous works have proposed various definitions for memorization, many exhibit shortcomings in comprehensively capturing this phenomenon, especially in aligned models. To address this, we introduce a novel framework: multi-prefix memorization. Our core insight is that memorized sequences are deeply encoded and thus retrievable via a significantly larger number of distinct prefixes than non-memorized content. We formalize this by defining a sequence as memorized if an external adversarial search can identify a target count of distinct prefixes that elicit it. This framework shifts the focus from single-path extraction to quantifying the robustness of a memory, measured by the diversity of its retrieval paths. Through experiments on open-source and aligned chat models, we demonstrate that our multi-prefix definition reliably distinguishes memorized from non-memorized data, providing a robust and practical tool for auditing data leakage in LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。