提出新型防御框架，保护知识增强大模型免受隐私泄露攻击
Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks
- 通过集成基础模型、知识注入模型与判别模型输出，提升抗成员推断能力
- 在SFT模型上隐私攻击成功率降低27.8%，在RAG模型上降低526.3%
- 不依赖模型结构，适用于多种知识增强类大模型，适合高敏感场景使用
检索增强生成（RAG）和监督微调（SFT）已成为为大语言模型注入外部知识以应对多样化知识密集型任务的主要方法。然而，这种知识注入虽提升性能，也引入新的隐私攻击面。成员推断攻击（MIA）旨在判断特定数据是否曾被用于模型训练，对敏感领域构成严重隐私与信任威胁。本文首先系统评估了基于RAG和SFT的LLM在各类MIA下的脆弱性；随后提出一种新型、模型无关的防御框架——集成隐私防御（EPD），通过聚合并评估知识注入模型、基础模型与专用判别模型的输出，增强对MIA的抵御能力。大量实验表明，相较于推理时基线，EPD在SFT模型上平均将MIA成功率降低27.8%，在RAG模型上降低526.3%，同时保持问答质量不变。
原文摘要 · Abstract (English)
Retrieval-Augmented Generation (RAG) and Supervised Finetuning (SFT) have become the predominant paradigms for equipping Large Language Models (LLMs) with external knowledge for diverse, knowledge-intensive tasks. However, while such knowledge injection improves performance, it also exposes new attack surfaces. Membership Inference Attacks (MIAs), which aim to determine whether a given data sample was included in a model's training set, pose serious threats to privacy and trust in sensitive domains. To this end, we first systematically evaluate the vulnerability of RAG- and SFT-based LLMs to various MIAs. Then, to address the privacy risk, we further introduce a novel, model-agnostic defense framework, Ensemble Privacy Defense (EPD), which aggregates and evaluates the outputs of a knowledge-injected LLM, a base LLM, and a dedicated judge model to enhance resistance against MIAs. Comprehensive experiments show that, on average, EPD reduces MIA success by up to 27.8\% for SFT and 526.3\% for RAG compared to inference-time baseline, while maintaining answer quality.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。