构建首个针对大语言模型的可信成员推理攻击基准测试
CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models
- 利用训练过程中固定点前后数据同分布特性构建评估框架
- 在Pythia和OLMo系列模型上验证了多种攻击方法，参数规模70M至7B
- 开源模块化工具库，支持可复现的隐私研究
成员推理攻击（MIAs）是评估机器学习模型隐私性的经典方法。尽管已有若干研究尝试评估大语言模型的成员推理攻击，但现有文献在构建清晰、可复现的评估方面面临诸多挑战。特别是，成员与非成员数据集之间的细微分布偏移会破坏MIAs的统计有效性；近期研究已证明，无需访问底层模型的“盲法”攻击在相同基准上表现远超已有方法。本文提出一个原则性评估框架，通过利用训练过程中某固定点前后的训练数据来自同一分布这一洞察，将具有中间检查点和公开训练数据的开源模型转化为成员推理攻击测试床。我们在此框架下对Pythia和OLMo系列模型（参数量70M至7B）上的多种攻击方法进行了评估。为促进后续隐私研究，我们开源了一个模块化库，用于设计和实现此类攻击：https://github.com/safr-ai-lab/pandora_llm。
原文摘要 · Abstract (English)
Membership inference attacks (MIAs) are a canonical way to assess a machine learning model's privacy properties. Although several attempts have been made to evaluate MIAs on language models, the extant literature has suffered numerous difficulties in constructing clean evaluations to test new techniques. In particular, subtle distribution shifts between member and non-member sets can undermine the statistical validity of MIAs; recent work has underscored this by showing that "blind" methods with no access to the underlying model can perform far better than published methods on the same benchmarks. This paper constructs a benchmark for principled evaluation of MIAs against LLMs, by leveraging the insight that training data before and after a fixed point during training are drawn from the same distribution. Therefore, all open-source models with intermediate checkpoints and public training data can be converted into MIA testbeds. We apply our framework to a half-dozen published attacks on the Pythia and OLMo family of models, from 70M to 7B parameters. To facilitate further privacy research, we open-source a modular library for designing and implementing attacks in this setting: https://github.com/safr-ai-lab/pandora_llm.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。