Amplifying Training Data Exposure through Fine-Tuning with Pseudo-Labeled Memberships
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2024
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866929480225783808 |
|---|---|
| author | Oh, Myung Gyo Ahn, Hong Eun Park, Leo Hyun Kwon, Taekyoung |
| author_facet | Oh, Myung Gyo Ahn, Hong Eun Park, Leo Hyun Kwon, Taekyoung |
| contents | Neural language models (LMs) are vulnerable to training data extraction attacks due to data memorization. This paper introduces a novel attack scenario wherein an attacker adversarially fine-tunes pre-trained LMs to amplify the exposure of the original training data. This strategy differs from prior studies by aiming to intensify the LM's retention of its pre-training dataset. To achieve this, the attacker needs to collect generated texts that are closely aligned with the pre-training data. However, without knowledge of the actual dataset, quantifying the amount of pre-training data within generated texts is challenging. To address this, we propose the use of pseudo-labels for these generated texts, leveraging membership approximations indicated by machine-generated probabilities from the target LM. We subsequently fine-tune the LM to favor generations with higher likelihoods of originating from the pre-training data, based on their membership probabilities. Our empirical findings indicate a remarkable outcome: LMs with over 1B parameters exhibit a four to eight-fold increase in training data exposure. We discuss potential mitigations and suggest future research directions. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2402_12189 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Amplifying Training Data Exposure through Fine-Tuning with Pseudo-Labeled Memberships Oh, Myung Gyo Ahn, Hong Eun Park, Leo Hyun Kwon, Taekyoung Computation and Language Cryptography and Security Machine Learning I.2.7; K.6.5 Neural language models (LMs) are vulnerable to training data extraction attacks due to data memorization. This paper introduces a novel attack scenario wherein an attacker adversarially fine-tunes pre-trained LMs to amplify the exposure of the original training data. This strategy differs from prior studies by aiming to intensify the LM's retention of its pre-training dataset. To achieve this, the attacker needs to collect generated texts that are closely aligned with the pre-training data. However, without knowledge of the actual dataset, quantifying the amount of pre-training data within generated texts is challenging. To address this, we propose the use of pseudo-labels for these generated texts, leveraging membership approximations indicated by machine-generated probabilities from the target LM. We subsequently fine-tune the LM to favor generations with higher likelihoods of originating from the pre-training data, based on their membership probabilities. Our empirical findings indicate a remarkable outcome: LMs with over 1B parameters exhibit a four to eight-fold increase in training data exposure. We discuss potential mitigations and suggest future research directions. |
| title | Amplifying Training Data Exposure through Fine-Tuning with Pseudo-Labeled Memberships |
| topic | Computation and Language Cryptography and Security Machine Learning I.2.7; K.6.5 |
| url | https://arxiv.org/abs/2402.12189 |