Extracting Training Data from Document-Based VQA Models
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866910523256209408 |
|---|---|
| author | Pinto, Francesco Rauschmayr, Nathalie Tramèr, Florian Torr, Philip Tombari, Federico |
| author_facet | Pinto, Francesco Rauschmayr, Nathalie Tramèr, Florian Torr, Philip Tombari, Federico |
| contents | Vision-Language Models (VLMs) have made remarkable progress in document-based Visual Question Answering (i.e., responding to queries about the contents of an input document provided as an image). In this work, we show these models can memorize responses for training samples and regurgitate them even when the relevant visual information has been removed. This includes Personal Identifiable Information (PII) repeated once in the training set, indicating these models could divulge memorised sensitive information and therefore pose a privacy risk. We quantitatively measure the extractability of information in controlled experiments and differentiate between cases where it arises from generalization capabilities or from memorization. We further investigate the factors that influence memorization across multiple state-of-the-art models and propose an effective heuristic countermeasure that empirically prevents the extractability of PII. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2407_08707 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Extracting Training Data from Document-Based VQA Models Pinto, Francesco Rauschmayr, Nathalie Tramèr, Florian Torr, Philip Tombari, Federico Computer Vision and Pattern Recognition Machine Learning I.2.7; I.2.10; K.4.1 Vision-Language Models (VLMs) have made remarkable progress in document-based Visual Question Answering (i.e., responding to queries about the contents of an input document provided as an image). In this work, we show these models can memorize responses for training samples and regurgitate them even when the relevant visual information has been removed. This includes Personal Identifiable Information (PII) repeated once in the training set, indicating these models could divulge memorised sensitive information and therefore pose a privacy risk. We quantitatively measure the extractability of information in controlled experiments and differentiate between cases where it arises from generalization capabilities or from memorization. We further investigate the factors that influence memorization across multiple state-of-the-art models and propose an effective heuristic countermeasure that empirically prevents the extractability of PII. |
| title | Extracting Training Data from Document-Based VQA Models |
| topic | Computer Vision and Pattern Recognition Machine Learning I.2.7; I.2.10; K.4.1 |
| url | https://arxiv.org/abs/2407.08707 |