Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods

Roy Xie, Junlin Wang, Ruomin Huang, Minxing Zhang, Rong Ge, Jian Pei, Neil Zhenqiang Gong, Bhuwan Dhingra

TL;DR

ReCall introduces a novel membership inference attack for large language models that uses the relative change in conditional log-likelihood when target data are preceded by non-member prefixes. By leveraging in-context learning dynamics without model parameter updates, ReCall achieves state-of-the-art performance on WikiMIA and remains competitive on MIMIR, even with random or synthetic prefixes and with ensemble enhancements. The paper provides extensive analyses of prefix strategies, shot counts, and token-level effects, highlighting practical considerations for real-world data auditing and privacy-preserving model deployment. Overall, ReCall sheds light on how LLMs reveal membership information and offers a scalable, effective tool for auditing pretraining data, with implications for policy and privacy safeguards.

Abstract

The rapid scaling of large language models (LLMs) has raised concerns about the transparency and fair use of the data used in their pretraining. Detecting such content is challenging due to the scale of the data and limited exposure of each instance during training. We propose ReCaLL (Relative Conditional Log-Likelihood), a novel membership inference attack (MIA) to detect LLMs' pretraining data by leveraging their conditional language modeling capabilities. ReCaLL examines the relative change in conditional log-likelihoods when prefixing target data points with non-member context. Our empirical findings show that conditioning member data on non-member prefixes induces a larger decrease in log-likelihood compared to non-member data. We conduct comprehensive experiments and show that ReCaLL achieves state-of-the-art performance on the WikiMIA dataset, even with random and synthetic prefixes, and can be further improved using an ensemble approach. Moreover, we conduct an in-depth analysis of LLMs' behavior with different membership contexts, providing insights into how LLMs leverage membership information for effective inference at both the sequence and token level.

ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods

TL;DR

ReCall introduces a novel membership inference attack for large language models that uses the relative change in conditional log-likelihood when target data are preceded by non-member prefixes. By leveraging in-context learning dynamics without model parameter updates, ReCall achieves state-of-the-art performance on WikiMIA and remains competitive on MIMIR, even with random or synthetic prefixes and with ensemble enhancements. The paper provides extensive analyses of prefix strategies, shot counts, and token-level effects, highlighting practical considerations for real-world data auditing and privacy-preserving model deployment. Overall, ReCall sheds light on how LLMs reveal membership information and offers a scalable, effective tool for auditing pretraining data, with implications for policy and privacy safeguards.

Abstract

The rapid scaling of large language models (LLMs) has raised concerns about the transparency and fair use of the data used in their pretraining. Detecting such content is challenging due to the scale of the data and limited exposure of each instance during training. We propose ReCaLL (Relative Conditional Log-Likelihood), a novel membership inference attack (MIA) to detect LLMs' pretraining data by leveraging their conditional language modeling capabilities. ReCaLL examines the relative change in conditional log-likelihoods when prefixing target data points with non-member context. Our empirical findings show that conditioning member data on non-member prefixes induces a larger decrease in log-likelihood compared to non-member data. We conduct comprehensive experiments and show that ReCaLL achieves state-of-the-art performance on the WikiMIA dataset, even with random and synthetic prefixes, and can be further improved using an ensemble approach. Moreover, we conduct an in-depth analysis of LLMs' behavior with different membership contexts, providing insights into how LLMs leverage membership information for effective inference at both the sequence and token level.
Paper Structure (64 sections, 13 equations, 12 figures, 16 tables)

This paper contains 64 sections, 13 equations, 12 figures, 16 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Membership Inference Attacks
  4. In-context Learning as Attack Vectors
  5. ReCall: Relative Conditional Log-Likelihood
  6. Problem Definition
  7. Proposed Method
  8. Prefix Selection
  9. Experiments and Results
  10. Experimental Setup
  11. Benchmarks
  12. Baselines
  13. Models
  14. Metrics
  15. Implementation Details
  16. ...and 49 more sections

Figures (12)

  • Figure 1: Log-Likelihood comparison between members (M) and non-members (NM). Members experience a higher likelihood reduction than non-members when conditioned with non-member context.
  • Figure 2: Distribution of ReCall scores for members and non-members. Values close to 1 indicate changes are minimal. Overall, members tend to have higher ReCall scores compared to non-members. More visualizations can be found in \ref{['app:recall_visual_v1']}.
  • Figure 3: ReCall performance up to 28 shots. Red dash line represents the LLMs' context window limit. ReCall consistently outperforms baselines across all settings, even with just one shot.
  • Figure 4: Conditioning both member and non-member with member prefix do not yield significant changes in LL compare to non-member prefix. More visualization can be found in \ref{['app:member_prefix_visual']}.
  • Figure 5: Token-level LL changes for members and non-members with different membership prefix. The largest changes occur in the beginning tokens. Member and non-member data are most different when prefixed with non-member context.
  • ...and 7 more figures