Pathway to Secure and Trustworthy ZSM for LLMs: Attacks, Defense, and Opportunities

TL;DR

The paper investigates the security and trustworthiness of pre-trained AI encoders used in Net4LLMs within ZSM/MEC networks. It centers on membership inference attacks targeting fine-tuned encoders and demonstrates significant leakage potential, with attack success reaching up to 92% in NER tasks. It proposes defense strategies, notably data-efficient fine-tuning via active/curiculum learning and an edge-based trust evaluation module to assess encoder trustworthiness. The work highlights practical risks for LLM-as-a-service in 6G/ZSM and outlines open issues in multimodal deployment, privacy protection, and latency considerations, providing a foundation for building trustworthy Net4LLMs.

Abstract

Recently, large language models (LLMs) have been gaining a lot of interest due to their adaptability and extensibility in emerging applications, including communication networks. It is anticipated that ZSM networks will be able to support LLMs as a service, as they provide ultra reliable low-latency communications and closed loop massive connectivity. However, LLMs are vulnerable to data and model privacy issues that affect the trustworthiness of LLMs to be deployed for user-based services. In this paper, we explore the security vulnerabilities associated with fine-tuning LLMs in ZSM networks, in particular the membership inference attack. We define the characteristics of an attack network that can perform a membership inference attack if the attacker has access to the fine-tuned model for the downstream task. We show that the membership inference attacks are effective for any downstream task, which can lead to a personal data breach when using LLM as a service. The experimental results show that the attack success rate of maximum 92% can be achieved on named entity recognition task. Based on the experimental analysis, we discuss possible defense mechanisms and present possible research directions to make the LLMs more trustworthy in the context of ZSM networks.

Figures (5)

• Figure 1: Network for LLMs illustration in ZSM with examples of smart homes and emergency services. The LLMs can be used by the central cloud and shared with the 6G Edge Cloud. The 6G edge cloud then share either the parameters to the ZSM network or users to fine-tune the network for personalization, or it shares the cached version of the model to provide a specific service.
• Figure 2: Training, Fine-tuning, and customization strategies for LLMs in ZSM-based MEC framework.
• Figure 3: Membership Inference Attack performance on CoNLL2003, Yelp, AG's News and SST downstream tasks.
• Figure 4: Membership Inference Attack performance on CoNLL2003, Yelp, AG's News and SST downstream tasks when the attack model employs only either of the dataset.
• Figure 5: Membership Inference Attack performance on Yelp downstream tasks when varying number of classes.