Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Self-Comparison for Dataset-Level Membership Inference in Large (Vision-)Language Models

Jie Ren, Kangrui Chen, Chen Chen, Vikash Sehwag, Yue Xing, Jiliang Tang, Lingjuan Lyu

TL;DR

It is found that a member prefix followed by a non-member suffix (paraphrased from a member suffix) can further trigger the model's memorization on training data, and a novel dataset-level membership inference method based on Self-Comparison is proposed.

Abstract

Large Language Models (LLMs) and Vision-Language Models (VLMs) have made significant advancements in a wide range of natural language processing and vision-language tasks. Access to large web-scale datasets has been a key factor in their success. However, concerns have been raised about the unauthorized use of copyrighted materials and potential copyright infringement. Existing methods, such as sample-level Membership Inference Attacks (MIA) and distribution-based dataset inference, distinguish member data (data used for training) and non-member data by leveraging the common observation that models tend to memorize and show greater confidence in member data. Nevertheless, these methods face challenges when applied to LLMs and VLMs, such as the requirement for ground-truth member data or non-member data that shares the same distribution as the test data. In this paper, we propose a novel dataset-level membership inference method based on Self-Comparison. We find that a member prefix followed by a non-member suffix (paraphrased from a member suffix) can further trigger the model's memorization on training data. Instead of directly comparing member and non-member data, we introduce paraphrasing to the second half of the sequence and evaluate how the likelihood changes before and after paraphrasing. Unlike prior approaches, our method does not require access to ground-truth member data or non-member data in identical distribution, making it more practical. Extensive experiments demonstrate that our proposed method outperforms traditional MIA and dataset inference techniques across various datasets and models, including including public models, fine-tuned models, and API-based commercial models.

Self-Comparison for Dataset-Level Membership Inference in Large (Vision-)Language Models

TL;DR

It is found that a member prefix followed by a non-member suffix (paraphrased from a member suffix) can further trigger the model's memorization on training data, and a novel dataset-level membership inference method based on Self-Comparison is proposed.

Abstract

Large Language Models (LLMs) and Vision-Language Models (VLMs) have made significant advancements in a wide range of natural language processing and vision-language tasks. Access to large web-scale datasets has been a key factor in their success. However, concerns have been raised about the unauthorized use of copyrighted materials and potential copyright infringement. Existing methods, such as sample-level Membership Inference Attacks (MIA) and distribution-based dataset inference, distinguish member data (data used for training) and non-member data by leveraging the common observation that models tend to memorize and show greater confidence in member data. Nevertheless, these methods face challenges when applied to LLMs and VLMs, such as the requirement for ground-truth member data or non-member data that shares the same distribution as the test data. In this paper, we propose a novel dataset-level membership inference method based on Self-Comparison. We find that a member prefix followed by a non-member suffix (paraphrased from a member suffix) can further trigger the model's memorization on training data. Instead of directly comparing member and non-member data, we introduce paraphrasing to the second half of the sequence and evaluate how the likelihood changes before and after paraphrasing. Unlike prior approaches, our method does not require access to ground-truth member data or non-member data in identical distribution, making it more practical. Extensive experiments demonstrate that our proposed method outperforms traditional MIA and dataset inference techniques across various datasets and models, including including public models, fine-tuned models, and API-based commercial models.

Paper Structure

This paper contains 18 sections, 5 equations, 9 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related works
  3. Preliminary Studies
  4. Definitions
  5. Limitation of DDI when the validation set is not available
  6. Prefix Sequences can trigger memorization on training Data
  7. Method
  8. Self-Comparison
  9. Criteria for membership
  10. A variant when not the logits/probability of the whole vocabulary are available
  11. Experiments
  12. Experimental Settings
  13. Main results
  14. Ablation studies
  15. Conclusion
  16. ...and 3 more sections

Figures (9)

  • Figure 1: An example of using DDI
  • Figure 2: The change of distribution and $p$-values before and after $Q$ is paraphrased.
  • Figure 3: Different memorization results between paraphrasing the whole sequence and half of the sequence.
  • Figure 4: The framework of Self-Comparison
  • Figure 5: Three regions for the threshold of sample-level MIAs
  • ...and 4 more figures