Membership inference attacks (MIAs) attempt to predict whether a particular datapoint is a member of a target model's training data. Despite extensive research on traditional machine learning models, there has been limited work studying MIA on the pre-training data of large language models (LLMs). We perform a large-scale evaluation of MIAs over a suite of language models (LMs) trained on the Pile, ranging from 160M to 12B parameters. We find that MIAs barely outperform random guessing for most settings across varying LLM sizes and domains. Our further analyses reveal that this poor performance can be attributed to (1) the combination of a large dataset and few training iterations, and (2) an inherently fuzzy boundary between members and non-members. We identify specific settings where LLMs have been shown to be vulnerable to membership inference and show that the apparent success in such settings can be attributed to a distribution shift, such as when members and non-members are drawn from the seemingly identical domain but with different temporal ranges. We release our code and data as a unified benchmark package that includes all existing MIAs, supporting future work.

成员推理攻击的大规模评估发现在多种设置中，大型语言模型的预训练数据上的成员推理攻击表现较差，主要原因是庞大数据集和较少训练迭代之间的结合，以及成员和非成员之间存在模糊的边界。我们识别出特定的设置，这些设置中语言模型易受成员推理攻击影响，并证明这种成功可以归因于分布变化，例如成员和非成员从看似相同的领域，但具有不同的时间范围。我们提供了代码和数据，形成了一个统一的基准测试套件，包括所有现有的成员推理攻击方案，以支持未来的研究工作。

大型语言模型是否受到成员推断攻击的影响？