Large Language Models (LLMs) are often trained on vast amounts of undisclosed data, motivating the development of post-hoc Membership Inference Attacks (MIAs) to gain insight into their training data composition. However, in this paper, we identify inherent challenges in post-hoc MIA evaluation due to potential distribution shifts between collected member and non-member datasets. Using a simple bag-of-words classifier, we demonstrate that datasets used in recent post-hoc MIAs suffer from significant distribution shifts, in some cases achieving near-perfect distinction between members and non-members. This implies that previously reported high MIA performance may be largely attributable to these shifts rather than model memorization. We confirm that randomized, controlled setups eliminate such shifts and thus enable the development and fair evaluation of new MIAs. However, we note that such randomized setups are rarely available for the latest LLMs, making post-hoc data collection still required to infer membership for real-world LLMs. As a potential solution, we propose a Regression Discontinuity Design (RDD) approach for post-hoc data collection, which substantially mitigates distribution shifts. Evaluating various MIA methods on this RDD setup yields performance barely above random guessing, in stark contrast to previously reported results. Overall, our findings highlight the challenges in accurately measuring LLM memorization and the need for careful experimental design in (post-hoc) membership inference tasks.

通过使用简单的词袋分类器，我们发现最近的后续成员推理攻击(MIAs)研究中使用的数据集存在显著的分布偏移，这意味着先前报道的高MIA性能可能主要归因于这些偏移而不是模型的记忆。为了解决这个问题，我们提出了回归不连续设计(RDD)方法来减轻分布偏移。在这种RDD设置下评估各种MIA方法的性能表现几乎与随机猜测相当，与先前报道的结果截然不同。总之，我们的研究结果凸显了准确衡量LLM记忆的挑战，以及在(后续)成员推理任务中需要仔细进行实验设计的必要性。

大型语言模型的事后成员推断的固有挑战