It is commonplace to produce application-specific models by fine-tuning large
pre-trained models using a small bespoke dataset. The widespread availability
of foundation model checkpoints on the web poses considerable risks, including
the vulnerability to backdoor attacks. In this paper, we unveil a new
vulnerability: the privacy backdoor attack. This black-box privacy attack aims
to amplify the privacy leakage that arises when fine-tuning a model: when a
victim fine-tunes a backdoored model, their training data will be leaked at a
significantly higher rate than if they had fine-tuned a typical model. We
conduct extensive experiments on various datasets and models, including both
vision-language models (CLIP) and large language models, demonstrating the
broad applicability and effectiveness of such an attack. Additionally, we carry
out multiple ablation studies with different fine-tuning methods and inference
strategies to thoroughly analyze this new threat. Our findings highlight a
critical privacy concern within the machine learning community and call for a
reevaluation of safety protocols in the use of open-source pre-trained models.

利用小型专用数据集微调大型预训练模型来生成特定应用模型是常见的做法。然而，我们揭示了一种新的漏洞：隐私后门攻击，通过该攻击，在微调受后门影响的模型时，训练数据的隐私泄露率会显著增加。我们在不同数据集和模型上进行了大量实验证明了这种攻击的广泛适用性和有效性，并通过不同微调方法和推断策略进行了多次消融研究以全面分析这个新威胁。我们的发现突出了机器学习社区的重要隐私问题，并呼吁重新评估使用开源预训练模型的安全协议。

隐私后门：通过污染预训练模型增强成员推断

Privacy Backdoors: Enhancing Membership Inference through Poisoning  Pre-trained Models

This paper introduces a novel approach for efficiently distilling LLMs into
smaller, application-specific models, significantly reducing operational costs
and manual labor. Addressing the challenge of deploying computationally
intensive LLMs in specific applications or edge devices, this technique
utilizes LLMs' reasoning capabilities to generate labels and natural language
rationales for unlabeled data. Our approach enhances both finetuning and
distillation by employing a multi-task training framework where student models
mimic these rationales alongside teacher predictions. Key contributions include
the employment of zero-shot prompting to elicit teacher model rationales,
reducing the necessity for handcrafted few-shot examples and lowering the
overall token count required, which directly translates to cost savings given
the pay-per-token billing model of major tech companies' LLM APIs.
Additionally, the paper investigates the impact of explanation properties on
distillation efficiency, demonstrating that minimal performance loss occurs
even when rationale augmentation is not applied across the entire dataset,
facilitating further reductions of tokens. This research marks a step toward
the efficient training of task-specific models with minimal human intervention,
offering substantial cost-savings while maintaining, or even enhancing,
performance.

本文介绍了一种新颖的方法，可以将 LLMs 高效地提炼成更小的、面向特定应用的模型，显著降低运营成本和人工劳动。该方法利用 LLMs 的推理能力为无标签数据生成标签和自然语言解释，从而在有限数据和计算资源情况下增强模型的微调和提炼效果。其中关键贡献包括使用零样本提示获取教师模型的解释，减少手工制作的小样本示例的需求，并降低令牌数，这直接转化为主要技术公司 LLM API 的按令牌计费模式下的成本节约。此外，本文还研究了解释特性对提炼效率的影响，并证明了即使在整个数据集上未应用理由增强时也几乎不会导致性能损失，从而进一步减少了令牌数量。这项研究是朝向最小化人工干预、高效训练特定任务模型的一步，提供了大幅降低成本并保持甚至增强性能的可能性。