Large Language Models (LLMs) are often trained on vast amounts of undisclosed
data, motivating the development of post-hoc Membership Inference Attacks
(MIAs) to gain insight into their training data composition. However, in this
paper, we identify inherent challenges in post-hoc MIA evaluation due to
potential distribution shifts between collected member and non-member datasets.
Using a simple bag-of-words classifier, we demonstrate that datasets used in
recent post-hoc MIAs suffer from significant distribution shifts, in some cases
achieving near-perfect distinction between members and non-members. This
implies that previously reported high MIA performance may be largely
attributable to these shifts rather than model memorization. We confirm that
randomized, controlled setups eliminate such shifts and thus enable the
development and fair evaluation of new MIAs. However, we note that such
randomized setups are rarely available for the latest LLMs, making post-hoc
data collection still required to infer membership for real-world LLMs. As a
potential solution, we propose a Regression Discontinuity Design (RDD) approach
for post-hoc data collection, which substantially mitigates distribution
shifts. Evaluating various MIA methods on this RDD setup yields performance
barely above random guessing, in stark contrast to previously reported results.
Overall, our findings highlight the challenges in accurately measuring LLM
memorization and the need for careful experimental design in (post-hoc)
membership inference tasks.

通过使用简单的词袋分类器，我们发现最近的后续成员推理攻击 (MIAs) 研究中使用的数据集存在显著的分布偏移，这意味着先前报道的高 MIA 性能可能主要归因于这些偏移而不是模型的记忆。为了解决这个问题，我们提出了回归不连续设计 (RDD) 方法来减轻分布偏移。在这种 RDD 设置下评估各种 MIA 方法的性能表现几乎与随机猜测相当，与先前报道的结果截然不同。总之，我们的研究结果凸显了准确衡量 LLM 记忆的挑战，以及在 (后续) 成员推理任务中需要仔细进行实验设计的必要性。

大型语言模型的事后成员推断的固有挑战

Inherent Challenges of Post-Hoc Membership Inference for Large Language  Models

User-generated reviews can be decomposed into fine-grained segments (e.g.,
sentences, clauses), each evaluating a different aspect of the principal entity
(e.g., price, quality, appearance). Automatically detecting these aspects can
be useful for both users and downstream opinion mining applications. Current
supervised approaches for learning aspect classifiers require many fine-grained
aspect labels, which are labor-intensive to obtain. And, unfortunately,
unsupervised topic models often fail to capture the aspects of interest. In
this work, we consider weakly supervised approaches for training aspect
classifiers that only require the user to provide a small set of seed words
(i.e., weakly positive indicators) for the aspects of interest. First, we show
that current weakly supervised approaches do not effectively leverage the
predictive power of seed words for aspect detection. Next, we propose a
student-teacher approach that effectively leverages seed words in a
bag-of-words classifier (teacher); in turn, we use the teacher to train a
second model (student) that is potentially more powerful (e.g., a neural
network that uses pre-trained word embeddings). Finally, we show that iterative
co-training can be used to cope with noisy seed words, leading to both improved
teacher and student models. Our proposed approach consistently outperforms
previous weakly supervised approaches (by 14.1 absolute F1 points on average)
in six different domains of product reviews and six multilingual datasets of
restaurant reviews.

本篇论文的主要研究是关于使用弱监督训练出纯文本的粒度级别用于用户生成的评论的细粒度方面分类器，并提出了基于学生 - 教师模型和迭代协同训练的方法来改进模型表现，对商品评论和餐厅评论的六个数据集，该方法模型的绝对 f1 值平均提升了 14.1 个百分点。