Model inversion and membership inference attacks aim to reconstruct and
verify the data which a model was trained on. However, they are not guaranteed
to find all training samples as they do not know the size of the training set.
In this paper, we introduce a new task: dataset size recovery, that aims to
determine the number of samples used to train a model, directly from its
weights. We then propose DSiRe, a method for recovering the number of images
used to fine-tune a model, in the common case where fine-tuning uses LoRA. We
discover that both the norm and the spectrum of the LoRA matrices are closely
linked to the fine-tuning dataset size; we leverage this finding to propose a
simple yet effective prediction algorithm. To evaluate dataset size recovery of
LoRA weights, we develop and release a new benchmark, LoRA-WiSE, consisting of
over 25000 weight snapshots from more than 2000 diverse LoRA fine-tuned models.
Our best classifier can predict the number of fine-tuning images with a mean
absolute error of 0.36 images, establishing the feasibility of this attack.

我们引入了一个新的任务：数据集大小恢复，旨在直接从模型的权重中确定用于训练模型的样本数量。我们提出了 DSiRe 方法，用于恢复用于微调模型的图像数量，并发现 LoRA 矩阵的范数和频谱与微调数据集的大小密切相关，我们利用这一发现提出了一个简单而有效的预测算法。通过开发和发布一个包含 25000 个权重快照的新基准 LoRA-WiSE，我们的最佳分类器可以预测微调图像的数量，平均绝对误差为 0.36 个图像，证明了这种攻击的可行性。