The proliferation of large language models (LLMs) in the real world has come
with a rise in copyright cases against companies for training their models on
unlicensed data from the internet. Recent works have presented methods to
identify if individual text sequences were members of the model's training
data, known as membership inference attacks (MIAs). We demonstrate that the
apparent success of these MIAs is confounded by selecting non-members (text
sequences not used for training) belonging to a different distribution from the
members (e.g., temporally shifted recent Wikipedia articles compared with ones
used to train the model). This distribution shift makes membership inference
appear successful. However, most MIA methods perform no better than random
guessing when discriminating between members and non-members from the same
distribution (e.g., in this case, the same period of time). Even when MIAs
work, we find that different MIAs succeed at inferring membership of samples
from different distributions. Instead, we propose a new dataset inference
method to accurately identify the datasets used to train large language models.
This paradigm sits realistically in the modern-day copyright landscape, where
authors claim that an LLM is trained over multiple documents (such as a book)
written by them, rather than one particular paragraph. While dataset inference
shares many of the challenges of membership inference, we solve it by
selectively combining the MIAs that provide positive signal for a given
distribution, and aggregating them to perform a statistical test on a given
dataset. Our approach successfully distinguishes the train and test sets of
different subsets of the Pile with statistically significant p-values < 0.1,
without any false positives.

大语言模型在现实世界中的大量使用产生了对公司以未经许可的方式在互联网上训练模型的版权纠纷。本文提出了一种新的数据集推断方法来准确识别用于训练大语言模型的数据集，成功地区分了不同子集的 Pile 数据集的训练集和测试集，无任何错误的正例。