Large Language Models (LLMs) are often trained on vast amounts of undisclosed
data, motivating the development of post-hoc Membership Inference Attacks
(MIAs) to gain insight into their training data composition. However, in this
paper, we identify inherent challenges in post-hoc MIA evaluation due to
potential distribution shifts between collected member and non-member datasets.
Using a simple bag-of-words classifier, we demonstrate that datasets used in
recent post-hoc MIAs suffer from significant distribution shifts, in some cases
achieving near-perfect distinction between members and non-members. This
implies that previously reported high MIA performance may be largely
attributable to these shifts rather than model memorization. We confirm that
randomized, controlled setups eliminate such shifts and thus enable the
development and fair evaluation of new MIAs. However, we note that such
randomized setups are rarely available for the latest LLMs, making post-hoc
data collection still required to infer membership for real-world LLMs. As a
potential solution, we propose a Regression Discontinuity Design (RDD) approach
for post-hoc data collection, which substantially mitigates distribution
shifts. Evaluating various MIA methods on this RDD setup yields performance
barely above random guessing, in stark contrast to previously reported results.
Overall, our findings highlight the challenges in accurately measuring LLM
memorization and the need for careful experimental design in (post-hoc)
membership inference tasks.

通过使用简单的词袋分类器，我们发现最近的后续成员推理攻击 (MIAs) 研究中使用的数据集存在显著的分布偏移，这意味着先前报道的高 MIA 性能可能主要归因于这些偏移而不是模型的记忆。为了解决这个问题，我们提出了回归不连续设计 (RDD) 方法来减轻分布偏移。在这种 RDD 设置下评估各种 MIA 方法的性能表现几乎与随机猜测相当，与先前报道的结果截然不同。总之，我们的研究结果凸显了准确衡量 LLM 记忆的挑战，以及在 (后续) 成员推理任务中需要仔细进行实验设计的必要性。

大型语言模型的事后成员推断的固有挑战

Inherent Challenges of Post-Hoc Membership Inference for Large Language  Models

Deferring systems extend supervised Machine Learning (ML) models with the
possibility to defer predictions to human experts. However, evaluating the
impact of a deferring strategy on system accuracy is still an overlooked area.
This paper fills this gap by evaluating deferring systems through a causal
lens. We link the potential outcomes framework for causal inference with
deferring systems. This allows us to identify the causal impact of the
deferring strategy on predictive accuracy. We distinguish two scenarios. In the
first one, we can access both the human and the ML model predictions for the
deferred instances. In such a case, we can identify the individual causal
effects for deferred instances and aggregates of them. In the second scenario,
only human predictions are available for the deferred instances. In this case,
we can resort to regression discontinuity design to estimate a local causal
effect. We empirically evaluate our approach on synthetic and real datasets for
seven deferring systems from the literature.

通过因果推断的方法，评估延迟系统对预测准确度的因果影响，区别两种场景，一种是能够接触到人类和机器学习模型的预测结果，另一种是只有人类预测结果可用，通过这种方法在合成和真实数据集上对七种延迟系统进行了实证评估。

用于评估延迟系统的因果框架

A Causal Framework for Evaluating Deferring Systems

Video analytics systems based on deep learning models are often opaque and
brittle and require explanation systems to help users debug. Current model
explanation system are very good at giving literal explanations of behavior in
terms of pixel contributions but cannot integrate information about the
physical or systems processes that might influence a prediction. This paper
introduces the idea that a simple form of causal reasoning, called a regression
discontinuity design, can be used to associate changes in multiple key
performance indicators to physical real world phenomena to give users a more
actionable set of video analytics explanations. We overview the system
architecture and describe a vision of the impact that such a system might have.

基于深度学习模型的视频分析系统常常是不透明且易碎的，需要解释系统来帮助用户进行调试。现有的模型解释系统善于以像素贡献的方式给出行为的字面解释，但无法整合可能影响预测的物理或系统过程的信息。本文引入了回归不连续设计这种简单形式的因果推理，用于将多个关键绩效指标的变化与物理世界现象相关联，以给用户提供更可行的视频分析解释集合。我们概述了系统架构，并描述了这种系统可能带来的影响的愿景。