R.R.：通过回忆与排序揭示 LLM 训练隐私
R.R.: Unveiling LLM Training Privacy through Recollection and Ranking
AI总结：
提出两步隐私攻击 R.R.，通过回忆填充掩码 PII 并基于参考模型校准排序，证明脱敏训练数据仍可泄露个人信息。
摘要：
大型语言模型（LLM）带来显著的隐私风险，可能因隐式记忆而泄露训练数据。现有隐私攻击主要关注成员推理攻击（MIA）或数据提取攻击，但重构 LLM 训练数据中特定的个人可识别信息（PII）仍然具有挑战性。本文提出 R.R.（Recollect and Rank，回忆与排序），这是一种新型两步隐私窃取攻击，使攻击者能够从已脱敏、PII 实体已被掩码的训练数据中重构 PII 实体。第一阶段，我们引入名为 recollection（回忆）的提示范式，指示 LLM 重复带掩码的文本并填充掩码；随后可使用 PII 标识符提取回忆出的 PII 候选。第二阶段，我们设计新的准则对每个 PII 候选评分并排序。受成员推理启发，我们利用参考模型作为该准则的校准。在三个常用 PII 数据集上的实验表明，R.R. 相比基线取得更好的 PII 识别性能。这些结果凸显，即使训练数据已经脱敏，LLM 仍易受 PII 泄露影响。我们在 GitHub 发布代码和数据集。
英文摘要：
Large Language Models (LLMs) pose significant privacy risks, potentially leaking training data due to implicit memorization. Existing privacy attacks primarily focus on membership inference attacks (MIAs) or data extraction attacks, but reconstructing specific personally identifiable information (PII) in LLMs' training data remains challenging. In this paper, we propose R.R. (Recollect and Rank), a novel two-step privacy stealing attack that enables attackers to reconstruct PII entities from scrubbed training data where the PII entities have been masked. In the first stage, we introduce a prompt paradigm named recollection, which instructs the LLM to repeat a masked text but fill in masks. Then we can use PII identifiers to extract recollected PII candidates. In the second stage, we design a new criterion to score each PII candidate and rank them. Motivated by membership inference, we leverage the reference model as a calibration to our criterion. Experiments across three popular PII datasets demonstrate that the R.R. achieves better PII identification performance than baselines. These results highlight the vulnerability of LLMs to PII leakage even when training data has been scrubbed. We release our code and datasets at GitHub.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
