arXiv 2506.060602026-02-25cs.CLcs.AI

简单而有效的：在联邦微调大型语言模型中提取客户端私有数据

Simple Yet Effective: Extracting Private Data Across Clients in Federated Fine-Tuning of Large Language Models

Harbin Institute of Technology（哈尔滨工业大学）；Kuaishou Technology（快手科技）；Meta AI；Monash University（墨尔本大学）；Fudan University（复旦大学）；Shanghai Academy of Artificial Intelligence for Science（上海人工智能科学研究院）

Yingqi Hu, Zhuo Zhang, Jingyuan Zhang, Jinghua Wang, Qifan Wang, Lizhen Qu, Zenglin Xu

备注：: IJCNLP 2025 Findings

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出三种简单有效的方法，用于在联邦微调大型语言模型中提取客户端私有数据，揭示了FedLLMs中的隐私风险并建立了评估框架。

摘要：

联邦大型语言模型（FedLLMs）能够在机构之间实现跨数据中心协同训练，同时保持数据本地性，使其在隐私敏感领域如法律、金融和医疗中具有吸引力。然而，LLM的记忆行为可能导致隐私风险，可能引发跨客户端数据泄露。在本工作中，我们研究了跨客户端数据提取的威胁，其中半诚实参与者试图从其他客户端的数据中恢复个人可识别信息（PII）。我们提出了三种简单而有效的提取策略，利用攻击者本地数据中的上下文前缀，包括基于频率的前缀采样和本地微调以增强记忆。为了评估这些攻击，我们构建了一个中文法律领域数据集，具有细粒度的PII注释，符合CPIS、GDPR和CCPA标准，并使用两个指标：覆盖率和效率来评估提取性能。实验结果表明，我们的方法可以恢复多达56.6%的受害者专属PII，其中姓名、地址和出生日期尤为脆弱。这些发现突显了FedLLMs中的具体隐私风险，并为未来隐私保护联邦学习的研究建立了基准和评估框架。代码和数据可在https://github.com/SMILELab-FL/FedPII获取。

英文摘要：

Federated large language models (FedLLMs) enable cross-silo collaborative training among institutions while preserving data locality, making them appealing for privacy-sensitive domains such as law, finance, and healthcare. However, the memorization behavior of LLMs can lead to privacy risks that may cause cross-client data leakage. In this work, we study the threat of cross-client data extraction, where a semi-honest participant attempts to recover personally identifiable information (PII) memorized from other clients' data. We propose three simple yet effective extraction strategies that leverage contextual prefixes from the attacker's local data, including frequency-based prefix sampling and local fine-tuning to amplify memorization. To evaluate these attacks, we construct a Chinese legal-domain dataset with fine-grained PII annotations consistent with CPIS, GDPR, and CCPA standards, and assess extraction performance using two metrics: coverage and efficiency. Experimental results show that our methods can recover up to 56.6% of victim-exclusive PII, where names, addresses, and birthdays are particularly vulnerable. These findings highlight concrete privacy risks in FedLLMs and establish a benchmark and evaluation framework for future research on privacy-preserving federated learning. Code and data are available at https://github.com/SMILELab-FL/FedPII.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。