GEP：一种基于GCG的从小语言模型构建的聊天机器人中提取个人身份信息的方法
GEP: A GCG-Based method for extracting personally identifiable information from chatbots built on small language models
AI总结：
本研究提出GEP方法，一种基于GCG的贪婪坐标梯度方法，用于从小语言模型构建的聊天机器人中提取个人身份信息，实验显示泄露量较模板方法增加60倍，自由式插入下泄露率达4.53%。
摘要：
小语言模型（SLMs）因其在特定领域与大型语言模型（LLMs）性能大致相当，且在训练和推理过程中消耗更少的能源和时间，而变得前所未有的具有吸引力。然而，SLMs在下游任务中的个人身份信息（PII）泄露问题尚未被探索。在本研究中，我们调查了基于SLM的聊天机器人的PII泄露情况。我们首先使用医学数据集Alpaca和HealthCareMagic，基于BioGPT骨干微调了一个新的聊天机器人，即ChatBioGPT。与之前ChatDoctor和ChatGPT的研究相比，它在BERTscore上表现出可匹配的性能。基于此模型，我们证明了在SLM条件下，先前基于模板的PII攻击方法无法有效提取数据集中的PII以进行泄露检测。然后，我们提出了GEP，这是一种专门为PII提取设计的贪婪坐标梯度（GCG）方法。我们进行了GEP的实验研究，结果显示与先前基于模板的方法相比，泄露量最多增加了60倍。我们进一步通过进行自由式插入来扩展GEP在更复杂和现实情况下的能力，其中数据集中插入的PII以多种句法表达形式而非固定模板出现，GEP仍然能够揭示高达4.53%的PII泄露率。
英文摘要：
Small language models (SLMs) become unprecedentedly appealing due to their approximately equivalent performance compared to large language models (LLMs) in certain fields with less energy and time consumption during training and inference. However, the personally identifiable information (PII) leakage of SLMs for downstream tasks has yet to be explored. In this study, we investigate the PII leakage of the chatbot based on SLM. We first finetune a new chatbot, i.e., ChatBioGPT based on the backbone of BioGPT using medical datasets Alpaca and HealthCareMagic. It shows a matchable performance in BERTscore compared with previous studies of ChatDoctor and ChatGPT. Based on this model, we prove that the previous template-based PII attacking methods cannot effectively extract the PII in the dataset for leakage detection under the SLM condition. We then propose GEP, which is a greedy coordinate gradient-based (GCG) method specifically designed for PII extraction. We conduct experimental studies of GEP and the results show an increment of up to 60$\times$ more leakage compared with the previous template-based methods. We further expand the capability of GEP in the case of a more complicated and realistic situation by conducting free-style insertion where the inserted PII in the dataset is in the form of various syntactic expressions instead of fixed templates, and GEP is still able to reveal a PII leakage rate of up to 4.53%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
