arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2601.02002cs.IRcs.AIcs.CL
收藏

探索用于检测大型语言模型中推荐系统数据记忆的方法

Exploring Approaches for Detecting Memorization of Recommender System Data in Large Language Models

Politecnico di Bari(巴里理工大学)

Antonio Colacicco, Vito Guida, Dario Di Palma, Fedelucio Narducci, Tommaso Di Noia

AI总结:

本文提出三种方法探索大型语言模型中推荐系统数据记忆的检测,发现自动优化提示是提取记忆样本最有效的方法。

摘要:

大型语言模型(LLMs)因其强大的自然语言理解和生成能力而越来越多地应用于推荐场景。然而,它们是在大量未公开内容的语料库上进行训练的,这引发了数据泄露的担忧。最近的研究表明,MovieLens-1M数据集已被LLaMA和OpenAI模型家族记忆,但目前提取此类记忆数据仅依赖于手动提示工程。在本文中,我们提出了三个主要问题:是否可以增强手动提示?是否可以通过超越手动提示的方法检测LLM的记忆?以及是否可以自动化检测数据泄露?为了解决这些问题,我们评估了三种方法:(i) jailbreak提示工程;(ii)无监督的潜在知识发现,通过对比一致搜索(CCS)和聚类范数探测内部激活;以及(iii)自动提示工程(APE),将提示发现视为元学习过程,通过迭代优化候选指令来改进。在使用LLaMA模型对MovieLens-1M进行实验时,发现jailbreak提示并未提高对记忆项的检索效果,且结果不一致;CCS能够可靠地区分真实和伪造的电影标题,但在数值用户和评分数据上失败;而APE在检索项级信息上取得了一定成效,但在恢复数值交互方面仍存在困难。这些发现表明,自动优化提示是提取记忆样本最具前景的策略。

英文摘要:

Large Language Models (LLMs) are increasingly applied in recommendation scenarios due to their strong natural language understanding and generation capabilities. However, they are trained on vast corpora whose contents are not publicly disclosed, raising concerns about data leakage. Recent work has shown that the MovieLens-1M dataset is memorized by both the LLaMA and OpenAI model families, but the extraction of such memorized data has so far relied exclusively on manual prompt engineering. In this paper, we pose three main questions: Is it possible to enhance manual prompting? Can LLM memorization be detected through methods beyond manual prompting? And can the detection of data leakage be automated? To address these questions, we evaluate three approaches: (i) jailbreak prompt engineering; (ii) unsupervised latent knowledge discovery, probing internal activations via Contrast-Consistent Search (CCS) and Cluster-Norm; and (iii) Automatic Prompt Engineering (APE), which frames prompt discovery as a meta-learning process that iteratively refines candidate instructions. Experiments on MovieLens-1M using LLaMA models show that jailbreak prompting does not improve the retrieval of memorized items and remains inconsistent; CCS reliably distinguishes genuine from fabricated movie titles but fails on numerical user and rating data; and APE retrieves item-level information with moderate success yet struggles to recover numerical interactions. These findings suggest that automatically optimizing prompts is the most promising strategy for extracting memorized samples.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑