超越不可区分性：衡量LLM API中的提取风险
Beyond Indistinguishability: Measuring Extraction Risk in LLM APIs
AI总结：
本文提出$(l, b)$-不可提取性作为衡量LLM API提取风险的新标准，通过定义提取风险上界并实验证明其在不同模型中的有效性，为模型训练、API访问和解码配置提供缓解指南。
摘要：
不可区分性属性如差分隐私界限或低经验测量的成员推断常被视为展示模型足够保护 against 更广泛的记忆风险的代理。然而，我们显示不可区分性属性既不充分也不必要防止LLM API中的数据提取。我们正式化了提取与基于不可区分性的隐私之间的隐私游戏分离，证明不可区分性与不可提取性不可比较：上界区分性不 upper-bound 提取性。为解决这一差距，我们引入$(l, b)$-不可提取性作为定义，要求任何黑盒对手至少需要$2^b$次查询才能使LLM API发出受保护的$l$-gram子字符串。我们通过最坏情况提取游戏实例化这一定义，并推导出针对精确提取的基于排名的提取风险上界，以及扩展到覆盖无针对性和近似提取。所得到的估计器捕捉了多个攻击试验和前缀适应的提取风险。我们证明它可以为标准贪心提取提供紧致且高效的估计，并为任何解码配置提供概率提取风险的上界。我们实证评估了不同模型的可提取性，澄清了其与区分性的联系，展示了其优于现有提取风险估计器的优势，并在LLM API部署中提供可行的缓解指南。我们的代码在：https://github.com/Emory-AIMS/Inextractability。
英文摘要：
Indistinguishability properties such as differential privacy bounds or low empirically measured membership inference are widely treated as proxies to show a model is sufficiently protected against broader memorization risks. However, we show that indistinguishability properties are neither sufficient nor necessary for preventing data extraction in LLM APIs. We formalize a privacy-game separation between extraction and indistinguishability-based privacy, showing that indistinguishability and inextractability are incomparable: upper-bounding distinguishability does not upper-bound extractability. To address this gap, we introduce $(l, b)$-inextractability as a definition that requires at least $2^b$ expected queries for any black-box adversary to induce the LLM API to emit a protected $l$-gram substring. We instantiate this via a worst-case extraction game and derive a rank-based extraction risk upper bound for targeted exact extraction, as well as extensions to cover untargeted and approximate extraction. The resulting estimator captures the extraction risk over multiple attack trials and prefix adaptations. We show that it can provide a tight and efficient estimation for standard greedy extraction and an upper bound on the probabilistic extraction risk given any decoding configuration. We empirically evaluate extractability across different models, clarifying its connection to distinguishability, demonstrating its advantage over existing extraction risk estimators, and providing actionable mitigation guidelines across model training, API access, and decoding configurations in LLM API deployment. Our code is publicly available at: https://github.com/Emory-AIMS/Inextractability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
