从监督微调模型中重建个人身份信息
Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Models
AI总结：
本文研究了从监督微调模型中重建个人身份信息的问题，提出COVA算法在前缀攻击下优于现有提取方法，揭示了不同PII类型泄露程度差异。
摘要：
监督微调（SFT）已成为调整大型语言模型（LLM）以适应领域特定任务的主要方法。SFT数据集通常包含用户提供的信息，可能包含敏感的个人身份信息（PII）。本文首次研究从SFT模型中重建PII的问题。我们构建了包含PII的多轮用户中心问答数据集，在敏感领域（医疗和法律）进行真实评估。使用这些数据集，我们评估了攻击者在不同知识水平下推断个体敏感信息的能力。在重建设置中，我们提出COVA算法，该算法在基于前缀的攻击中一致优于现有提取方法。结果表明，即使攻击者部分知识也能显著提高重建成功率，而PII类型之间的泄露程度差异很大。
英文摘要：
Supervised Finetuning (SFT) has become one of the primary methods for adapting a large language model (LLM) with extensive pre-trained knowledge to domain-specific, instruction-following tasks. SFT datasets, composed of instruction-response pairs, often include user-provided information that may contain sensitive data such as personally identifiable information (PII), raising privacy concerns. This paper studies the problem of targeted PII reconstruction from models fine- tuned on proprietary SFT data, in which an adversary attempts to recover PII associated with a specific identity. We construct multi-turn, user-centric Q&A datasets in sensitive domains, specifically medical and legal settings, that incorporate PII to enable realistic evaluation of leakage. We then propose COVA, a coverage-aware decoding algorithm for targeted PII reconstruction under prefix-based attacks. Using COVA, we study how the amount of information available about a target user affects the recovery of their PII from SFT models. Across datasets, COVA consistently improves PII reconstruction over baseline decoding methods, and even limited contextual knowledge can substantially increase an adversary's success. Our findings demonstrate that small, proprietary SFT datasets can induce meaningful privacy leakage through the reconstruction of target-PII associations learned during fine-tuning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
