通过链式再生放大成员信号
Anchored or Drifting: What Recursive Self-Generation Reveals About Training Data
AI总结：
提出MADreMIA框架，利用链式再生迭代轨迹增强生成模型的成员推断和数据集推理攻击，在低误报率下提升信号强度。
摘要：
大型生成模型记忆训练数据的趋势使得样本验证对于隐私审计和版权执行至关重要。当前的成员推断（MIA）和数据集推理（DI）攻击通常依赖于一次性生成，这会产生弱信号并在不同模态间具有有限的敏感性。受模型自噬障碍（MAD）的启发，我们引入了MADreMIA，这是一个模型无关的框架，增强了白盒、灰盒和黑盒MIA及DI。我们的框架不依赖于影子模型训练（对于大型生成模型通常不可行），而是通过迭代轨迹利用固有信号促进可扩展的推理。该过程利用跨不同模态的链式生成，其中每个输出作为后续输入，以在低误报率下改善成员证据。我们证明，与非成员生成相比，记忆的训练样本在迭代再生过程中表现出显著更高的连贯性和更慢的退化。我们的结果表明，MADreMIA在不同模型家族和模态中提供了更丰富的信号；我们提供了对IAR、扩散和语言模型的全面评估，以及初步结果展示了其在音频模型上的潜力。
英文摘要：
Large generative models are known to memorize their training data, posing severe privacy risks. Yet, current methods to detect training membership typically rely on the weak signals of a single forward pass. In this work, we find that training samples and unseen (held-out) data follow visibly different trajectories under recursive self-generation -- repeatedly feeding a model's output back as its next input. Held-out samples \emph{drift}: they lose the specifics of the original within a few steps. Training samples stay \emph{anchored}, degrading far more slowly. We show that the membership signal this produces holds across model modalities, architectures and scales, spanning language, diffusion, and autoregressive vision models. Furthermore, these recursive trajectories provide a signal that raises membership inference TPR at $1\%$ FPR for nearly every attack we evaluate, roughly doubling it on the weakest baselines and still improving the strongest, which shows that a model's behavior under recursion carries membership evidence that a single query does not.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
