Repository logo
  • Log In
    Log in via Symplectic to deposit your publication(s).
Repository logo
  • About
  • Communities & Collections
  • Advanced Search
  • Statistics
  • Log In
    Log in via Symplectic to deposit your publication(s).
  1. Home
  2. Faculty of Engineering
  3. Computing
  4. Computing
  5. Did the neurons read your book? Document-level membership inference for large language models
 
  • Details
Did the neurons read your book? Document-level membership inference for large language models
File(s)
usenixsecurity24-meeus.pdf (947.33 KB)
Published version
Author(s)
Meeus, M
Jain, S
Rei, M
de Montjoye, YA
Type
Conference Paper
Abstract
With large language models (LLMs) poised to become embedded in our daily lives, questions are starting to be raised about the data they learned from. These questions range from potential bias or misinformation LLMs could retain from their training data to questions of copyright and fair use of human-generated text. However, while these questions emerge, developers of the recent state-of-the-art LLMs become increasingly reluctant to disclose details on their training corpus. We here introduce the task of document-level membership inference for real-world LLMs, i.e. inferring whether the LLM has seen a given document during training or not. First, we propose a procedure for the development and evaluation of document-level membership inference for LLMs by leveraging commonly used data sources for training and the model release date. We then propose a practical, black-box method to predict document-level membership and instantiate it on OpenLLaMA-7B with both books and academic papers. We show our methodology to perform very well, reaching an AUC of 0.856 for books and 0.678 for papers (Fig. 1). We then show our approach to outperform the sentence-level membership inference attacks used in the privacy literature for the document-level membership task. We further evaluate whether smaller models might be less sensitive to document-level inference and show OpenLLaMA-3B to be approximately as sensitive as OpenLLaMA-7B to our approach. Finally, we consider two mitigation strategies and find the AUC to slowly decrease when only partial documents are considered but to remain fairly high when the model precision is reduced. Taken together, our results show that accurate document-level membership can be inferred for LLMs, increasing the transparency of technology poised to change our lives.
Date Issued
2024
Date Acceptance
2024-08-14
Citation
Proceedings of the 33rd USENIX Security Symposium, 2024, pp.2369-2385
URI
http://hdl.handle.net/10044/1/116093
URL
https://www.usenix.org/conference/usenixsecurity24/presentation/meeus
ISBN
978-1-939133-44-1
Publisher
USENIX
Start Page
2369
End Page
2385
Journal / Book Title
Proceedings of the 33rd USENIX Security Symposium
Copyright Statement
Copyright to this work is retained by
the author[s].
Identifier
https://www.usenix.org/conference/usenixsecurity24/presentation/meeus
Source
33rd USENIX Security Symposium
Publication Status
Published
Start Date
2024-08-14
Finish Date
2024-08-16
Coverage Spatial
Philadelphia, PA, USA
Date Publish Online
2024-08
About
Spiral Depositing with Spiral Publishing with Spiral Symplectic
Contact us
Open access team Report an issue
Other Services
Scholarly Communications Library Services
logo

Imperial College London

South Kensington Campus

London SW7 2AZ, UK

tel: +44 (0)20 7589 5111

Accessibility Modern slavery statement Cookie Policy

Built with DSpace-CRIS software - Extension maintained and optimized by 4Science

  • Cookie settings
  • Privacy policy
  • End User Agreement
  • Send Feedback