Bag of Tricks for Training Data Extraction from Language Models

By Weichen Yu, Tianyu Pang, Qian Liu, Chao Du, Bingyi Kang, Yan Huang, Min Lin, Shuicheng Yan. 2023

95 citations recorded by the source corpus.

With the advance of language models, privacy protection is receiving more attention. Training data extraction is therefore of great importance, as it can serve as a potential tool to assess privacy leakage. However, due to the difficulty of this task, most of the existing methods are proof-of-concept and still not effective enough. In this paper, we investigate and benchmark tricks for improving training data extraction using a publicly available dataset. Because most existing extraction methods use a pipeline of generating-then-ranking, i.e., generating text candidates as potential training data and then ranking them based on specific criteria, our research focuses on the tricks for both text generation (e.g., sampling strategy) and text ranking (e.g., token-level criteria). The experimental results show that several previously overlooked tricks can be crucial to the success of training data extraction. Based on the GPT-Neo 1.3B evaluation results, our proposed tricks outperform the baseline by a large margin in most cases, providing a much stronger baseline for future research. The code is available at https://github.com/weichen-yu/LM-Extraction.

Subfields: Artificial Intelligence, Information Systems, Large Language Models, Privacy & Security

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Large Language Models

In Privacy & Security

Citations in the corpus

Foundation Models and Fair Use (2023, background): “Several works have demonstrated how various factors affect generation of memorized content (Carlini et al., 2019; Lee et al., 2022; Carlini et al., 2022; Kandpal et al., 2022; Carlini et al., 2021; Yu et al., 2023).”
StruQ: Defending Against Prompt Injection with Structured Queries (2024, unknown): “Beyond prompt injection and jail-breaking, researchers have studied other attacks on LLMs, including data extraction [52, 53, 54, 55, 56] and task-specific attacks to decrease the LLM’s performance [13, 57, 14].”
Magpie: Alignment Data Synthesis from Scratch by Prompting Aligned LLMs with Nothing (2024, background): “Yu et al. [60] propose several tricks including adjusting sampling strategies to better extract training datasets from language models.”