ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods

2024/06/23 by Roy Xie, Xie, Roy, Junlin Wang +13 · 26 citations
Decision Sciences · #Computation and Language (cs.CL) #Data Quality and Management #FOS: Computer and information sciences #Machine Learning (cs.LG)

paper · pdf · doi:10.48550/arxiv.2406.15968

openalex publication_date 2024/06/23 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

The rapid scaling of large language models (LLMs) has raised concerns about the transparency and fair use of the data used in their pretraining. Detecting such content is challenging due to the scale of the data and limited exposure of each instance during training. We propose ReCaLL (Relative Conditional Log-Likelihood), a novel membership inference attack (MIA) to detect LLMs' pretraining data by leveraging their conditional language modeling capabilities. ReCaLL examines the relative change in conditional log-likelihoods when prefixing target data points with non-member context. Our empirical findings show that conditioning member data on non-member prefixes induces a larger decrease in log-likelihood compared to non-member data. We conduct comprehensive experiments and show that ReCaLL achieves state-of-the-art performance on the WikiMIA dataset, even with random and synthetic prefixes, and can be further improved using an ensemble approach. Moreover, we conduct an in-depth analysis of LLMs' behavior with different membership contexts, providing insights into how LLMs leverage membership information for effective inference at both the sequence and token level.

Cited by

• On the Effectiveness of Membership Inference in Targeted Data Extraction from Large Language Models
• Lost in Modality: Evaluating the Effectiveness of Text-Based Membership Inference Attacks on Large Multimodal Models
• Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks
• Memories Retrieved from Many Paths: A Multi-Prefix Framework for Robust Detection of Training Data Leakage in Large Language Models
• As If We've Met Before: LLMs Exhibit Certainty in Recognizing Seen Files
• GRPO Privacy Is at Risk: A Membership Inference Attack Against Reinforcement Learning With Verifiable Rewards
• REMIND: Input Loss Landscapes Reveal Residual Memorization in Post-Unlearning LLMs
• EL-MIA: Quantifying Membership Inference Risks of Sensitive Entities in LLMs
• Learning to Attack: Uncovering Privacy Risks in Sequential Data Releases
• Fast-MIA: Efficient and Scalable Membership Inference for LLMs
• Machine Text Detectors are Membership Inference Attacks
• Quantifying Information Disclosure During Gradient Descent Using Gradient Uniqueness
• Provable Training Data Identification for Large Language Models
• Detecting Data Contamination from Reinforcement Learning Post-training for Large Language Models
• (Token-Level) InfoRMIA: Stronger Membership Inference and Memorization Assessment for LLMs
• Generalizability of Large Language Model-Based Agents: A Comprehensive Survey
• Beyond Data Privacy: New Privacy Risks for Large Language Models
• AnalogFed: Privacy-Preserving Discovery of Analog Circuits at Scale with Federated Generative AI
• LexiMark: Robust Watermarking via Lexical Substitutions to Enhance Membership Verification of an LLM's Textual Training Data
• SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks
• SHE-LoRA: Selective Homomorphic Encryption for Federated Tuning with Heterogeneous LoRA
• RN-F: A Novel Approach for Mitigating Contaminated Data in Large Language Models
• On Membership Inference Attacks in Knowledge Distillation
• Leak It: A Probabilistic Approach to Training-Data Extraction from Black-Box Language Models
• LLMSurgeon: Diagnosing Data Mixture of Large Language Models
• An Early Experience with Confidential Computing Architecture for On-Device Model Protection

Related

• Con-ReCall: Detecting Pre-training Data in LLMs via Contrastive Decoding
• Context-Aware Membership Inference Attacks against Pre-trained Large Language Models
• Detecting Training Data of Large Language Models via Expectation Maximization
• Do Membership Inference Attacks Work on Large Language Models?
• Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models