2024/12/30 by Ruixuan Liu, Toan Tran, Liu, Ruixuan +9 · 1 voice · 1 citation
Computer Science · Social Sciences · #Access Control and Trust #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing #Web Application Security Vulnerabilities #cs.CR
paper · pdf · doi:10.48550/arxiv.2412.21123
openalex publication_date 2024/12/30 · arxiv published 2024/12/30 · openalex created_date 2025/10/10 · arxiv updated 2025/12/16 · openalex updated_date 2026/07/30
As large language models increasingly memorize web-scraped training content, they risk exposing copyrighted or private information. Existing protections require compliance from crawlers or model developers, fundamentally limiting their effectiveness. We propose ExpShield, a proactive self-guard that mitigates memorization while maintaining readability via invisible perturbations, and we formulate it as a constrained optimization problem. Due to the lack of an individual-level risk metric for natural text, we first propose instance exploitation, a metric that measures how much training on a specific text increases the chance of guessing that text from a set of candidates-with zero indicating perfect defense. Directly solving the problem is infeasible for defenders without sufficient knowledge, thus we develop two effective proxy solutions: single-level optimization and synthetic perturbation. To enhance the defense, we reveal and verify the memorization trigger hypothesis, which can help to identify key tokens for memorization. Leveraging this insight, we design targeted perturbations that (i) neutralize inherent trigger tokens to reduce memorization and (ii) introduce artificial trigger tokens to misdirect model memorization. Experiments validate our defense across attacks, model scales, and tasks in language and vision-to-language modeling. Even with privacy backdoor, the Membership Inference Attack (MIA) AUC drops from 0.95 to 0.55 under the defense, and the instance exploitation approaches zero. This suggests that compared to the ideal no-misuse scenario, the risk of exposing a text instance remains nearly unchanged despite its inclusion in the training data.