Extracting Training Data from Large Language Models (Carlini et al.)
Date: 2021-06
Affected: OpenAI GPT-2 (research target; method generalizes to all LLMs)
Attack vector: membership-inference
Category: research
Severity: High

Carlini et al. demonstrated a training-data extraction attack against GPT-2: by probing the model with carefully chosen prefixes, they recovered hundreds of verbatim training examples including personally identifiable information, code, and copyrighted content. The work established membership-inference / training-data extraction as a practical LLM privacy threat.


Mitigations:

Architectural layers (MAESTRO):