## 5 Experimental Results
### Results of the Training Data Extraction Challenge  
Due to the generally low efficiency of membership inference attack methods in this study, it is necessary to balance text quality and diversity during suffix generation to achieve higher extraction accuracy. This balance not only results in a higher overall precision across multiple experiments, providing more options, but also makes it easier for suffix sorting strategies to select the correct training members. The specific hyperparameter choices and their values are shown in Table 10. In consideration of computing power, the number of trials is set to 20. Through the analysis of the results of many different experiments, too much parameter tuning will reduce the diversity of the generated text, and temperature is the most useful parameter to adjust the generated text. In order to achieve a balance between the quality and diversity of the generated text, beam search, top-k, and top-p are combined with temperature, and hyperparameter tuning is performed for each method. The best-performing combination was found by manual hyperparameter search. Secondly, it is important to choose an appropriate suffix sorting strategy. In the tests conducted in this experiment, the differences among various suffix ranking strategies are not particularly significant. Our implemented membership inference attack based on neighborhood comparison and the Zlib entropy-based (\(\times\)Zlib) membership inference attack performs slightly better. Additionally, we reproduce the currently most accurate strategy (dynamic context window + rewarding high-confidence tokens) proposed by [PERSON]. [PERSON] et al. for comparison. As shown in Figure 3, the combination of beam search, temperature, and the Zlib entropy-based (\(\times\)Zlib) membership inference attack achieves the highest accuracy rate of 52.5%, improving the previous highest accuracy by 5.8%. Our implemented combination of beam search, temperature, and neighborhood comparison-based membership inference attack also achieves a high accuracy rate of 52.1%, representing an improvement of 5.4%.  
This paper also compares the runtime of different strategies. As shown in Figure 4, the runtimes of other training data extraction strategies were all within 1 h, showing a significant improvement over previous extraction speeds and greatly enhancing the efficiency of training data extraction. However, the neighborhood comparison-based membership inference attack method we implemented took considerably longer, highlighting a major drawback of this training data extraction approach.  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Hyperparameters** & **Range of Value** & **Step Size** \\ \hline beam-search & [2,6] & 1 \\ top-k & [2,6] & 1 \\ top-p & [0.4,0.9] & 0.05 \\ temperature & [0.4,1.4] & 0.02 \\ \hline \hline \end{tabular}
\end{table}
Table 10: Hyperparameter values.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \(M_{\mathbf{20}p}\) & \(M_{p}\) & \(E_{mia}\) & **Time\_Cost** \\ \hline Loss & 0.604 & 0.501 & 82.947\% & 0.54 h \\ \(\times\)Zlib & 0.604 & 0.503 & 83.278\% & 0.6 h \\ \(\div\)Zlib & 0.604 & 0.495 & 81.954\% & 0.6 h \\ Neighbour comparison & 0.604 & 0.502 & 83.113\% & 12 h \\ High confident & 0.604 & 0.489 & 80.960\% & 0.58 h \\ \hline \hline \end{tabular}
\end{table}
Table 9: Effect of different membership inference attacks.