Sampling-based Pseudo-Likelihood for Membership Inference Attacks (2025)

Abstract: Large Language Models (LLMs) are trained on large-scale web data, which makes it difficult to grasp the contribution of each text. This poses the risk of leaking inappropriate data such as benchmarks, personal information, and copyrighted texts in the training data. Membership Inference Attacks (MIA), which determine whether a given text is included in the model’s training data, have been attracting attention. Previous studies of MIAs revealed that likelihood-based classification is effective for detecting leaks in LLMs. However, the existing likelihood-based methods cannot be applied to some proprietary models like ChatGPT or Claude 3 because the likelihood for input text is unavailable to the user. In this study, we propose a Sampling-based Pseudo-Likelihood (SPL) method for MIA (SaMIA) that calculates SPL using only the text generated by an LLM to detect leaks. The SaMIA treats the target text as the reference text and multiple outputs from the LLM as text samples, calculates the degree of n -gram match as SPL, and determines the membership of the text in the training data. Even without likelihoods, SaMIA performed on par with existing likelihood-based methods.

## introduction large language models (llms) bring about a game-changing transformation in various services used on a daily basis @xcite . the pre-training of llms relies on massive-scale web data of mixed quality @xcite . while pre-processing such as filtering is applied to construct as clean datasets as possible, it is unrealistic to remove everything undesired @xcite . there is a risk of unintentionally leaking benchmark data, copyrighted * these authors contributed equally to this work. 1 our code is available at: https://github.com/ nlp-titech/samia texts, or personal information into the pre-training data @xcite @xcite . the leakage of benchmark data can lead to an overestimation of llms' capabilities, preventing an appropriate assessment of their true performance @xcite . additionally, llm generation based on copyrighted texts or personal information can result in serious violations of the law @xcite . membership inference attacks (mia) consider the task of determining whether a given target text is included in the training data of a model @xcite . generally, because models are trained to fit the data, a text included in the training data tends to exhibit a higher likelihood compared to ones unseen in the training data @xcite . existing mia studies rely on this idea and thus require the likelihood of a input text computed by the model @xcite @xcite @xcite . it is impossible to apply the existing studies to the models that do not provide a likelihood. when the training data of a model is accessible, it is straightforward to check the membership by directly searching for a given text in the training data @xcite @xcite . therefore, the primary targets for mia are llms without the training data disclosed @xcite @xcite . such llms mostly provide no access to likelihoods, severely limiting the practical applicability of likelihoodbased mia. moreover, as the commercial value of llms is increasing, developers of recent powerful models like chatgpt foot_0 , gemini foot_1 , and claude 3 foot_2 are more reluctant to disclose the details of their training data. in this paper, we propose a sampling-based pseudo likelihood (spl) method for mia (samia) that calculates spl using the match ratio of n-grams between the output texts sampled from an llm and the target text. we provide proof that the match rate of sampled outputs serves as an approximation of likelihood. figure 1 shows the detection of a leaked text using spl, based on the n-gram similarity between text samples and the reference text. providing the initial part of the target text to the llm, samia generates multiple continuations of the text by sampling. treating the generated sequences as candidate texts and the remaining part of the target text (after the given part) as the reference text, we calculate the degree of n-gram overlaps between the candidate texts and the reference text. if the degree of n-gram overlaps exceeds a specified threshold, we regard that the llm has been trained on the text. samia can detect leakage even under settings where the target model is a black box @xcite . we conducted experiments on mia with opt-6.7b @xcite and llama-2-7b @xcite whose training data is publicly available. the experimental results on the wikipedia articles @xcite and book @xcite datasets showed that samia achieves performance comparable to existing methods based on likelihood or loss values. in addition, we introduce a leakage detection method that combines information content and spl, which achieves the highest average score. we also report the analysis results of the impacts of the number n of n-gram, the number of text samples, and the length of the target text on the performance of samia. the performance of samia is highest when using unigrams. we observed the improved performance by increasing the number of text samples and length of the target text. ## analysis this section investigates how each design will affect the performance of samia(*zlib). ## conclusion we propose samia, a pseudo-likelihood-based approach for leakage detection. we have proven that the token distribution of outputs sampled from the model approximates the likelihood. in experiments, samia demonstrated performance comparable to existing likelihood-dependent methods, despite having limited access to information.