R e C a LL : Membership Inference via Relative Conditional Log-Likelihoods (2024)

Abstract: The rapid scaling of large language models (LLMs) has raised concerns about the transparency and fair use of the data used in their pretraining. Detecting such content is challenging due to the scale of the data and limited exposure of each instance during training. We propose ReCaLL (Relative Conditional Log-Likelihood), a novel membership inference attack (MIA) to detect LLMs’ pretraining data by leveraging their conditional language modeling capabilities. ReCaLL examines the relative change in conditional log-likelihoods when prefixing target data points with non-member context. Our empirical findings show that conditioning member data on non-member prefixes induces a larger decrease in log-likelihood compared to non-member data. We conduct comprehensive experiments and show that ReCaLL achieves state-of-the-art performance on the WikiMIA dataset, even with random and synthetic prefixes, and can be further improved using an ensemble approach. Moreover, we conduct an in-depth analysis of LLMs’ behavior with different membership contexts, providing insights into how LLMs leverage membership information for effective inference at both the sequence and token level.

## introduction the amount of pretraining data used to train large language models (llms) has quickly expanded in recent years, comprising of trillions of tokens sourced from a vast array of sources @xcite . while such diversity and volume allow for a comprehensive language understanding, it also raises the concerns of including sensitive or unintended content such as copyrighted materials @xcite , personally identifiable information @xcite , or test data from benchmarks @xcite . additionally, the lack of transparency regarding the composition of pretraining datasets exacerbates these concerns, as many developers are reluctant to disclose full details due to proprietary reasons or the sheer volume of data involved. to address these concerns, many works have proposed to detect pretraining data in llms @xcite @xcite , which involve using membership inference attacks (mias) to infer whether a given data point was part of the training set. the basic mia leverages a simple fact that member data are trained and memorized by the model, which leaves footprints in the model, resulting in higher log-likelihood (ll) than non-member data @xcite . however, the massive scale of pretraining data means that llms are typically trained for only a single epoch, making this problem particularly challenging @xcite , as each instance is only exposed once to the model, leading to limited memorization @xcite . in this work, we propose recall (relative conditional log likelihood), an efficient mia detects llms pretraining data. recall leverages the conditional language modeling capabilities of llms by examining the relative change in conditional lls when prefixing data with non-member context. our key empirical finding, as illustrated in figure 1 , 1 is that conditioning member data on non-member prefix induces a larger decrease in ll compared to conditioning non-member data on other non-members. this observation forms the basis of recall. we leverage a few nonmembers from the target domain to construct the non-member prefix. while this might seem like a limitation, in practice, it is not a hard constraint. for most real-world applications, we can easily obtain non-member data points by selecting recent data that postdates the model's training data or by creating new, synthetic data points @xcite @xcite . one interpretation of this empirical finding comes from prior work on in-context learning (icl), which suggests that it has an effect similar to fine-tuning @xcite . by filling the context with non-members, we are essentially changing the predictive distribution of the language 2 related work membership inference attacks membership inference attacks (mias) aim to determine whether a given data sample was part of a model's training set. it was initially proposed by @xcite and has significant implication in tasks such as measuring memorization and privacy risk @xcite @xcite , serving as basis of advance attacks @xcite , and detection on testset contamination @xcite , copyrighted content @xcite and knowledge cutoff @xcite for llms. research in mia has been explored in natural language domain for both finetuning @xcite @xcite and pretraining settings @xcite @xcite . current llms typically train on the massive data for only a single epoch, which makes mia more challenging compared to the multi-epoch finetuning setting @xcite . ## recall: relative conditional log-likelihood problem definition given that m is an autoregressive language model that outputs a probability distribution over the next token given a prefix, let d be a dataset used to train m . the goal of a membership inference attack is to determine, for a target data point x, whether @xmath0. a membership score s(x; m ) is calculated and thresholded to classify whether x is a member or non-member of the training dataset d. ## experiments and results in this section we conduct comprehensive experiments to demonstrate the effectiveness of recall. ## analysis in this section, we conduct a series of investigations to better understand recall. following @xcite , we focus on the wikimia using the pythia-12b model for our analysis. ## conclusion we introduced recall, a novel mia for detecting pretraining data in llms by leveraging their conditional language modeling capabilities. re-call captures the relative change in conditional log-likelihoods when prefixing target data points with non-member context. through extensive experiments on wikimia and mimir benchmarks, we demonstrated recall's state-of-the-art performance, outperforming existing mia methods on wikimia. we showed that random and synthetic prefixes achieve comparable performance to real non-member data, enhancing recall's practicality. recall consistently outperforms baselines and can be further improved using an ensemble method. our in-depth analysis revealed valuable insights into llms' behavior under different membership contexts. as future work, we plan to investigate the theoretical aspects of recall and explore more efficient mia methods.