Membership inference attacks (MIAs) attempt to predict whether a particular datapoint is a member of a target model's training data. Despite extensive research on traditional machine learning models, there has been limited work studying MIA on the pre-training data of large language models (LLMs). We perform a large-scale evaluation of MIAs over a suite of language models (LMs) trained on the Pile, ranging from 160M to 12B parameters. We find that MIAs barely outperform random guessing for most settings across varying LLM sizes and domains. Our further analyses reveal that this poor performance can be attributed to (1) the combination of a large dataset and few training iterations, and (2) an inherently fuzzy boundary between members and non-members. We identify specific settings where LLMs have been shown to be vulnerable to membership inference and show that the apparent success in such settings can be attributed to a distribution shift, such as when members and non-members are drawn from the seemingly identical domain but with different temporal ranges. We release our code and data as a unified benchmark package that includes all existing MIAs, supporting future work.

翻译：成员推理攻击（MIAs）试图预测特定数据点是否为目标模型训练数据的成员。尽管在传统机器学习模型上已有广泛研究，但针对大型语言模型（LLM）预训练数据的MIA研究仍然有限。我们对在Pile数据集上训练的一系列语言模型（LM）进行了大规模MIA评估，模型参数规模从1.6亿到120亿不等。研究发现，在大多数设置下，面对不同LLM规模和领域，MIAs的性能仅略优于随机猜测。进一步分析表明，这种低劣性能可归因于：（1）大规模数据集与少量训练迭代的结合；（2）成员与非成员之间天然模糊的边界。我们识别了特定设置下LLM被证实易受成员推理攻击的情况，并表明此类设置中表面上的成功可归因于分布偏移——例如当成员与非成员看似来自相同领域却具有不同时间范围时。我们公开发布了代码与数据，作为包含所有现有MIA方法的统一基准测试包，以支持未来研究。