An Unsupervised Black-Box Membership Inference Attack Method and System Based on Generative Collaborative Learning

Abstract

This invention provides an unsupervised black-box membership reasoning attack method and system based on generative collaborative learning, introducing a generator, a discriminator, and a collaborative framework. Samples are input into multiple heuristic tasks, and task scores for each heuristic task are calculated. The generator aggregates all task scores to generate pseudo-labels for the samples, and filters out noisy samples based on a dynamic threshold. An offset vector between the sample input cue and the output response of a large language model is calculated to represent the internal state of the large language model. This offset vector is used as input to the discriminator, and the discriminator is trained using the pseudo-labels generated by the generator, enabling it to predict the membership probability of samples based on the offset vector. The membership probabilities generated by the discriminator are used as new pseudo-labels for the samples to aid in the generator's training and optimization. Iterative cross-supervised training continues until the discriminator converges. The discriminator trained using this method achieves high-performance membership reasoning under completely black-box and unsupervised conditions.

Description

Technical Field

[0001] This invention relates to the field of privacy and security of large language models and unsupervised machine learning, and in particular to an unsupervised black-box member reasoning attack method and system based on generative collaborative learning. Background Technology

[0002] Large Language Models (LLMs) have demonstrated outstanding performance across multiple domains, primarily due to their powerful generalization capabilities achieved through pre-training on massive datasets, with their parameter count exceeding hundreds of billions (e.g., GPT-3 has surpassed 175 billion parameters). This data-driven training paradigm presents two key challenges: first, training data may contain un-anonymized personal information (such as medical records, social media conversations), copyrighted content, or benchmark datasets; second, models may overfit some samples during training, potentially generating text with high confidence during user interaction, thus indirectly leaking sensitive information. Research indicates that when specific trigger prefixes are input, models like GPT-2 can completely reproduce email addresses and phone numbers from the training data.

[0003] Membership inference attacks (MIA) aim to determine whether a given data sample belongs to the training set of a target model. Essentially, they differentiate the model's behavior towards "seen data" (trained members) and "unseen data" (non-trained members). However, increasingly, model developers are reluctant to disclose the source information of their training corpora to avoid legal and ethical controversies. Therefore, membership inference attacks are widely used to assess the privacy risks of language models.

[0004] Existing methods for attacking member reasoning in large language models mainly include gray-box access methods and prompt-based heuristic methods.

[0005] Gray-box methods assume that the model exhibits a stronger memory of patterns in the trained data, reflected in the probability distribution of the output tokens. Therefore, by calculating the token probabilities of the input sequence, a membership score is obtained, and a threshold is used to classify the tokens as members or non-members. Consequently, they must have access to the model's token-level probability distribution. This makes them unsuitable for completely black-box models, such as commercial large language models like the Claude model and ChatGPT model, which follow an "input prompt → output response" interaction pattern.

[0006] Prompt-based heuristics reveal latent memories through model-generated responses. They design specific task prompts for the model to answer, reflecting the model's memory of the data in its responses, thus inducing the model to expose its memory of the training data and achieve member reasoning. However, they are limited by the high sensitivity of large language models to prompts. For example, adding different prompts to the same prefix (e.g., "Please continue:" vs. "Supplement the following text:") can lead to significant differences in generated results. This sensitivity necessitates repeated adjustments to prompt templates for different models and datasets, greatly increasing deployment costs and posing challenges to stability. Furthermore, the performance of heuristics fluctuates significantly across models or domains. For instance, the DE-COP algorithm performs excellently on book text (BookTection dataset), but its accuracy drops by nearly 30% on academic papers (arXivTection dataset) due to increased text structural complexity. This instability makes existing methods difficult to adapt to diverse practical needs. Summary of the Invention

[0007] In view of this, embodiments of the present invention provide an unsupervised black-box member reasoning attack method and system based on generative collaborative learning, so as to eliminate or improve one or more defects existing in the prior art.

[0008] On the one hand, this invention provides an unsupervised black-box membership reasoning attack method based on generative collaborative learning, the method comprising the following steps:

[0009] The input samples are input into multiple preset heuristic tasks, and the task score of each heuristic task is calculated. The task scores are input into a generator, and the generator aggregates the task scores to obtain the final member score of the input sample. The input samples are filtered based on the final member score and a preset confidence threshold. Corresponding pseudo-labels are generated according to the final member scores of the filtered input samples. The pseudo-labels include training members and non-training members.

[0010] The filtered input samples are input into a large language model to generate an output response; the offset vector between the input samples and the output response is calculated based on the pre-trained encoder.

[0011] The discriminator is trained using the offset vector and the pseudo-labels generated by the generator, enabling the discriminator to predict the member probability of the input sample based on the offset vector. The member probability generated by the discriminator is used as a new pseudo-label for the input sample to optimize the generator. Cross-supervised training of the generator and the discriminator is performed iteratively until the discriminator converges. The trained discriminator is used as the final member inference attack model.

[0012] The sample to be detected is input into the large language model to generate the output response of the sample to be detected; an offset vector between the sample to be detected and its output response is generated based on the pre-trained encoder; the offset vector is input into the member inference attack model to generate the member probability of the sample to be detected, so as to determine whether the sample to be detected is a training member.

[0013] In some embodiments of the present invention, after calculating the task scores of each heuristic task, the method further includes:

[0014] The task scores are then normalized using the following formula:

[0015]

[0016] Among them, s i s represents the task score of the i-th heuristic task; i ′ This represents the normalized score of the i-th heuristic task.

[0017] In some embodiments of the present invention, the generator aggregates the scores of each task to obtain the final member score of the input sample, including:

[0018] The weighted sum of the normalized task scores yields the final member score of the input sample, calculated as follows:

[0019]

[0020] Among them, s member This represents the final membership score of the input sample; w i s represents the weight of the i-th heuristic task; i ′ Let represent the normalized task score of the i-th heuristic task, and N represent the total number of heuristic tasks.

[0021] In some embodiments of the present invention, the input samples are filtered based on the final member score and a preset confidence threshold, including:

[0022] Calculate the distribution of the final member scores; based on the distribution of the final member scores and the preset confidence threshold, calculate the dynamic member threshold and non-member threshold using the inverse cumulative distribution function, as follows:

[0023] θ member =F -1 (1-α);

[0024] θ non-member =F -1 (α);

[0025] Where, θ member Represents the member threshold; θ non-member F represents the non-member threshold; -1 (·) represents the inverse cumulative distribution function; α represents the preset confidence threshold;

[0026] The input samples are selected from the proportion of the preset confidence threshold that is the highest final member score and is greater than or equal to the member threshold, and the lowest final member score and is less than or equal to the non-member threshold.

[0027] In some embodiments of the present invention, generating corresponding pseudo-labels based on the final member scores of the filtered input samples includes:

[0028]

[0029] in, This refers to the pseudo-label; s member θ represents the final membership score of the input sample; member Represents the member threshold; θ non-member This represents the non-member threshold.

[0030] In some embodiments of the present invention, calculating the offset vector between the input sample and the output response based on a pre-trained encoder includes:

[0031] Based on the pre-trained encoder, embedding vectors of the input samples and the output response are generated, and the offset vector between the input sample embedding vector and the output response embedding vector is calculated. The offset vector is defined according to the following formula:

[0032] Δe = e(y) - e(x);

[0033] Where Δe represents the offset vector; e(x) represents the embedding representation of the input sample x; and e(y) represents the embedding representation of the output response y.

[0034] The training set of the discriminator is constructed based on the offset vector and the corresponding pseudo-label. The training set is defined according to the following formula:

[0035]

[0036] in, The discriminator The training set; Δe represents the offset vector; This refers to the pseudo-label.

[0037] In some embodiments of the present invention, training the discriminator using the offset vector and the pseudo-labels generated by the generator further includes:

[0038] The discriminator is trained by constructing a binary cross-entropy loss between the member probabilities generated by the discriminator and the pseudo-labels generated by the generator, with the goal of minimizing the binary cross-entropy loss.

[0039] The formula for the binary cross-entropy loss is:

[0040]

[0041] in, The discriminator The binary cross-entropy loss; I(·) represents the indicator function; The pseudo-label represents the i-th input sample; N represents the total number of input samples; This represents the member probability predicted by the discriminator for the i-th input sample.

[0042] In some embodiments of the present invention, before inputting the input sample into the generator, the method further includes:

[0043] Initialize the weights of each heuristic task in the generator;

[0044] The heuristic tasks include at least multiple choice, name completion, self-checking, output consistency, and recall continuation.

[0045] In some embodiments of the present invention, the member probabilities generated by the discriminator are used as new pseudo-labels for the input samples, including:

[0046] Calculate the distribution of the member probabilities; based on the distribution of the member probabilities and a preset confidence threshold, calculate a dynamic threshold using the inverse cumulative distribution function to filter out high-confidence input samples;

[0047] The filtered input samples are then used to train the generator, and the member probabilities generated by the discriminator are used as new pseudo-labels.

[0048] On the other hand, the present invention also provides an unsupervised black-box member reasoning attack system based on generative collaborative learning, characterized in that the system, when executed, implements the steps of any of the methods mentioned above.

[0049] This invention provides an unsupervised black-box membership inference attack method and system based on generative collaborative learning, comprising: inputting samples into multiple heuristic tasks, calculating the task scores of each heuristic task, and then using a generator to aggregate all task scores to generate sample pseudo-labels, capturing model memory features from different dimensions without relying on any annotation information. The generated pseudo-labels are filtered, retaining only samples with high confidence at both ends and discarding noisy samples in the middle to improve sample quality and ensure the robustness of the model in complex scenarios. A pre-trained encoder is used to quantize the offset vector between the sample input prompt and the output response to obtain the internal state of the large language model, replacing the word probability distribution information in traditional gray-box methods to overcome the black-box limitation. The discriminator takes the offset vector as input and is trained based on the pseudo-labels generated by the generator, enabling the discriminator to predict the membership probability of samples based on the offset vector. During training, the generator provides pseudo-labels for the discriminator's training, and the membership probabilities generated by the discriminator serve as new pseudo-labels for the samples to help the generator optimize. The two are iteratively optimized through a cross-supervision mechanism until the discriminator converges. Based on the discriminator trained, high-performance membership reasoning can be achieved under completely black-box and unsupervised conditions, promoting the practical development of privacy and security technologies for large language models.

[0050] Additional advantages, objects, and features of the invention will be set forth in part in the description which follows, and will also become apparent in part to those skilled in the art upon studying the description, or may be learned by practice of the invention. The objects and other advantages of the invention can be realized and obtained by means of the structures specifically pointed out in the description and drawings.

[0051] Those skilled in the art will understand that the objectives and advantages achievable with the present invention are not limited to those specifically described above, and that the above and other objectives achievable with the present invention will become clearer from the following detailed description. Attached Figure Description

[0052] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, are not intended to limit the scope of the invention. In the drawings:

[0053] Figure 1 This is a schematic diagram illustrating the steps of an unsupervised black-box member inference attack method based on generative collaborative learning in one embodiment of the present invention.

[0054] Figure 2 This is an overall framework diagram of an unsupervised black-box member reasoning attack method based on generative collaborative learning in one embodiment of the present invention. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and descriptions of this invention are used to explain the invention, but are not intended to limit the invention.

[0056] It should also be noted that, in order to avoid obscuring the invention with unnecessary details, only the structures and / or processing steps closely related to the solution according to the invention are shown in the accompanying drawings, while other details that are not closely related to the invention are omitted.

[0057] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0058] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0059] In the following description, embodiments of the invention will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0060] It should be emphasized here that the step markers mentioned below are not a limitation on the order of the steps, but should be understood as meaning that the steps can be executed in the order mentioned in the embodiments, or in a different order than in the embodiments, or several steps can be executed simultaneously.

[0061] To address the shortcomings of existing large language model membership inference attack methods, such as gray-box methods relying on the model's internal lexical probability distribution (making them unsuitable for completely black-box models) and prompt-based heuristic methods being limited by prompt sensitivity, poor generalization ability, large performance fluctuations, and difficulty in stably adapting to different models and datasets, this invention proposes an unsupervised black-box membership inference attack method based on generative cooperative learning (GCL-UMIA). Through interactive collaboration between heuristic and discriminative tasks, it achieves automated membership inference attacks without relying on any labeled data. Figure 1 As shown, the method includes the following steps S101 to S104:

[0062] Step S101: Input the input samples into multiple preset heuristic tasks, and calculate the task score for each heuristic task; input the task scores into a generator, and aggregate the task scores to obtain the final member score of the input samples; filter the input samples based on the final member score and a preset confidence threshold; generate corresponding pseudo-labels based on the final member scores of the filtered input samples. The pseudo-labels include trained members and non-trained members.

[0063] Step S102: Input the filtered input samples into the large language model to generate the output response; calculate the offset vector between the input samples and the output response based on the pre-trained encoder.

[0064] Step S103: Train the discriminator using the offset vector and the pseudo-labels generated by the generator, so that the discriminator can predict the member probability of the input sample based on the offset vector; use the member probability generated by the discriminator as the new pseudo-label of the input sample, and train the generator again using the input sample and its new pseudo-label; iteratively perform cross-supervised training of the generator and the discriminator until the discriminator converges; use the trained discriminator as the final member inference attack model.

[0065] Step S104: Input the sample to be detected into the large language model to generate the output response of the sample to be detected; generate the offset vector between the sample to be detected and its output response based on the pre-trained encoder, input the offset vector into the member inference attack model to generate the member probability of the sample to be detected, so as to determine whether the sample to be detected is a training member.

[0066] like Figure 2 The diagram shows the overall framework of an unsupervised black-box membership inference attack method based on generative co-learning. This framework includes a generator, a discriminator, and a co-learning framework. The generator generates pseudo-labels through several pre-defined heuristic tasks; these pseudo-labels are filtered to remove noise before training the discriminator. The discriminator is trained based on the difference between the input and output embedding vectors and the generated pseudo-labels. The new pseudo-labels generated by the trained discriminator are used to improve the generator. This process is repeated iteratively until a trained discriminator capable of automatically performing membership inference attacks is obtained.

[0067] Specifically, in step S101, the generator is described.

[0068] The goal of the generator is to evaluate whether a given text (i.e., an input sample) belongs to the training members of a specific large language model through multiple heuristic tasks, thereby generating pseudo-labels for the training of the discriminator.

[0069] In some embodiments, five heuristic tasks related to member reasoning attacks are considered to generate pseudo-labels: multiple choice, name completion, self-checking, output consistency, and recall continuation. The scores of each task reflect different aspects of member characteristics.

[0070] Multiple choice: This requires a large language model to select the original text from a given paragraph and its rewritten versions. The model is more likely to correctly answer the samples that appear in its training data.

[0071] Name Fill-in-the-Blank: Proper nouns in the sample are masked, and a large language model is required to predict the masked words. This task can reveal whether the model has memorized specific training content.

[0072] Self-checking: This requires large language models to determine whether a given text belongs to their training dataset, thus enabling the model to assess its familiarity with a given sample.

[0073] Output consistency: The model generates multiple continuations for the same input and calculates the consistency between them. For trained samples, the model tends to generate consistent responses.

[0074] Recall continuation: The samples are divided into prefixes and suffixes. The large language model is required to continue writing from the prefix. The semantic similarity between the continuation and the suffix reflects the model's memory level.

[0075] In some embodiments, during the system cold start phase, the weights of each heuristic task are first initialized. Taking the above embodiment as an example, the generator has five heuristic tasks: multiple choice, name filling, self-check, output consistency, and recall continuation. Based on the reliability verified by existing research, the weight of the multiple choice task is set to 0.6, the weight of the self-check task is set to 0.3, and the weights of the remaining tasks (name filling, output consistency, and recall continuation) are each set to 0.033.

[0076] The input sample is input into multiple preset heuristic tasks, and the task score of the input sample in each heuristic task is calculated. Then, the generator aggregates the task scores to obtain the final member score of the input sample.

[0077] In some embodiments, to facilitate subsequent aggregation of task scores, the task scores are first normalized to a uniform range. The normalization process is shown in formula (1):

[0078]

[0079] Among them, s i s represents the task score of the i-th heuristic task; i ′This represents the normalized score of the i-th heuristic task, ensuring comparability between different tasks.

[0080] Considering that the weights of each task should vary depending on the input samples and the large language model, and in order to enhance the generalization ability and stability of the method, the weights of each heuristic task are regarded as variables affected by the input samples in this invention, and a neural network is designed to calculate the weights of each heuristic task, as shown in formula (2):

[0081] w i =Softmax(W·x+b); (2)

[0082] Among them, w i Let represent the weight of the i-th heuristic task, which is part of the generator's parameters. The initial values ​​are randomly set and can be optimized through subsequent training; W represents the weight matrix; x represents the semantic representation of the input sample; and b represents the bias term. After applying the Softmax function, the weights of each heuristic task are mapped to the [0,1] interval.

[0083] The final member score of the input sample is obtained by weighted aggregation based on the normalized task score and weight, as shown in formula (3):

[0084]

[0085] Among them, s member w represents the final membership score of the input sample. i s represents the weight of the i-th heuristic task; i ′ Let N represent the normalized task score of the i-th heuristic task, and let N represent the total number of heuristic tasks. For example, N = 5.

[0086] To improve the reliability of pseudo-labels and reduce noise, input samples are filtered based on their final member scores and a preset confidence threshold. Reliable input samples are selected for discriminator training. Specifically, a confidence threshold α is preset, and in each iteration, only the top α input samples with the highest and lowest final member scores are selected as reliable training and non-training members for discriminator training.

[0087] Specifically, firstly, the distribution of the final member scores of all input samples is calculated, and then the dynamic member threshold and non-member threshold are calculated using the inverse cumulative distribution function, as shown in formulas (4) and (5) respectively:

[0088] θ member =F -1 (1-α); (4)

[0089] θnon-member =F -1 (α); (5)

[0090] Where, θ member Represents the membership threshold; θ non-member Indicates the non-member threshold; F -1 (·) represents the inverse cumulative distribution function; α represents the preset confidence threshold.

[0091] The final member score is the highest and is greater than or equal to the member threshold (s). member ≥θ member ), and the lowest and less than or equal to the non-membership threshold (s member ≤θ non-member The input samples are the first α proportions. Preferably, α is set to 0.15 or 0.2.

[0092] In some embodiments, a mapping function is introduced to generate corresponding pseudo-labels based on the final member scores of the filtered input samples, as shown in formula (6):

[0093]

[0094] in, Indicates pseudo-tag; s member θ represents the final membership score of the input sample. member Represents the membership threshold; θ non-member This represents the non-member threshold.

[0095] After screening Indicates reliable training members, Indicates reliable non-trained members, Low-confidence samples will be filtered out directly, and the discriminator will be trained using only the input samples corresponding to reliable training members and non-training members.

[0096] In step S102, the input to the discriminator is explained.

[0097] One reason why existing gray-box access-to-membership inference attack methods perform well is that they utilize the output lexical distribution of a large language model as input to the discriminator. These distributions encode fine-grained features reflecting the model's internal state. However, in a black-box setting, only the "input hints" and "output responses" of the large language model can be accessed, not the internal state. To address this issue, this invention proposes obtaining input data from the black-box large language model, specifically using the variations of "input hints" and "output responses" in the embedding space as input to the discriminator. This approach is based on the observation that the "output response" is influenced by both the "input hints" and the internal parameters of the large language model; that is, the offset between the "input hints" and the "output response" indirectly reflects the influence of the large language model's internal state.

[0098] Based on the above analysis, in this invention, the filtered input samples are input into a large language model to generate an output response. Then, based on a pre-trained encoder (such as the BERT model), the embedding vectors of the input samples and the output response are generated, and the offset vector between the input sample embedding vector and the output response embedding vector is calculated. The definition of this offset vector satisfies the following formula (7):

[0099] Δe = e(y) - e(x); (7)

[0100] Where Δe represents the offset vector; e(x) represents the embedding representation of the input sample x; and e(y) represents the embedding representation of the output response y.

[0101] By calculating the offset vector between the input sample and the output response, the discriminator can obtain more accurate and comprehensive input features without relying on the internal state information of a large language model.

[0102] In step S103, the generator and discriminator are cross-supervised training.

[0103] Based on step S101, the generator provides pseudo-labels required for training the discriminator.

[0104] The training set for the discriminator is constructed based on the offset vector calculated by formula (7) and the pseudo-labels generated by the generator. The definition of this training set satisfies the following formula (8):

[0105]

[0106] in, Discriminator The training set; Δe represents the offset vector; This indicates a pseudo-tag.

[0107] The discriminator is a binary classification network. By inputting the training set into the discriminator for prediction, the member probability of each input sample can be obtained.

[0108] The discriminator is trained using a training set. The discriminator takes the offset vector and the pseudo-labels generated by the generator as input and outputs the member probability of each input sample.

[0109] The member probabilities generated by the discriminator are used as new pseudo-labels for the corresponding input samples to optimize the generator.

[0110] In some embodiments, during generator training and optimization, a loss function is constructed between the final member scores and the new pseudo-labels generated by the discriminator. The generator is optimized by minimizing this loss function, i.e., optimizing the weight parameters of each heuristic task. The weight update process enables the generator to adapt to the feature distribution of different samples and the response characteristics of the target model, thereby improving the aggregation effect of the heuristic tasks.

[0111] In some embodiments, consistent with the input sample screening mechanism mentioned above, the distribution of member probabilities for each input sample is calculated. Based on the distribution of member probabilities and a preset confidence threshold, a dynamic threshold is calculated using the inverse cumulative distribution function to screen out new pseudo-labels with high confidence. The new pseudo-labels obtained are then used in the optimization of the generator to filter out pseudo-labels with low confidence.

[0112] In some embodiments, during discriminator training, a binary cross-entropy loss is constructed between the member probabilities generated by the discriminator and the pseudo-labels generated by the generator. The discriminator is trained with the goal of minimizing the binary cross-entropy loss. The binary cross-entropy loss is shown in Equation (9):

[0113]

[0114] in, Discriminator The binary cross-entropy loss; I(·) represents the indicator function; The pseudo-label represents the i-th input sample; N represents the total number of input samples; This represents the member probability predicted by the discriminator for the i-th input sample.

[0115] Based on the training steps described above, the generator and discriminator alternately use each other's generated pseudo-labels for training, iteratively optimizing the pseudo-labels to improve member detection performance. The generator optimizes the weights of the heuristic task to generate more reliable pseudo-labels, while the discriminator utilizes high-quality pseudo-labels to optimize the classification boundary. Iteration continues until the discriminator converges; training stops when the discriminator's AUC score fluctuates by less than 1%. The trained discriminator is then used as the final member inference attack model.

[0116] In step S104, the trained discriminator, i.e., the membership inference attack model, can be directly deployed in a black-box large language model scenario. Automated inference includes the following steps:

[0117] Obtain the sample to be tested, input the sample to be tested into the large language model, and generate the corresponding output response.

[0118] The offset vector between the input representation and the output response of the sample to be detected is generated based on the pre-trained encoder (such as the BERT model).

[0119] The offset vector is input into the member inference attack model to generate the member probability of the sample to be detected. A preset probability threshold is used; for example, the probability threshold is set to 0.5. If the generated member probability is greater than 0.5, the sample to be detected is determined to be a training member; otherwise, it is a non-training member.

[0120] Corresponding to the above method, the present invention also provides an unsupervised black-box member reasoning attack system based on generative collaborative learning, which, when executed, can implement the steps of the unsupervised black-box member reasoning attack method based on generative collaborative learning.

[0121] Corresponding to the above method, the present invention also provides an electronic device including a computer device, the computer device including a processor and a memory, the memory storing computer instructions, the processor executing the computer instructions stored in the memory, and when the computer instructions are executed by the processor, the electronic device performs the steps of the method as described above.

[0122] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned edge computing server deployment method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0123] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this invention are programs or code segments used to perform the desired tasks. The programs or code segments can be stored in a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried in a carrier wave.

[0124] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0125] In this invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0126] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations of the embodiments of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An unsupervised black-box member reasoning attack method based on generative collaborative learning, characterized in that, The method includes the following steps: The input samples are input into multiple preset heuristic tasks, and the task score of each heuristic task is calculated. The task scores are input into a generator, and the generator aggregates the task scores to obtain the final member score of the input sample. The input samples are filtered based on the final member score and a preset confidence threshold. Corresponding pseudo-labels are generated according to the final member scores of the filtered input samples. The pseudo-labels include training members and non-training members. The filtered input samples are input into a large language model to generate an output response; the offset vector between the input samples and the output response is calculated based on the pre-trained encoder. The discriminator is trained using the offset vector and the pseudo-labels generated by the generator, enabling the discriminator to predict the member probability of the input sample based on the offset vector. The member probability generated by the discriminator is used as a new pseudo-label for the input sample to optimize the generator. Cross-supervised training of the generator and the discriminator is performed iteratively until the discriminator converges. The trained discriminator is used as the final member inference attack model. The sample to be detected is input into the large language model to generate the output response of the sample to be detected; an offset vector between the sample to be detected and its output response is generated based on the pre-trained encoder; the offset vector is input into the member inference attack model to generate the member probability of the sample to be detected, so as to determine whether the sample to be detected is a training member.

2. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 1, characterized in that, After calculating the task scores for each heuristic task, the following steps are also included: The task scores are then normalized using the following formula: Among them, s i s represents the task score of the i-th heuristic task; i ′ This represents the normalized score of the i-th heuristic task.

3. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 2, characterized in that, The generator aggregates the scores of each task to obtain the final member score of the input sample, including: The weighted sum of the normalized task scores yields the final member score of the input sample, calculated as follows: Among them, s member This represents the final membership score of the input sample; w i s represents the weight of the i-th heuristic task; i ′ Let represent the normalized task score of the i-th heuristic task, and N represent the total number of heuristic tasks.

4. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 1, characterized in that, The input samples are filtered based on the final member scores and a preset confidence threshold, including: Calculate the distribution of the final member scores; based on the distribution of the final member scores and the preset confidence threshold, calculate the dynamic member threshold and non-member threshold using the inverse cumulative distribution function, as follows: i member =F -1 (1-a); i non-member =F -1 (a); Where, θ member Represents the member threshold; θ non-member F represents the non-member threshold; -1 (·) represents the inverse cumulative distribution function; α represents the preset confidence threshold; The input samples are selected from the proportion of the preset confidence threshold that is the highest final member score and is greater than or equal to the member threshold, and the lowest final member score and is less than or equal to the non-member threshold.

5. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 4, characterized in that, Based on the final member scores of the filtered input samples, corresponding pseudo-labels are generated, including: in, This refers to the pseudo-label; s member θ represents the final membership score of the input sample; member Represents the member threshold; θ non-member This represents the non-member threshold.

6. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 1, characterized in that, The offset vector between the input sample and the output response is calculated based on the pre-trained encoder, including: Based on the pre-trained encoder, embedding vectors of the input samples and the output response are generated, and the offset vector between the input sample embedding vector and the output response embedding vector is calculated. The offset vector is defined according to the following formula: Δe = e(y) - e(x); Where Δe represents the offset vector; e(x) represents the embedding representation of the input sample x; and e(y) represents the embedding representation of the output response y. The training set of the discriminator is constructed based on the offset vector and the corresponding pseudo-label. The training set is defined according to the following formula: in, The discriminator The training set; Δe represents the offset vector; This refers to the pseudo-label.

7. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 1, characterized in that, Training the discriminator using the offset vector and the pseudo-labels generated by the generator further includes: The discriminator is trained by constructing a binary cross-entropy loss between the member probabilities generated by the discriminator and the pseudo-labels generated by the generator, with the goal of minimizing the binary cross-entropy loss. The formula for the binary cross-entropy loss is: in, The discriminator The binary cross-entropy loss; I(·) represents the indicator function; The pseudo-label represents the i-th input sample; N represents the total number of input samples; This represents the member probability predicted by the discriminator for the i-th input sample.

8. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 1, characterized in that, Before inputting the input sample into the generator, it also includes: Initialize the weights of each heuristic task in the generator; The heuristic tasks include at least multiple choice, name completion, self-checking, output consistency, and recall continuation.

9. The unsupervised black-box membership reasoning attack method based on generative collaborative learning according to claim 1, characterized in that, Using the member probabilities generated by the discriminator as new pseudo-labels for the input samples includes: Calculate the distribution of the member probabilities; based on the distribution of the member probabilities and a preset confidence threshold, calculate a dynamic threshold using the inverse cumulative distribution function to filter out high-confidence input samples; The filtered input samples are then used to train the generator, and the member probabilities generated by the discriminator are used as new pseudo-labels.

10. An unsupervised black-box membership inference attack system based on generative collaborative learning, characterized in that, When the system is executed, it implements the steps of the method as described in any one of claims 1 to 9.

Images