Quantifying Memorization and Detecting Training Data of Pre-trained Language Models using Japanese Newspaper

TL;DR

This paper investigates how Japanese newspaper domain-specific GPT-2 models memorize training data and demonstrates that such models can reveal their training data through membership inference attacks, highlighting privacy concerns.

Contribution

It extends understanding of memorization and data leakage in pre-trained language models to Japanese, showing similar patterns as in English and emphasizing privacy risks.

Findings

Memorization correlates with data duplication, model size, and prompt length.

Membership inference attacks can detect training data in Japanese PLMs.

Japanese PLMs exhibit data copying similar to English models.

Abstract

Dominant pre-trained language models (PLMs) have demonstrated the potential risk of memorizing and outputting the training data. While this concern has been discussed mainly in English, it is also practically important to focus on domain-specific PLMs. In this study, we pre-trained domain-specific GPT-2 models using a limited corpus of Japanese newspaper articles and evaluated their behavior. Experiments replicated the empirical finding that memorization of PLMs is related to the duplication in the training data, model size, and prompt length, in Japanese the same as in previous English studies. Furthermore, we attempted membership inference attacks, demonstrating that the training data can be detected even in Japanese, which is the same trend as in English. The study warns that domain-specific PLMs, sometimes trained with valuable private data, can ''copy and paste'' on a large scale.