Towards More Realistic Extraction Attacks: An Adversarial Perspective

TL;DR

This paper investigates realistic extraction attacks on language models, revealing that multi-faceted, repeated, and varied prompts significantly increase data extraction risks, even against mitigations, with implications for privacy and copyright.

Contribution

It introduces a comprehensive adversarial perspective considering multiple access points, demonstrating increased extraction risks and outperforming prior methods in realistic scenarios.

Findings

Extraction risks double with combined attacks.

Small prompt changes can significantly alter extraction outcomes.

Mitigation strategies like data deduplication are less effective against advanced attacks.

Abstract

Language models are prone to memorizing their training data, making them vulnerable to extraction attacks. While existing research often examines isolated setups, such as a single model or a fixed prompt, real-world adversaries have a considerably larger attack surface due to access to models across various sizes and checkpoints, and repeated prompting. In this paper, we revisit extraction attacks from an adversarial perspective -- with multi-faceted access to the underlying data. We find significant churn in extraction trends, i.e., even unintuitive changes to the prompt, or targeting smaller models and earlier checkpoints, can extract distinct information. By combining multiple attacks, our adversary doubles ($2 \times$) the extraction risks, persisting even under mitigation strategies like data deduplication. We conclude with four case studies, including detecting pre-training data, copyright violations, extracting personally identifiable information, and attacking closed-source models, showing how our more realistic adversary can outperform existing adversaries in the literature.