PerProb: Indirectly Evaluating Memorization in Large Language Models.
Abstract
The rapid advancement of Large Language Models (LLMs) has been driven by extensive datasets that may contain sensitive information, raising serious privacy concerns. One notable threat is the Membership Inference Attack (MIA), where adversaries infer whether a specific sample was used in model training. However, the true impact of MIA on LLMs remains unclear due to inconsistent findings and the lack of standardized evaluation methods, further complicated by the undisclosed nature of many LLM training sets. To address these limitations, we propose PerProb, a unified, label-free framework for indirectly assessing LLM memorization vulnerabilities. PerProb evaluates changes in perplexity and average log probability between data generated by victim and adversary models, enabling an indirect estimation of training-induced memory. Compared with prior MIA methods that rely on member/non-member labels or internal access, PerProb is independent of model and task, and applicable in both black-box and white-box settings. Through a systematic classification of MIA into four attack patterns, we evaluate PerProb's effectiveness across five datasets, revealing varying memory behaviors and privacy risks among LLMs. Additionally, we assess mitigation strategies, including knowledge distillation, early stopping, and differential privacy, demonstrating their effectiveness in reducing data leakage. Our findings offer a practical and generalizable framework for evaluating and improving LLM privacy. Index Terms-Large language model, Membership inference attack, Privacy-preserving. I. I NTRODUCTION Large Language Models (LLMs) play a critical role in Natural Language Processing (NLP) with wide application [1]-[3]. However, the widespread adoption of LLMs in various applications has raised significant privacy concerns, as these models are trained on extensive datasets that may include sensitive information [4]. Membership Inference Attack (MIA) is one of the most prominent privacy risks, where an adversary attempts to determine whether specific data is part of a model's training set [5]. Such data leakage can lead to severe consequences, including personal privacy violations and intel