Track genomics, neuroscience and molecular biology.
Search papers, labs, and topics across Lattice.
This paper introduces alignment-based defenses to protect large language models (LLMs) from property inference attacks, which can exploit sensitive dataset-level information. By employing post-training alignment techniques, specifically adapting Direct Preference Optimization (DPO) and Group Relative Policy Optimization (GRPO), the authors reshape the model's output distribution without altering the original training data. Experimental results demonstrate that these defenses significantly reduce the risk of property inference while preserving the model's utility, addressing a critical gap in existing defense mechanisms.
Alignment-based defenses can effectively shield LLMs from property inference attacks without requiring access to original training data.
Large language models (LLMs) are increasingly fine-tuned on domain-specific datasets that may contain sensitive, dataset-level properties. Recent work has shown that such dataset-level information can be effectively extracted through property inference attacks, posing a confidentiality risk. Existing defenses against these attacks primarily operate by modifying the training data distribution and hence require access to the original data and retraining the model, limiting their applicability to settings where data is unavailable or models are already deployed. In this work, we propose alignment-based defenses for mitigating property inference attacks in LLMs. Our approach reshapes the model's output distribution towards a target property ratio via post-training alignment, without modifying the training data. In particular, we adapt two widely used RLHF frameworks--Direct Preference Optimization (DPO) and Group Relative Policy Optimization (GRPO)--as our defenses by constructing preference pairs and defining a specific reward function respectively. Through comprehensive experiments, we show that our alignment based defenses effectively mitigate property inference attacks while maintaining a strong utility confidentiality tradeoff.
CMU ML