Privacy preserving deep learning is an emerging field in machine learning that aims to mitigate the privacy risks in the use of deep neural networks. One such risk is training data extraction from language models that have been trained on datasets , which contain personal and privacy sensitive information. In our study, we investigate the extent of named entity memorization in fine-tuned BERT models. We use single-label text classification as representative downstream task and employ three different fine-tuning setups in our experiments, including one with Differentially Privacy (DP). We create a large number of text samples from the fine-tuned BERT models utilizing a custom sequential sampling strategy with two prompting strategies. We search in these samples for named entities and check if they are also present in the fine-tuning datasets. We experiment with two benchmark datasets in the domains of emails and blogs. We show that the application of DP has a huge effect on the text generation capabilities of BERT. Furthermore, we show that a fine-tuned BERT does not generate more named entities entities specific to the fine-tuning dataset than a BERT model that is pre-trained only. This suggests that BERT is unlikely to emit personal or privacy sensitive named entities. Overall, our results are important to understand to what extent BERT-based services are prone to training data extraction attacks.

It has become common to publish large (billion parameter) language models that have been trained on private datasets. This paper demonstrates that in such settings, an adversary can perform a training data extraction attack to recover individual training examples by querying the language model. We demonstrate our attack on GPT-2, a language model trained on scrapes of the public Internet, and are able to extract hundreds of verbatim text sequences from the model's training data. These extracted examples include (public) personally identifiable information (names, phone numbers, and email addresses), IRC conversations, code, and 128-bit UUIDs. Our attack is possible even though each of the above sequences are included in just one document in the training data.We comprehensively evaluate our extraction attack to understand the factors that contribute to its success. Worryingly, we find that larger models are more vulnerable than smaller models. We conclude by drawing lessons and discussing possible safeguards for training large language models.

Pre-training large transformer models with in-domain data improves domain adaptation and helps gain performance on the domain-specific downstream tasks. However, sharing models pre-trained on potentially sensitive data is prone to adversarial privacy attacks. In this paper, we asked to which extent we can guarantee privacy of pre-training data and, at the same time, achieve better downstream performance on legal tasks without the need of additional labeled data. We extensively experiment with scalable self-supervised learning of transformer models under the formal paradigm of differential privacy and show that under specific training configurations we can improve downstream performance without sacrifying privacy protection for the in-domain data. Our main contribution is utilizing differential privacy for large-scale pre-training of transformer language models in the legal NLP domain, which, to the best of our knowledge, has not been addressed before.

随着大型预训练的语言模型（例如GPT-2和BERT）的广泛可用性，最近的趋势是微调一个预训练的模型，以在下游任务上实现最新的性能。一个自然的示例是“智能回复”应用程序，其中调整了预训练的模型以为给定的查询消息提供建议的答复。由于这些模型通常是使用敏感数据（例如电子邮件或聊天成绩单）调整的，因此了解和减轻模型泄漏其调整数据的风险很重要。我们研究了典型的智能回复管道中的潜在信息泄漏漏洞，并引入了一种新型的主动提取攻击，该攻击利用包含敏感数据的文本中的规范模式。我们通过实验表明，对手可以提取培训数据中存在的敏感用户信息。我们探讨了潜在的缓解策略，并从经验上证明了差异隐私如何成为这种模式提取攻击的有效防御机制。

This paper describes a testing methodology for quantitatively assessing the risk that rare or unique training-data sequences are unintentionally memorized by generative sequence models-a common type of machine-learning model. Because such models are sometimes trained on sensitive data (e.g., the text of users' private messages), this methodology can benefit privacy by allowing deep-learning practitioners to select means of training that minimize such memorization.In experiments, we show that unintended memorization is a persistent, hard-to-avoid issue that can have serious consequences. Specifically, for models trained without consideration of memorization, we describe new, efficient procedures that can extract unique, secret sequences, such as credit card numbers. We show that our testing strategy is a practical and easy-to-use first line of defense, e.g., by describing its application to quantitatively limit data exposure in Google's Smart Compose, a commercial text-completion neural network trained on millions of users' email messages.

从公共机器学习（ML）模型中泄漏数据是一个越来越重要的领域，因为ML的商业和政府应用可以利用多个数据源，可能包括用户和客户的敏感数据。我们对几个方面的当代进步进行了全面的调查，涵盖了非自愿数据泄漏，这对ML模型很自然，潜在的恶毒泄漏是由隐私攻击引起的，以及目前可用的防御机制。我们专注于推理时间泄漏，这是公开可用模型的最可能场景。我们首先在不同的数据，任务和模型体系结构的背景下讨论什么是泄漏。然后，我们提出了跨非自愿和恶意泄漏的分类法，可用的防御措施，然后进行当前可用的评估指标和应用。我们以杰出的挑战和开放性的问题结束，概述了一些有希望的未来研究方向。

Named entity recognition models (NER), are widely used for identifying named entities (e.g., individuals, locations, and other information) in text documents. Machine learning based NER models are increasingly being applied in privacy-sensitive applications that need automatic and scalable identification of sensitive information to redact text for data sharing. In this paper, we study the setting when NER models are available as a black-box service for identifying sensitive information in user documents and show that these models are vulnerable to membership inference on their training datasets. With updated pre-trained NER models from spaCy, we demonstrate two distinct membership attacks on these models. Our first attack capitalizes on unintended memorization in the NER's underlying neural network, a phenomenon NNs are known to be vulnerable to. Our second attack leverages a timing side-channel to target NER models that maintain vocabularies constructed from the training data. We show that different functional paths of words within the training dataset in contrast to words not previously seen have measurable differences in execution time. Revealing membership status of training samples has clear privacy implications, e.g., in text redaction, sensitive words or phrases to be found and removed, are at risk of being detected in the training dataset. Our experimental evaluation includes the redaction of both password and health data, presenting both security risks and privacy/regulatory issues. This is exacerbated by results that show memorization with only a single phrase. We achieved 70% AUC in our first attack on a text redaction use-case. We also show overwhelming success in the timing attack with 99.23% AUC. Finally we discuss potential mitigation approaches to realize the safe use of NER models in light of the privacy and security implications of membership inference attacks.

Language models are widely deployed to provide automatic text completion services in user products. However, recent research has revealed that language models (especially large ones) bear considerable risk of memorizing private training data, which is then vulnerable to leakage and extraction by adversaries. In this study, we test the efficacy of a range of privacy-preserving techniques to mitigate unintended memorization of sensitive user text, while varying other factors such as model size and adversarial conditions. We test both "heuristic" mitigations (those without formal privacy guarantees) and Differentially Private training, which provides provable levels of privacy at the cost of some model performance. Our experiments show that (with the exception of L2 regularization), heuristic mitigations are largely ineffective in preventing memorization in our test suite, possibly because they make too strong of assumptions about the characteristics that define "sensitive" or "private" text. In contrast, Differential Privacy reliably prevents memorization in our experiments, despite its computational and model-performance costs.

我们提出了一种新颖的基准和相关的评估指标，用于评估文本匿名方法的性能。文本匿名化定义为编辑文本文档以防止个人信息披露的任务，目前遭受了面向隐私的带注释的文本资源的短缺，因此难以正确评估各种匿名方法提供的隐私保护水平。本文介绍了标签（文本匿名基准），这是一种新的开源注释语料库，以解决此短缺。该语料库包括欧洲人权法院（ECHR）的1,268个英语法院案件，并充满了有关每个文档中出现的个人信息的全面注释，包括其语义类别，标识符类型，机密属性和共同参考关系。与以前的工作相比，TAB语料库旨在超越传统的识别（仅限于检测预定义的语义类别），并且明确标记了这些文本跨越的标记，这些文本应该被掩盖，以掩盖该人的身份受到保护。除了介绍语料库及其注释层外，我们还提出了一套评估指标，这些指标是针对衡量文本匿名性的性能而定制的，无论是在隐私保护和公用事业保护方面。我们通过评估几个基线文本匿名模型的经验性能来说明基准和提议的指标的使用。完整的语料库及其面向隐私的注释准则，评估脚本和基线模型可在以下网址提供：

本次调查绘制了用于分析社交媒体数据的生成方法的研究状态的广泛的全景照片（Sota）。它填补了空白，因为现有的调查文章在其范围内或被约会。我们包括两个重要方面，目前正在挖掘和建模社交媒体的重要性：动态和网络。社会动态对于了解影响影响或疾病的传播，友谊的形成，友谊的形成等，另一方面，可以捕获各种复杂关系，提供额外的洞察力和识别否则将不会被注意的重要模式。

最近的工作证明了从生成语言模型中成功提取培训数据。但是，在文本分类模型中，这种提取是否可行，因为培训目标是预测类标签而不是下一字预测。这提出了一个有趣的挑战，并提出了关于文本分类设置中培训数据隐私的重要问题。因此，我们通过研究与学习任务无关的培训数据的意外记忆的问题来研究文本分类域中的潜在隐私泄漏。我们提出了一种算法，通过利用模型提供的类标签的可能性来提取部分文本的缺失令牌。我们通过将金丝雀插入训练集并试图在训练后提取令牌来测试算法的有效性。在我们的实验中，我们证明了在一定程度上可以成功提取。这也可以用作审计策略，以评估未经同意的任何未经授权使用个人数据的使用。

Transfer learning, where a model is first pre-trained on a data-rich task before being finetuned on a downstream task, has emerged as a powerful technique in natural language processing (NLP). The effectiveness of transfer learning has given rise to a diversity of approaches, methodology, and practice. In this paper, we explore the landscape of transfer learning techniques for NLP by introducing a unified framework that converts all text-based language problems into a text-to-text format. Our systematic study compares pre-training objectives, architectures, unlabeled data sets, transfer approaches, and other factors on dozens of language understanding tasks. By combining the insights from our exploration with scale and our new "Colossal Clean Crawled Corpus", we achieve state-of-the-art results on many benchmarks covering summarization, question answering, text classification, and more. To facilitate future work on transfer learning for NLP, we release our data set, pre-trained models, and code.

分层文本分类包括将文本文档分类为类和子类的层次结构。尽管人造神经网络已经证明有用的是执行这项任务，但遗憾的是，由于培训数据记忆，他们可以将培训数据信息泄漏到对手。在模型培训期间使用差异隐私可以减轻泄漏攻击训练型型号，使模型能够以降低的模型精度安全地共享。这项工作调查了具有差异隐私保证的分层文本分类中的隐私实用权折衷，并识别了提供优越权衡的神经网络架构。为此，我们使用白盒会员推理攻击来凭经验评估三种广泛使用的神经网络架构的信息泄漏。我们表明，大型差异隐私参数已经足以完全减轻隶属度推理攻击，因此仅导致模型实用程序的中等减少。更具体地说，对于具有长文本的大型数据集，我们观察了基于变压器的模型，实现了整体有利的隐私式实用工具权，而对于具有较短文本的较小的数据集是优选的。

近年来，我们看到了处理敏感个人信息的应用程序（包括对话系统）的指数增长。这已经揭示了在虚拟环境中有关个人数据保护的极为重要的问题。首先，性能模型应该能够区分敏感内容与中性句子的句子。其次，它应该能够识别其中包含的个人数据类别的类型。这样，可以考虑每个类别的不同隐私处理。在文献中，如果有关于自动敏感数据识别的作品，则通常在没有共同基准的不同域或语言上进行。为了填补这一空白，在这项工作中，我们介绍了SPEDAC，这是一个新的注释基准，用于识别敏感的个人数据类别。此外，我们提供了对数据集的广泛评估，该数据集使用不同的基准和基于Roberta的分类器进行的，这是一种神经体系结构，在检测敏感句子和个人数据类别的分类方面实现了强大的性能。

差异化（DP）学习在建立大型文本模型方面的成功有限，并尝试直接将差异化私有随机梯度下降（DP-SGD）应用于NLP任务，从而导致了大量的性能下降和高度计算的开销。我们表明，通过（1）使用大型验证模型可以缓解这种性能下降； （2）适合DP优化的超参数； （3）与训练过程对齐的微调目标。通过正确设定这些因素，我们将获得私人NLP模型，以优于最先进的私人培训方法和强大的非私人基准 - 通过直接对中等大小的Corpora进行DP优化的预审计模型。为了解决使用大型变压器运行DP-SGD的计算挑战，我们提出了一种存储器保存技术，该技术允许DP-SGD中的剪辑在不实例化模型中任何层的每个示例梯度的情况下运行。该技术使私人训练变压器的内存成本几乎与非私人培训相同，并以适度的运行时间开销。与传统的观点相反，即DP优化在学习高维模型（由于尺寸缩放的噪声）方面失败的经验结果表明，使用预审预周化模型的私人学习往往不会遭受维度依赖性性能降低的障碍。

最近的数据提取攻击暴露了语言模型可以记住一些培训样本逐字。这是一种漏洞，可以损害模型培训数据的隐私。在这项工作中，我们介绍了子句：私人私人下一象征预测的实用协议，旨在防止在公共语料库预训练后在私人语料库中进行微调的语言模型的隐私违规。我们展示子子句通过放松差异私密预测，限制了私人语料库中的任何单独用户所唯一的信息的泄漏。重要的是，子提M允许一个紧张，数据相关的隐私会计机制，它允许它挫败现有的数据提取攻击，同时保持语言模型的效用。子句是即使在公开释放由大型变压器的模型等基于GPT-2的基于大型变换器的模型制作的数千个下一令牌预测，也是第一个维护隐私的协议。

隐私保护是联合学习中的一个重要和有关的主题，特别是对于自然语言处理。在客户端设备中，用户每天由用户产生大量包含个人信息的文本。由于来自用户信息的直接应用可能会引起个人隐私，因此在联合学习中提出了许多方法来阻止来自客户端设备中的原始信息的中心模型。在本文中，我们尝试通过在保留语义时扭曲文本来更新语言。在实践中，我们利用最近提出的公制，邻近分布分配，以评估失真期间的语义保存。基于度量标准，我们提出了两个用于语义保存的失真，生成的一个和替代的框架。由于目前的自然语言处理领域中缺乏隐私相关任务，我们对命名实体识别和选区解析进行实验。我们的实验结果表明了我们扭曲的合理性和效率，作为个人隐私保护的方法。

大型语言模型被显示为记住隐私信息，例如培训数据中的社会保险号。鉴于培训语料库的巨大规模，筛选和自动筛选和过滤这些隐私数据是一项挑战。在本文中，我们提出了秘密编辑的培训（CRT），这是一种培训语言生成模型的方法，同时保护机密细分市场。我们从差异隐私（解决一个相关但独特的问题）中借鉴了想法，并表明我们的方法能够通过随机将培训过程的部分随机化来防止意外的记忆。此外，我们证明了通过近似正确的筛选策略进行修复会放大机密性保证。我们实施LSTM和GPT语言模型的方法。我们的实验结果表明，通过CRT训练的模型获得了几乎相同的困惑，同时保持了强大的机密性。

本教程展示了工作流程，将文本数据纳入精算分类和回归任务。主要重点是采用基于变压器模型的方法。平均长度为400个单词的车祸描述的数据集，英语和德语可用，以及具有简短财产保险索赔的数据集用来证明这些技术。案例研究应对与多语言环境和长输入序列有关的挑战。他们还展示了解释模型输出，评估和改善模型性能的方法，通过将模型调整到应用程序领域或特定预测任务。最后，该教程提供了在没有或仅有少数标记数据的情况下处理分类任务的实用方法。通过使用最少的预处理和微调的现成自然语言处理（NLP）模型的语言理解技能（NLP）模型实现的结果清楚地证明了用于实际应用的转移学习能力。

聊天机器人用于许多应用程序中，例如自动化代理，智能家庭助理，在线游戏中的互动角色等。因此，确保他们不会以不希望的方式行事，对用户提供令人反感或有毒的反应。这并不是一项琐碎的任务，因为最先进的聊天机器人模型是在从互联网公开收集的大型公共数据集上培训的。本文提出了对聊天机器人中毒性的首次大规模测量。我们表明，公开可用的聊天机器人很容易在喂养有毒的查询时提供有毒的反应。更令人担忧的是，一些无毒的查询也会触发有毒反应。然后，我们着手设计和实验攻击，即毒性，该攻击依赖于微调的GPT-2来产生无毒的查询，使聊天机器人以有毒的方式做出反应。我们广泛的实验评估表明，我们的攻击对公共聊天机器人模型有效，并且优于先前工作提出的手动制作的恶意查询。我们还评估了针对毒性的三种防御机制，表明它们要么以影响聊天机器人的效用而降低攻击性能，要么仅有效地减轻了一部分攻击。这强调了对计算机安全和在线安全社区进行更多研究的需求，以确保聊天机器人模型不会伤害其用户。总体而言，我们有信心有毒可以用作审计工具，我们的工作将为设计更有效的聊天机器人安全防御措施铺平道路。