Natural Identifiers for Privacy and Data Audits in Large Language Models
This work addresses the practical bottleneck of auditing already-trained LLMs for privacy compliance, which is crucial for real-world deployment but currently infeasible without costly retraining or access to private data.
The paper introduces natural identifiers (NIDs) to enable post-hoc privacy auditing and dataset inference for large language models without requiring retraining or private held-out datasets. NIDs are structured random strings naturally occurring in training data, allowing generation of unlimited canaries and same-distribution held-out data.
Assessing the privacy of large language models (LLMs) presents significant challenges. In particular, most existing methods for auditing differential privacy require the insertion of specially crafted canary data during training, making them impractical for auditing already-trained models without costly retraining. Additionally, dataset inference, which audits whether a suspect dataset was used to train a model, is infeasible without access to a private non-member held-out dataset. Yet, such held-out datasets are often unavailable or difficult to construct for real-world cases since they have to be from the same distribution (IID) as the suspect data. These limitations severely hinder the ability to conduct scalable, post-hoc audits. To enable such audits, this work introduces natural identifiers (NIDs) as a novel solution to the above-mentioned challenges. NIDs are structured random strings, such as cryptographic hashes and shortened URLs, naturally occurring in common LLM training datasets. Their format enables the generation of unlimited additional random strings from the same distribution, which can act as alternative canaries for audits and as same-distribution held-out data for dataset inference. Our evaluation highlights that indeed, using NIDs, we can facilitate post-hoc differential privacy auditing without any retraining and enable dataset inference for any suspect dataset containing NIDs without the need for a private non-member held-out dataset.