Extracting Training Data from Large Language Models: USENIX

Research question

Can verbatim training data be recovered from a deployed language model?

Key findings

Hundreds of verbatim sequences including names, phone numbers and code were extracted from GPT-2 - Larger models memorise more; sequences seen once can be extracted

Sources

arxiv.orghttps://arxiv.org/abs/2012.07805

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit research Report a correction or request removal

Related in Research Paper Library

SpliTEE: Improving LLM Inference on Trusted Hardware with Differentially Private GPU Outsourcing

User prompts provided to large language models (LLMs) may contain sensitive or private information that can be misused by remotely deployed models, such as through inadvertent memorization during retraining. One way…

Training-data extraction and memorisation2026

Scalable Extraction of Training Data from (Production) Language Models

The divergence attack on ChatGPT, extracting personal information and verbatim text, showing alignment does not protect against memorisation leaks.

Training-data extraction and memorisation2023

Scalable Extraction of Training Data from (Production) Language Models

Shows that aligned production models still leak training data, including through the divergence attack that made ChatGPT emit memorised text after repeating a word, and that alignment hides rather than removes…

Training-data extraction and memorisation2023