从 LoRA 权重中恢复数据集大小

Dataset Size Recovery from LoRA Weights

June 27, 2024

作者: Mohammad Salama, Jonathan Kahana, Eliahu Horwitz, Yedid Hoshen

cs.AI

摘要

模型反演和成员推断攻击的目标是重建和验证模型训练的数据。然而，它们不能保证找到所有训练样本，因为它们不知道训练集的大小。在本文中，我们引入了一个新任务：数据集大小恢复，旨在直接从模型的权重中确定用于训练模型的样本数量。然后，我们提出了DSiRe，一种用于恢复用于微调模型的图像数量的方法，在微调使用LoRA的常见情况下。我们发现LoRA矩阵的范数和频谱与微调数据集大小密切相关；我们利用这一发现提出了一个简单而有效的预测算法。为了评估LoRA权重的数据集大小恢复，我们开发并发布了一个新的基准测试，名为LoRA-WiSE，其中包含来自2000多个不同LoRA微调模型的25000多个权重快照。我们最佳的分类器可以预测微调图像的数量，平均绝对误差为0.36个图像，证实了这种攻击的可行性。

English

Model inversion and membership inference attacks aim to reconstruct and verify the data which a model was trained on. However, they are not guaranteed to find all training samples as they do not know the size of the training set. In this paper, we introduce a new task: dataset size recovery, that aims to determine the number of samples used to train a model, directly from its weights. We then propose DSiRe, a method for recovering the number of images used to fine-tune a model, in the common case where fine-tuning uses LoRA. We discover that both the norm and the spectrum of the LoRA matrices are closely linked to the fine-tuning dataset size; we leverage this finding to propose a simple yet effective prediction algorithm. To evaluate dataset size recovery of LoRA weights, we develop and release a new benchmark, LoRA-WiSE, consisting of over 25000 weight snapshots from more than 2000 diverse LoRA fine-tuned models. Our best classifier can predict the number of fine-tuning images with a mean absolute error of 0.36 images, establishing the feasibility of this attack.