Stealing Supervised Fine Tuning Samples: A Data Extraction Attack Driven by Token Modulation and Loss Ratio

Extraction attacks aim to steal Supervised Fine-Tuning (SFT) samples from fine-tuned Large Language Models (LLMs), causing severe compromises of model owners’ core commercial assets and sensitive user privacy. Mainstream attack methods typically induce fine-tuned LLMs to generate multiple candidate samples and then select one as the extracted sample. However, deviations of candidate samples from the SFT sample, together with inaccurate screening from candidates, remain the primary obstacles for current research. Given that pre-trained and fine-tuned models exhibit similar token probability distributions with respect to text style and structure, candidates generated by the fine-tuned model tend to resemble the pre-training corpus in these aspects, deviating from the SFT sample. Moreover, current methods employ semantic similarity as the screening criterion, which solely evaluates semantic equivalence and cannot reflect the varying degrees of data memorization within the model, leading to the mis-selection of the extracted sample. A Token modulation and Cross-model loss ratio-guided SFT sample Extraction Attack method named TCEA is proposed. Candidate samples are generated by decoding the superimposed logits difference between the fine-tuned and pre-trained models, amplifying the fine-tuned features, maximizing similarity between candidates and the SFT sample. Furthermore, the conditional loss ratio of candidate samples between the fine-tuned and pre-trained models is computed, which quantifies the fitting discrepancy to verify the model's memorization of the text. Experimental results demonstrate that TCEA surpasses existing state-of-the-art methods across multi-domain datasets. TCEA provides a quantitative perspective on the fine-tuned model’s memorization of candidates by measuring the fitting discrepancy between fine-tuned and pre-trained models.