TL;DR: Researchers developed Contrastive Decoding Diffing (CDD), a method that recovers verbatim training data from finetuned LLMs using only logit access, highlighting new privacy and IP risks for model builders.
Summary: A new model diffing method called Contrastive Decoding Diffing (CDD) can recover exact finetuning content from LLMs using grey-box logit access without needing weights, activations, or a probe corpus. By comparing logit differences between a base and a finetuned model, CDD reconstructs specific training examples. Unlike previous white-box methods that only retrieve domain-level descriptions, this approach proves that narrow finetuning data can be extracted purely from model outputs.
Why it matters: This exposure of training data means proprietary finetuning datasets can be extracted by anyone with API logit access to the model. Builders should audit their logit exposure and avoid exposing raw logit distributions on APIs hosting sensitive finetuned models.
Source: r/machinelearning