TranScope: What the Software Hides About LLM Training Data, the Hardware Reveals at Scale, and Accelerators Magnify
TranScope detects LLM training membership from TLB and accelerator timing without a surrogate model.
A cs.CR paper examines how large language models and vision transformers interact with TLBs, page tables, and on-core accelerators even when inference is constant-time and has no input-dependent branches or early exits. Tokenization during training changes the locality of later vocabulary fetches, so microarchitectural state differs for inputs inside versus outside the training distribution. The authors introduce TranScope, a low-cost membership detector that needs no surrogate model and report about 0.9 AUC compared with 0.6 AUC for previously reported PETAL results. They present the channel both as a copyright-audit signal and as a new membership-inference risk.
- Membership leakage persists in constant-time models without input-dependent branches.
- Training tokenization changes later vocabulary locality and TLB behavior.
- TranScope needs no surrogate model and reports about 0.9 AUC.
- Authors frame hardware as both a copyright check and an MIA channel.
From the original article
1 min read at arxiv.orgMembership is the root privacy primitive in machine learning: to date, no hardware-based out-of-distribution detection on black-box models has been demonstrated against constant-time, static neural networks with masked confidence.
By Joshua Kalyanapu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.