Why it matters

Reconstruction is worst-case leak. Understanding shapes defense.

Advertisement

The architecture

Prompt with prefix.

LLM completes with memorized text.

Extract PII, secrets.

Reconstruction attackPrompt prefixattacker probingLLM completesmemorized dataExtractPII / secretsGPT-2/3 shown to regurgitate; frontier models still vulnerable
Reconstruction.
Advertisement

How it works end to end

Carlini 2021: extracted GPT-2 training data.

Includes: emails, addresses, code.

Larger models memorize more.

Defense: dedup + DP + filtering.