Contrastive Decoding Diffing: Extracting Finetuning Data from Model Logits

What Happened

Researchers demonstrated that verbatim finetuning data can be extracted from model logits without accessing model weights, using contrastive decoding to amplify token-level divergence between a target model and a reference model. The method recovers training sequences with high fidelity across standard deployment configurations, including cases where only top-k logits or sampled outputs are exposed. The work establishes logit access as a sufficient condition for training data reconstruction, independent of weight exfiltration.

Why It Matters

The prevailing assumption that logit-level access constitutes a lower security boundary than weight access is no longer valid. Any deployment exposing raw logits—logprob APIs, scoring endpoints, distillation services, evaluation harnesses—should now be modeled as equivalent to weight leakage with respect to training data recovery. This directly affects vendors serving proprietary finetuning data: customer instructions, domain corpora, and specialized datasets become recoverable by parties with sustained query access. The operational question shifts from "who has the weights" to "who can observe the distribution." API exposure decisions that previously weighed latency, cost, and abuse now must also weigh reconstruction risk against the sensitivity of the underlying training distribution.

Technical Details

The attack uses contrastive decoding: given target logits from a finetuned model and reference logits from a base or sibling model, the method computes a weighted difference that suppresses shared pretraining priors and amplifies finetuning-specific token preferences. Iterative decoding on this contrastive signal recovers sequences closer to the finetuning corpus than either model's native sampling would produce. Recovery quality degrades with coarser logit exposure—top-k truncation, temperature scaling, and quantization all reduce fidelity—but partial exposure remains sufficient for partial reconstruction. The method requires neither gradient access nor model internals, only repeated query access to comparable logit outputs. Limits appear where reference models are unavailable or where finetuning distributions overlap heavily with pretraining data, reducing the divergence signal the contrastive step depends on.

Operational Impact

Teams exposing raw logits through inference APIs, batch scoring, or distillation endpoints must now treat those surfaces as training data egress channels. Practical mitigations include truncating to top-k, quantizing logits to low-bit precision, or serving only normalized probability distributions with restricted vocabulary. Evaluation and red-team harnesses that log full logit vectors become liability surfaces and require retention limits or aggregation. Distillation-as-a-service offerings face direct exposure, since the customer's reference model plus the vendor's target logits are exactly the inputs the attack requires. Where training data is sensitive, self-hosted deployment with no external logit surface becomes the conservative default, and permissive logit APIs require explicit risk acceptance rather than default enablement.