Fact · Voice privacy and security
1document
The Carlini et al. extraction attack worked on sequences that appeared in only one document in the training data.
Checked against its source on October 17, 2026
In the source's own words
“Our attack is possible even though each of the above sequences are included in just one document in the training data.”
Extracting Training Data from Large Language Models, Nicholas Carlini et al., 30th USENIX Security Symposium, 2021, Abstract.
Open the original- What it measures
- The authors tested GPT-2, a language model trained on public web text. The sequences that could be recovered included names, phone numbers, email addresses, code and UUIDs.
- What it does not show
- The study is about a large text model from 2019, not a dictation model. It shows that a rare item in training data can be recovered, not how often this happens in a given product.