leakit 0.1.0__py3-none-any.whl

leakit/__init__.py

@@ -0,0 +1,21 @@
+"""leakit: continuation-free membership inference for closed language models.
+
+Public API:
+    LeakIt        - high-level scorer over any OpenAI-compatible endpoint
+    ScoreResult   - per-document result
+    self_concentration_word_jaccard / self_concentration_kgram - raw statistics
+"""
+
+from ._stats import self_concentration_kgram, self_concentration_word_jaccard
+from .core import LeakIt, ScoreResult, percentile_of
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "LeakIt",
+    "ScoreResult",
+    "percentile_of",
+    "self_concentration_word_jaccard",
+    "self_concentration_kgram",
+    "__version__",
+]

leakit/_stats.py

@@ -0,0 +1,69 @@
+"""Self-concentration statistics for continuation-free membership inference.
+
+These are the membership signals defined in the paper. The statistic operates
+purely on a set of sampled continuations: it never sees a gold continuation and
+needs no model internals. Higher values indicate a more concentrated sampling
+distribution, which the paper shows is predictive of training-set membership.
+
+Pure Python, no third-party dependencies, so the package stays lightweight.
+"""
+
+from __future__ import annotations
+
+from itertools import combinations
+
+
+def _word_set(text: str) -> set[str]:
+    return set(text.split())
+
+
+def _kgram_set(text: str, k: int) -> set[str]:
+    if len(text) < k:
+        return set()
+    return {text[i : i + k] for i in range(len(text) - k + 1)}
+
+
+def _mean_pairwise_jaccard(sets: list[set[str]]) -> float:
+    if len(sets) < 2:
+        return 0.0
+    total = 0.0
+    pairs = 0
+    for a, b in combinations(sets, 2):
+        union = a | b
+        if not union:
+            continue
+        total += len(a & b) / len(union)
+        pairs += 1
+    return total / pairs if pairs else 0.0
+
+
+def self_concentration_word_jaccard(completions: list[str]) -> float:
+    """Parameter-free self-concentration: mean pairwise word-set Jaccard.
+
+    Each completion is reduced to its set of whitespace-delimited tokens, and we
+    average the Jaccard similarity across all unordered pairs. This is the
+    headline statistic in the paper (no n-gram size to tune).
+    """
+    return _mean_pairwise_jaccard([_word_set(c) for c in completions])
+
+
+def self_concentration_kgram(completions: list[str], k: int = 5) -> float:
+    """Self-concentration over character k-grams: mean pairwise k-gram Jaccard."""
+    return _mean_pairwise_jaccard([_kgram_set(c, k) for c in completions])
+
+
+STATISTICS = {
+    "word-jaccard": lambda completions, k: self_concentration_word_jaccard(completions),
+    "kgram": self_concentration_kgram,
+}
+
+
+def compute(completions: list[str], statistic: str = "word-jaccard", k: int = 5) -> float:
+    """Dispatch to the named statistic. Raises ValueError on unknown names."""
+    try:
+        fn = STATISTICS[statistic]
+    except KeyError:
+        raise ValueError(
+            f"unknown statistic {statistic!r}; choose from {sorted(STATISTICS)}"
+        ) from None
+    return fn(completions, k)

leakit/cli.py

@@ -0,0 +1,175 @@
+"""Command-line interface for leakit."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__, _stats
+from .core import LeakIt, ScoreResult, percentile_of
+
+_EPILOG = """\
+examples:
+  # score a file against an OpenAI model (reads LEAKIT_API_KEY or OPENAI_API_KEY)
+  leakit --model gpt-4o-mini suspect.txt
+
+  # probe a model served behind any OpenAI-compatible endpoint
+  leakit --model anthropic/claude-3.5-sonnet \\
+         --base-url https://openrouter.ai/api/v1 \\
+         --api-key-env OPENROUTER_API_KEY \\
+         -n 32 suspect.txt
+
+  # compare a candidate against a baseline of known non-member documents
+  leakit --model gpt-4o-mini --calibrate known_clean/*.txt suspect.txt
+
+  # pipe text in
+  cat article.txt | leakit --model gpt-4o-mini
+
+A higher self-concentration score means the model's continuations agree more,
+which the paper shows correlates with training-set membership. The absolute
+scale is model-dependent; use --calibrate (or score several documents together)
+to interpret a score relatively.
+"""
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        prog="leakit",
+        description="Continuation-free membership inference on closed language models.",
+        epilog=_EPILOG,
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    p.add_argument("documents", nargs="*", help="document file(s) to score; omit to read stdin")
+    p.add_argument("--text", action="append", default=[], metavar="STR",
+                   help="inline document text (repeatable)")
+    p.add_argument("--model", required=True, help="model id passed to the API")
+    p.add_argument("--base-url", default=None,
+                   help="OpenAI-compatible base URL (default: OpenAI)")
+    p.add_argument("--api-key-env", default=None, metavar="VAR",
+                   help="env var holding the API key (default: LEAKIT_API_KEY then OPENAI_API_KEY)")
+    p.add_argument("-n", "--samples", type=int, default=16,
+                   help="number of sampled continuations per document (default: 16)")
+    p.add_argument("--max-tokens", type=int, default=64,
+                   help="tokens generated per continuation (default: 64)")
+    p.add_argument("--temperature", type=float, default=1.0, help="sampling temperature (default: 1.0)")
+    p.add_argument("--top-p", type=float, default=1.0, help="nucleus sampling top-p (default: 1.0)")
+    p.add_argument("--prefix-chars", type=int, default=256,
+                   help="chars of each document used as the conditioning prefix; 0 = whole document (default: 256)")
+    p.add_argument("--statistic", choices=sorted(_stats.STATISTICS), default="word-jaccard",
+                   help="self-concentration statistic (default: word-jaccard)")
+    p.add_argument("--k", type=int, default=5, help="k for the kgram statistic (default: 5)")
+    p.add_argument("--mode", choices=("chat", "completion"), default="chat",
+                   help="API surface: chat for instruct/closed APIs (default), completion for base models")
+    p.add_argument("--concurrency", type=int, default=8, help="parallel requests (default: 8)")
+    p.add_argument("--n-per-request", type=int, default=1,
+                   help="continuations per API call via the provider's n param (default: 1)")
+    p.add_argument("--calibrate", default=None, metavar="GLOB",
+                   help="glob (quote it) or comma-separated path(s) of known NON-member documents; "
+                        "report each candidate's percentile vs this baseline")
+    p.add_argument("--json", action="store_true", help="emit JSON instead of a table")
+    p.add_argument("--show-completions", action="store_true",
+                   help="include raw completions in JSON output")
+    p.add_argument("--version", action="version", version=f"leakit {__version__}")
+    return p
+
+
+def _read_documents(args) -> list[tuple[str, str]]:
+    """Return (id, text) pairs from files, --text, or stdin."""
+    docs: list[tuple[str, str]] = []
+    for path in args.documents:
+        text = Path(path).read_text(encoding="utf-8", errors="replace")
+        docs.append((path, text))
+    for i, t in enumerate(args.text):
+        docs.append((f"--text[{i}]", t))
+    if not docs and not sys.stdin.isatty():
+        data = sys.stdin.read()
+        if data.strip():
+            docs.append(("<stdin>", data))
+    return docs
+
+
+def _make_scorer(args) -> LeakIt:
+    return LeakIt(
+        model=args.model,
+        base_url=args.base_url,
+        api_key_env=args.api_key_env,
+        n_samples=args.samples,
+        max_tokens=args.max_tokens,
+        temperature=args.temperature,
+        top_p=args.top_p,
+        mode=args.mode,
+        concurrency=args.concurrency,
+        n_per_request=args.n_per_request,
+        statistic=args.statistic,
+        k=args.k,
+        prefix_chars=args.prefix_chars,
+    )
+
+
+def _print_table(results: list[ScoreResult], percentiles: dict[str, float] | None) -> None:
+    name_w = max([len(r.document_id) for r in results] + [8])
+    header = f"{'document':<{name_w}}  {'score':>7}  {'samples':>7}"
+    if percentiles is not None:
+        header += f"  {'pctile':>7}"
+    print(header)
+    print("-" * len(header))
+    for r in results:
+        line = f"{r.document_id:<{name_w}}  {r.score:>7.4f}  {r.n_returned:>3}/{r.n_requested:<3}"
+        if percentiles is not None:
+            pv = percentiles.get(r.document_id, float("nan"))
+            line += f"  {pv:>6.1f}%"
+        print(line)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    docs = _read_documents(args)
+    if not docs:
+        print("error: no documents given (pass file paths, --text, or pipe stdin)", file=sys.stderr)
+        return 2
+
+    try:
+        scorer = _make_scorer(args)
+    except (RuntimeError, ValueError) as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 2
+
+    results = [scorer.score(text, document_id=doc_id) for doc_id, text in docs]
+
+    percentiles: dict[str, float] | None = None
+    if args.calibrate:
+        import glob
+
+        paths: list[str] = []
+        for pattern in args.calibrate.split(","):
+            paths.extend(sorted(glob.glob(pattern.strip())))
+        if not paths:
+            print(f"error: --calibrate matched no files: {args.calibrate!r}", file=sys.stderr)
+            return 2
+        baseline_scores = [
+            scorer.score(Path(p).read_text(encoding="utf-8", errors="replace"),
+                         document_id=p).score
+            for p in paths
+        ]
+        percentiles = {r.document_id: percentile_of(r.score, baseline_scores) for r in results}
+
+    if args.json:
+        out = [r.as_dict(include_completions=args.show_completions) for r in results]
+        if percentiles is not None:
+            for d in out:
+                d["percentile_vs_baseline"] = percentiles.get(d["document"])
+        print(json.dumps(out, indent=2))
+    else:
+        _print_table(results, percentiles)
+
+    if any(r.n_returned == 0 for r in results):
+        print("warning: some documents returned no completions (check model/endpoint/key)",
+              file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":  # pragma: no cover
+    raise SystemExit(main())

leakit/core.py

@@ -0,0 +1,122 @@
+"""High-level scoring API: prefix extraction, sampling, self-concentration."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from . import _stats
+from .sampler import Sampler, SamplerConfig, resolve_api_key
+
+
+@dataclass
+class ScoreResult:
+    document_id: str
+    score: float
+    n_requested: int
+    n_returned: int
+    statistic: str
+    prefix: str
+    completions: list[str]
+
+    def as_dict(self, include_completions: bool = False) -> dict:
+        d = {
+            "document": self.document_id,
+            "score": self.score,
+            "statistic": self.statistic,
+            "n_requested": self.n_requested,
+            "n_returned": self.n_returned,
+            "prefix_preview": self.prefix[:120],
+        }
+        if include_completions:
+            d["completions"] = self.completions
+        return d
+
+
+def make_prefix(document: str, prefix_chars: int) -> str:
+    """Take the conditioning prefix from the start of the document.
+
+    prefix_chars == 0 means use the whole document. The prefix is what the model
+    conditions on; the rest of the document is never sent (continuation-free).
+    """
+    text = document.strip()
+    if prefix_chars and prefix_chars > 0:
+        return text[:prefix_chars]
+    return text
+
+
+class LeakIt:
+    """Continuation-free membership-inference scorer over an OpenAI-compatible API.
+
+    Example
+    -------
+    >>> scorer = LeakIt(model="gpt-4o-mini")  # reads LEAKIT_API_KEY / OPENAI_API_KEY
+    >>> result = scorer.score("In the beginning the Universe was created.")
+    >>> result.score
+    0.42
+    """
+
+    def __init__(
+        self,
+        model: str,
+        *,
+        base_url: str | None = None,
+        api_key: str | None = None,
+        api_key_env: str | None = None,
+        n_samples: int = 16,
+        max_tokens: int = 64,
+        temperature: float = 1.0,
+        top_p: float = 1.0,
+        mode: str = "chat",
+        concurrency: int = 8,
+        n_per_request: int = 1,
+        statistic: str = "word-jaccard",
+        k: int = 5,
+        prefix_chars: int = 256,
+        client=None,
+    ):
+        if statistic not in _stats.STATISTICS:
+            raise ValueError(
+                f"unknown statistic {statistic!r}; choose from {sorted(_stats.STATISTICS)}"
+            )
+        self.statistic = statistic
+        self.k = k
+        self.prefix_chars = prefix_chars
+        self.n_samples = n_samples
+        key = api_key or resolve_api_key(api_key_env)
+        self.sampler = Sampler(
+            SamplerConfig(
+                model=model,
+                base_url=base_url,
+                n_samples=n_samples,
+                max_tokens=max_tokens,
+                temperature=temperature,
+                top_p=top_p,
+                mode=mode,
+                concurrency=concurrency,
+                n_per_request=n_per_request,
+            ),
+            api_key=key,
+            client=client,
+        )
+
+    def score(self, document: str, document_id: str = "<text>") -> ScoreResult:
+        prefix = make_prefix(document, self.prefix_chars)
+        completions = self.sampler.sample(prefix)
+        value = _stats.compute(completions, self.statistic, self.k)
+        return ScoreResult(
+            document_id=document_id,
+            score=value,
+            n_requested=self.n_samples,
+            n_returned=len(completions),
+            statistic=self.statistic,
+            prefix=prefix,
+            completions=completions,
+        )
+
+
+def percentile_of(value: float, baseline: list[float]) -> float:
+    """Fraction of baseline scores below ``value`` (0-100). Empty baseline -> nan."""
+    if not baseline:
+        return float("nan")
+    below = sum(1 for b in baseline if b < value)
+    return 100.0 * below / len(baseline)

leakit/sampler.py

@@ -0,0 +1,155 @@
+"""Sampling backend built on the OpenAI Python SDK.
+
+Any OpenAI-compatible endpoint works: set ``base_url`` to the provider you are
+probing (OpenAI, Anthropic via its OpenAI-compatible route, OpenRouter, vLLM,
+Together, a local server, ...) and supply the matching API key. The attack only
+needs a sampling endpoint; it never reads logits.
+"""
+
+from __future__ import annotations
+
+import os
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from dataclasses import dataclass, field
+
+# The continuation instruction used in chat mode. Closed chat APIs do not expose
+# a raw text-completion surface, so we ask the model to continue the passage
+# verbatim. Base/text models should use mode="completion" for the unbiased
+# sampling distribution the paper studies.
+_CONTINUE_SYSTEM = (
+    "You continue text. Given the beginning of a passage, write the text that "
+    "most plausibly comes next. Output only the continuation, with no preamble, "
+    "quotation marks, or commentary."
+)
+
+DEFAULT_API_KEY_ENVS = ("LEAKIT_API_KEY", "OPENAI_API_KEY")
+
+
+def resolve_api_key(api_key_env: str | None = None) -> str:
+    """Resolve the API key from the environment.
+
+    If ``api_key_env`` is given, only that variable is consulted. Otherwise the
+    default chain (LEAKIT_API_KEY then OPENAI_API_KEY) is tried.
+    """
+    candidates = (api_key_env,) if api_key_env else DEFAULT_API_KEY_ENVS
+    for name in candidates:
+        if name and os.environ.get(name):
+            return os.environ[name]
+    tried = ", ".join(c for c in candidates if c)
+    raise RuntimeError(
+        f"no API key found in environment (looked at: {tried}). "
+        f"Export your provider key, e.g. `export {candidates[0]}=sk-...`."
+    )
+
+
+@dataclass
+class SamplerConfig:
+    model: str
+    base_url: str | None = None
+    n_samples: int = 16
+    max_tokens: int = 64
+    temperature: float = 1.0
+    top_p: float = 1.0
+    mode: str = "chat"  # "chat" or "completion"
+    concurrency: int = 8
+    n_per_request: int = 1  # set >1 to batch via the provider's `n` param
+    timeout: float = 120.0
+    max_retries: int = 4
+    extra_body: dict = field(default_factory=dict)
+
+
+class Sampler:
+    """Draws continuations of a prefix from an OpenAI-compatible endpoint."""
+
+    def __init__(self, config: SamplerConfig, api_key: str, client=None):
+        self.config = config
+        # `client` is injectable for testing; defaults to a real OpenAI client.
+        if client is None:
+            from openai import OpenAI
+
+            client = OpenAI(
+                api_key=api_key,
+                base_url=config.base_url,
+                timeout=config.timeout,
+                max_retries=0,  # we handle retries/backoff ourselves
+            )
+        self.client = client
+
+    def _request(self, prefix: str, n: int) -> list[str]:
+        """One API call returning up to ``n`` continuations."""
+        cfg = self.config
+        if cfg.mode == "completion":
+            resp = self.client.completions.create(
+                model=cfg.model,
+                prompt=prefix,
+                max_tokens=cfg.max_tokens,
+                temperature=cfg.temperature,
+                top_p=cfg.top_p,
+                n=n,
+                extra_body=cfg.extra_body or None,
+            )
+            return [choice.text or "" for choice in resp.choices]
+        elif cfg.mode == "chat":
+            resp = self.client.chat.completions.create(
+                model=cfg.model,
+                messages=[
+                    {"role": "system", "content": _CONTINUE_SYSTEM},
+                    {"role": "user", "content": prefix},
+                ],
+                max_tokens=cfg.max_tokens,
+                temperature=cfg.temperature,
+                top_p=cfg.top_p,
+                n=n,
+                extra_body=cfg.extra_body or None,
+            )
+            return [(choice.message.content or "") for choice in resp.choices]
+        raise ValueError(f"unknown mode {cfg.mode!r}; use 'chat' or 'completion'")
+
+    def _request_with_retry(self, prefix: str, n: int) -> list[str]:
+        import time
+
+        last_exc: Exception | None = None
+        for attempt in range(self.config.max_retries):
+            try:
+                return self._request(prefix, n)
+            except Exception as exc:  # noqa: BLE001 - provider errors are heterogeneous
+                last_exc = exc
+                if not _is_retryable(exc) or attempt == self.config.max_retries - 1:
+                    break
+                time.sleep(min(2**attempt, 30))
+        raise RuntimeError(f"sampling request failed: {last_exc}") from last_exc
+
+    def sample(self, prefix: str) -> list[str]:
+        """Return up to ``n_samples`` continuations of ``prefix``.
+
+        Requests are batched by ``n_per_request`` and run concurrently. Failed
+        requests are skipped; the returned list may be shorter than n_samples.
+        """
+        cfg = self.config
+        per = max(1, cfg.n_per_request)
+        # Build a list of per-request batch sizes summing to n_samples.
+        batches: list[int] = []
+        remaining = cfg.n_samples
+        while remaining > 0:
+            batches.append(min(per, remaining))
+            remaining -= batches[-1]
+
+        completions: list[str] = []
+        workers = max(1, min(cfg.concurrency, len(batches)))
+        with ThreadPoolExecutor(max_workers=workers) as ex:
+            futures = [ex.submit(self._request_with_retry, prefix, b) for b in batches]
+            for fut in as_completed(futures):
+                try:
+                    completions.extend(fut.result())
+                except Exception:  # noqa: BLE001 - one dead batch shouldn't kill the run
+                    continue
+        return completions
+
+
+def _is_retryable(exc: Exception) -> bool:
+    """Heuristic: retry on rate limits, timeouts, and 5xx; not on 4xx/auth."""
+    status = getattr(exc, "status_code", None)
+    if status is not None:
+        return status == 429 or status >= 500
+    name = type(exc).__name__.lower()
+    return any(tok in name for tok in ("timeout", "connection", "ratelimit", "apierror"))

leakit-0.1.0.dist-info/METADATA

@@ -0,0 +1,136 @@
+Metadata-Version: 2.4
+Name: leakit
+Version: 0.1.0
+Summary: Continuation-free membership inference on closed language models via sample self-concentration
+Project-URL: Homepage, https://github.com/victormaricato/leakit
+Project-URL: Repository, https://github.com/victormaricato/leakit
+Author: Victor Maricato
+License: MIT
+License-File: LICENSE
+Keywords: audit,llm,membership-inference,mia,privacy,security
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Science/Research
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
+Classifier: Topic :: Security
+Requires-Python: >=3.9
+Requires-Dist: openai>=1.40
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# leakit
+
+**Continuation-free membership inference for closed language models.**
+
+`leakit` tells you whether a document was likely in a model's training set using
+nothing but its sampling API. No logits, no log-probabilities, and -- unlike
+prior sampling attacks such as SaMIA -- no need to know the document's true
+continuation. You give it the *opening* of a document; it samples several
+continuations and measures how much they agree with each other. Training
+documents pull the model's continuation distribution toward the memorised text,
+so the samples concentrate; novel documents leave the distribution diffuse.
+
+This is the reference implementation of the *self-concentration* attack from the
+paper *"Leak It: Continuation-Free Membership Inference on Closed Language Models
+via Sample Self-Concentration."*
+
+## Install
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/victormaricato/leakit/main/install.sh | bash
+```
+
+or, directly, with any of:
+
+```bash
+uv tool install leakit       # recommended
+pipx install leakit
+pip install leakit
+```
+
+## Use
+
+`leakit` talks to any **OpenAI-compatible** endpoint. Set the API key for the
+service you are probing -- the key maps to whatever provider `--base-url` points
+at -- then run it.
+
+```bash
+export LEAKIT_API_KEY="sk-..."        # or OPENAI_API_KEY
+
+# OpenAI
+leakit --model gpt-4o-mini suspect.txt
+
+# Anything OpenAI-compatible (OpenRouter, Anthropic compat route, vLLM, Together, local server)
+leakit --model anthropic/claude-3.5-sonnet \
+       --base-url https://openrouter.ai/api/v1 \
+       --api-key-env OPENROUTER_API_KEY \
+       -n 32 suspect.txt
+
+# Compare a candidate against known non-member documents (relative percentile)
+leakit --model gpt-4o-mini --calibrate clean/*.txt suspect.txt
+
+# Pipe text in, get JSON out
+cat article.txt | leakit --model gpt-4o-mini --json
+```
+
+Output:
+
+```
+document     score  samples
+-----------------------------
+suspect.txt  0.4213   32/32
+```
+
+A higher score means the sampled continuations agree more, which correlates with
+membership. The absolute scale is model-dependent, so interpret scores
+*relatively*: score several documents together, or use `--calibrate` with a set
+of documents you know were **not** in training to get a percentile.
+
+### Key options
+
+| Flag | Meaning | Default |
+|------|---------|---------|
+| `--model` | model id passed to the API | required |
+| `--base-url` | OpenAI-compatible endpoint | OpenAI |
+| `--api-key-env` | env var holding the key | `LEAKIT_API_KEY`, then `OPENAI_API_KEY` |
+| `-n, --samples` | continuations per document | 16 |
+| `--max-tokens` | tokens per continuation | 64 |
+| `--temperature` | sampling temperature | 1.0 |
+| `--prefix-chars` | chars of each doc used as the prefix (0 = whole doc) | 256 |
+| `--statistic` | `word-jaccard` (parameter-free) or `kgram` | `word-jaccard` |
+| `--mode` | `chat` (closed APIs) or `completion` (base models) | `chat` |
+| `--calibrate` | non-member baseline file(s) for a percentile | off |
+| `--json` | machine-readable output | off |
+
+For base/text-completion models (e.g. self-hosted Pythia/Llama base), use
+`--mode completion` to sample the raw continuation distribution. For chat/instruct
+models, the default `chat` mode asks the model to continue the passage verbatim.
+
+## Python API
+
+```python
+from leakit import LeakIt
+
+scorer = LeakIt(model="gpt-4o-mini", n_samples=32)   # reads LEAKIT_API_KEY/OPENAI_API_KEY
+result = scorer.score(open("suspect.txt").read())
+print(result.score, result.n_returned)
+```
+
+The raw statistics are exposed too:
+
+```python
+from leakit import self_concentration_word_jaccard
+self_concentration_word_jaccard(["a b c", "a b c", "x y z"])
+```
+
+## Responsible use
+
+`leakit` is a privacy-auditing and red-teaming tool: use it to test models you
+own or are authorised to assess. The self-concentration signal is a statistical
+indicator, not proof of membership; calibrate before drawing conclusions.
+
+## License
+
+MIT.

leakit-0.1.0.dist-info/RECORD

@@ -0,0 +1,10 @@
+leakit/__init__.py,sha256=xEHnjPbdRq5xZQT2PPOlCHmWrUjvjzDszp1E7NXacHI,603
+leakit/_stats.py,sha256=SueTdWUyYPao9S_xuvUGU8ukCZkP6pSxFom5jjB0MdU,2328
+leakit/cli.py,sha256=57hhrYzP92L5Cfwj3fbhuwn1iC1oFoK9WVvBrmEMdSs,7306
+leakit/core.py,sha256=JfFuxuIEcTow-uCXFBIubI2INxhroek5s_zTGnFWhmI,3759
+leakit/sampler.py,sha256=IbcrHFOfoDhVZHLqxh50dJ5b6kNQDofUEvrSJ4wPEho,6097
+leakit-0.1.0.dist-info/METADATA,sha256=ORoyBGMLDNY6O9ZnT73zE9S8cxPY0OJpmlyXQC75t5U,4791
+leakit-0.1.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+leakit-0.1.0.dist-info/entry_points.txt,sha256=x1fRFD6WlDAJCw1yqlp2kf9rGMhm_vactksrA9UY0zQ,43
+leakit-0.1.0.dist-info/licenses/LICENSE,sha256=V5Nv0q1iihujExbX2Yy6kcAta5uLG_DyougMnwJhrKw,1072
+leakit-0.1.0.dist-info/RECORD,,

leakit-0.1.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

leakit-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+leakit = leakit.cli:main

leakit-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Victor Maricato
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.