Papers with MIA
Fast-MIA: Efficient and Scalable Membership Inference for LLMs (2026.acl-demo)
Copied to clipboard
| Challenge: | a library for evaluating membership inference attacks against large language models (LLMs) has emerged as a crucial technique for auditing privacy risks and copyright infringement in LLMs. |
| Approach: | They propose a Python library for efficiently evaluating membership inference attacks against large language models (LLMs) they use a high-throughput batch inference via vLLM and a cross-method caching architecture that computes intermediate results once and shares them across methods. |
| Outcome: | The proposed library performs a 5 speedup in inference and a cross-method caching architecture that computes intermediate results once and shares them across methods. |
CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models (2026.acl-short)
Copied to clipboard
| Challenge: | Membership inference attacks are a canonical way to assess a machine learning model’s privacy properties. |
| Approach: | They propose a framework for principled evaluation of membership inference attacks against large language models by leveraging the insight that training data before and after a fixed point during training are drawn from the same distribution. |
| Outcome: | The proposed framework can be used to evaluate membership inference attacks against large language models. |
DPDLLM: A Black-box Framework for Detecting Pre-training Data from Large Language Models (2024.findings-acl)
Copied to clipboard
Baohang Zhou, Zezhong Wang, Lingzhi Wang, Hongru Wang, Ying Zhang, Kehui Song, Xuhui Sui, Kam-Fai Wong
| Challenge: | Existing methods to detect pretraining data from large language models are unrealistic to them. |
| Approach: | They propose to detect pre-training data from LLM in a black-box way by using GPT-2 as reference model and feed it with sequence probabilities to detect whether it was used to train it. |
| Outcome: | The proposed framework outperforms existing methods on the benchmark datasets and shows that it is effective on different popular LLMs. |
ADePT: Auto-encoder based Differentially Private Text Transformation (2021.eacl-main)
Copied to clipboard
| Challenge: | Differential privacy is an important privacy concern when building statistical models on data containing sensitive information. |
| Approach: | They propose a utility-preserving differentially private text transformation algorithm using auto-encoders that can be used to transform text to offer robustness against attacks and produce transformations with high semantic quality. |
| Outcome: | The proposed model performs better against membership inference attacks while offering lower to no degradation in the utility of the underlying transformation process compared to baselines. |
Scaling Up Membership Inference: When and How Attacks Succeed on Large Language Models (2025.findings-naacl)
Copied to clipboard
| Challenge: | Membership inference attacks (MIAs) attempt to verify the membership of a data sample in the training set for a model. |
| Approach: | They propose to use membership inference attacks to verify the membership of a given data sample in a model training set. |
| Outcome: | The proposed methods are based on a new benchmark that measures the performance of membership inference attacks on large language models at a continuous scale. |
Does Data Contamination Detection Work (Well) for LLMs? A Survey and Evaluation on Detection Assumptions (2025.findings-naacl)
Copied to clipboard
| Challenge: | Large language models have demonstrated great performance across various benchmarks, but data contamination is a concern in their evaluation. |
| Approach: | They analyze 50 papers on data contamination detection and test three of them as case studies to identify the possibility of data contamination. |
| Outcome: | The proposed methods can detect membership inference attacks on instance-level data, and can perform similar to random guessing on LLM pretraining datasets. |
Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home? (2025.findings-emnlp)
Copied to clipboard
| Challenge: | delivering private retrieved documents directly to LLMs introduces vulnerability to membership inference attacks . |
| Approach: | They propose a similarity-based membership inference attack detection framework for RAG . they propose obfuscate attackers, maintain data utility, and remain system-agnostic . |
| Outcome: | The proposed framework can detect and hide membership inference attacks, while remaining system-agnostic against them. |
Sampling-based Pseudo-Likelihood for Membership Inference Attacks (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are trained on large-scale web data, which makes it difficult to grasp the contribution of each text. |
| Approach: | They propose a membership-inference attack method that uses only the input text to detect leaks. |
| Outcome: | The proposed method performs on par with existing likelihood-based methods even without likelihoods. |
ReCaLL: Membership Inference via Relative Conditional Log-Likelihoods (2024.emnlp-main)
Copied to clipboard
| Challenge: | ReCaLL (Relative Conditional Log-Likelihood) is a membership inference attack that can detect LLMs’ pretraining data by leveraging their conditional language modeling capabilities. |
| Approach: | They propose a membership inference attack to detect LLMs’ pretraining data by leveraging their conditional language modeling capabilities. |
| Outcome: | The proposed model achieves state-of-the-art performance on the WikiMIA dataset, even with random and synthetic prefixes, and can be further improved using an ensemble approach. |
Data Contamination Calibration for Black-box LLMs (2024.findings-acl)
Copied to clipboard
| Challenge: | Despite the rapid advancements of Large Language Models, the unchecked ultra-large-scale training sets introduce a series of potential risks like data contamination. |
| Approach: | They propose a method to detect contaminated training data and diminish the contamination effect by using a to-be-released dataset. |
| Outcome: | The proposed method outperforms existing methods by at least 4.5% on more 4 dataset formats, with more than 10 base LLMs. |
CoLA: A Choice Leakage Attack Framework to Expose Privacy Risks in Subset Training (2026.acl-long)
Copied to clipboard
| Challenge: | Existing threat models underestimate subset-training privacy risks because of the scale of modern datasets. |
| Approach: | They propose a unified framework for analyzing privacy leakage in subset selection based on side-channel metadata from the subset process or via the outputs of the target model. |
| Outcome: | The proposed framework analyzes privacy leakage in subset selection based on two different scenarios . |
MalAlgoQA: Pedagogical Evaluation of Counterfactual Reasoning in Large Language Models and Implications for AI in Education (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Using a novel dataset, we evaluate the counterfactual reasoning capabilities of Large Language Models (LLMs) . |
| Approach: | They propose a dataset to evaluate the counterfactual reasoning capabilities of Large Language Models (LLMs) using a pedagogical approach. |
| Outcome: | The proposed method mimics how educators anticipate and model potential student misconceptions by creating plausible but incorrect answer options by envisioning hypothetical scenarios and logically coherent reasoning paths. |
Tracing Training Footprints: A Calibration Approach for Membership Inference Attacks Against Multimodal Large Language Models (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing methods to improve difficulty calibration for Multimodal Large Language Models only consider text input . visual embeddings in training data reduce effectiveness of these methods . |
| Approach: | They propose a method to detect member samples in poorly generalized local manifolds by visual embeddings. |
| Outcome: | The proposed method surpasses existing methods. |
Locally Differentially Private In-Context Learning (2024.lrec-main)
Copied to clipboard
| Challenge: | Large pretrained language models (LLMs) have shown surprising In-Context Learning ability. |
| Approach: | They propose a locally differentially private framework of in-context learning for LLMs that can be augmented with a private database for some specific task. |
| Outcome: | The proposed framework can predict labels without additional parameter modifications without input-label pairs . |
A Statistical and Multi-Perspective Revisiting of the Membership Inference Attack in Large Language Models (2025.acl-long)
Copied to clipboard
| Challenge: | Membership Inference Attack (MIA) is a method that differentiates trained (member) and untrained (non-member) data. |
| Approach: | They used thousands of experiments to examine membership inference attacks from different settings and then revisited them with thousands of different methods. |
| Outcome: | The proposed methods outperform baselines in the study and improve with model size and varies with domains. |
Robust Membership Inference for Large Language Models under Adversarial Generative Corruption (2026.acl-long)
Copied to clipboard
Yuanhong Huang, Huili Wang, Xueying Bai, Jinrui Wang, Jiajun Liu, Ziqin Wang, Wanchun Ni, Shangguang Wang, Tao Qi
| Challenge: | Membership inference attacks are a promising tool for auditing training data of LLMs . existing methods rely on the assumption that LLM's assign higher confidence scores to training samples than to non-training ones. |
| Approach: | They propose a membership inference framework that can be robust against adversarial MIAs. |
| Outcome: | The proposed framework can be robust against adversarial MIA methods and AIGT detectors while maintaining the performance of baselines. |