Papers with MIAs
FiMMIA: scaling semantic perturbation-based membership inference across modalities (2026.eacl-demo)
Copied to clipboard
| Challenge: | Membership Inference attacks aim to determine whether a specific data point was included in the training set of a target model. |
| Approach: | They propose to train a neural network to analyze the target model’s behavior on perturbed inputs, capturing interactions between semantic domains and loss values on members and non-members in the local neighborhood of each sample. |
| Outcome: | The proposed methods can detect distribution shifts in existing datasets and release a baseline pipeline to detect them. |
CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models (2026.acl-short)
Copied to clipboard
| Challenge: | Membership inference attacks are a canonical way to assess a machine learning model’s privacy properties. |
| Approach: | They propose a framework for principled evaluation of membership inference attacks against large language models by leveraging the insight that training data before and after a fixed point during training are drawn from the same distribution. |
| Outcome: | The proposed framework can be used to evaluate membership inference attacks against large language models. |
Detecting Training Data of Large Language Models via Expectation Maximization (2026.eacl-long)
Copied to clipboard
| Challenge: | Membership inference attacks aim to determine whether a specific example was used to train a given language model. |
| Approach: | They propose a membership inference approach that iteratively refines prefix effectiveness and membership scores using an expectation-maximization strategy without requiring labeled non-member examples. |
| Outcome: | The proposed approach outperforms baselines under systematically varied distributional overlap and difficulty. |
Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks (2026.findings-eacl)
Copied to clipboard
| Challenge: | Large language models (LLMs) are the foundation of modern natural language processing, powering applications across diverse domains. |
| Approach: | They propose a model-agnostic defense framework which aggregates and evaluates the outputs of a knowledge-injected LLM, a base LLM and a dedicated judge model to enhance resistance against membership inference attacks. |
| Outcome: | The proposed framework reduces MIA success by up to 27.8% for SFT and 526.3% for RAG compared to inference-time baseline while maintaining answer quality. |
Order of Magnitude Speedups for LLM Membership Inference (2024.emnlp-main)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are complex and require fine-tuning on proprietary datasets to improve performance and relevance. |
| Approach: | They propose a low-cost membership inference attack that leverages an ensemble of small quantile regression models to determine if a document belongs to the model’s training set. |
| Outcome: | The proposed approach achieves comparable or improved accuracy on fine-tuned LLMs of varying families and across multiple datasets. |
Neural Breadcrumbs: Membership Inference Attacks on LLMs Through Hidden State and Attention Pattern Analysis (2026.eacl-long)
Copied to clipboard
| Challenge: | Membership inference attacks (MIAs) reveal whether specific data was used to train machine learning models, serving as important tools for privacy auditing and compliance assessment. |
| Approach: | They propose to examine LLMs’ internal representations rather than just their outputs to gain additional insights into potential membership inference signals. |
| Outcome: | The proposed framework yields strong membership detection across several model families achieving average AUC scores of 0.85 on popular MIA benchmarks. |
Tag&Tab: Pretraining Data Detection in Large Language Models Using Keyword-Based Membership Inference Attack (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Recent studies on detecting pretraining data in large language models have focused on sentence-level membership inference attacks (MIAs) but these methods often exhibit poor accuracy, failing to account for the semantic importance of textual content and word significance. |
| Approach: | They propose a method that leverages established natural language processing techniques to tag keywords in input text and then uses them to obtain probabilities and calculate their average log-likelihood to determine input text membership. |
| Outcome: | The proposed method exploits established natural language processing techniques to tag keywords in input text and calculate their average log-likelihood to determine input text membership. |
SEAD: A Surrogate-free Label-only Membership Inference Attack against Pre-trained LLMs with Semantic-Aware Density (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing membership inference attacks require access to complete logits, but such access is often unavailable in real-world deployments where only the generated text is exposed. |
| Approach: | They propose a surrogate-free label-only MIA approach that directly estimates token probabilities through Monte Carlo sampling of the target model. |
| Outcome: | The proposed approach outperforms existing label-only attacks and serves as a foundational density estimator in the label-exclusive setting. |
EverTracer: Hunting Stolen Large Language Models via Stealthy and Robust Probabilistic Fingerprint (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing fingerprinting methods require impractical white-box access or introduce detectable statistical anomalies. |
| Approach: | They propose a gray-box fingerprinting framework that ensures stealthy and robust model provenance tracing. |
| Outcome: | The proposed framework is the first to repurpose Membership Inference Attacks (MIAs) for defensive use, embedding ownership signals via memorization instead of artificial trigger-output overfitting. |
Context-Aware Membership Inference Attacks against Pre-trained Large Language Models (2025.emnlp-main)
Copied to clipboard
| Challenge: | Prior Membership Inference Attacks on pre-trained Large Language Models fail at LLMs due to ignoring the generative nature of LLM data. |
| Approach: | They propose a method that adapts MIA statistical tests to the perplexity dynamics of subsequences within a data point. |
| Outcome: | The proposed method significantly outperforms prior approaches, revealing context-dependent memorization patterns in pre-trained LLMs. |
Image Corruption-Inspired Membership Inference Attacks against Large Vision-Language Models (2026.eacl-long)
Copied to clipboard
| Challenge: | Large vision-language models (LVLMs) are trained on large-scale datasets, which can pose privacy risks if training images contain sensitive information. |
| Approach: | They propose to detect whether a target image is used to train LVLMs by using image-text pairs and single-modality content to detect image-related data. |
| Outcome: | The proposed methods detect whether a target image is used to train the LVLM on large-scale datasets. |
Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home? (2025.findings-emnlp)
Copied to clipboard
| Challenge: | delivering private retrieved documents directly to LLMs introduces vulnerability to membership inference attacks . |
| Approach: | They propose a similarity-based membership inference attack detection framework for RAG . they propose obfuscate attackers, maintain data utility, and remain system-agnostic . |
| Outcome: | The proposed framework can detect and hide membership inference attacks, while remaining system-agnostic against them. |
Sampling-based Pseudo-Likelihood for Membership Inference Attacks (2025.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are trained on large-scale web data, which makes it difficult to grasp the contribution of each text. |
| Approach: | They propose a membership-inference attack method that uses only the input text to detect leaks. |
| Outcome: | The proposed method performs on par with existing likelihood-based methods even without likelihoods. |
Powerful Training-Free Membership Inference Against Fine-Tuned Autoregressive Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Existing methods for auditing fine-tuned language models have limited detection rates . membership inference attacks aim to determine if a specific record was in a model's training set . |
| Approach: | They propose a membership inference attack that exploits memorization at error positions . EZ-MIA achieves 3.8 higher detection than previous state-of-the-art . |
| Outcome: | The proposed attack achieves 3.8 higher detection than previous state-of-the-art models . EZ-MIA achieves 8 higher detectability than prior work, requiring no model training . |
Membership Inference Attacks against Language Models via Neighbourhood Comparison (2023.findings-acl)
Copied to clipboard
Justus Mattern, Fatemehsadat Mireshghallah, Zhijing Jin, Bernhard Schoelkopf, Mrinmaya Sachan, Taylor Berg-Kirkpatrick
| Challenge: | Existing membership inference attacks aim to predict whether a data sample was present in training data of a machine learning model. |
| Approach: | They propose to compare model scores to neighbour texts to eliminate access to training data by comparing model scores with a given sample. |
| Outcome: | The proposed attacks outperform reference-based attacks with perfect knowledge of the training data distribution and outperformed reference-free attacks with imperfect knowledge. |
R.R.: Unveiling LLM Training Privacy through Recollection and Ranking (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing privacy attacks focus on membership inference or data extraction, but reconstructing specific personally identifiable information (PII) in training data remains challenging. |
| Approach: | They propose a two-step privacy stealing attack that enables attackers to reconstruct PII entities from scrubbed training data where the PI I entities have been masked. |
| Outcome: | The proposed attack can reconstruct PII entities from scrubbed training data where the PI I entities have been masked. |
Tokens for Learning, Tokens for Unlearning: Mitigating Membership Inference Attacks in Large Language Models via Dual-Purpose Training (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing defenses for large language models do not account for the sequential nature of text data. |
| Approach: | They propose a lightweight yet effective empirical privacy defense that leverages token-specific characteristics to protect training data of large language models. |
| Outcome: | The proposed approach provides strong protection against membership inference attacks and improves language modeling performance by 10% across different LLM architectures and datasets compared to baselines. |
Black-Box Membership Inference Attacks for Video Training Data in Multimodal Large Language Models (2026.acl-long)
Copied to clipboard
Jinrui Wang, Zhenfeng Gao, Wendan Wang, Huili Wang, Zichen Qin, Linjie Zhu, Hongke Fu, Shangguang Wang, Tao Qi
| Challenge: | Existing methods assess model memorization of key semantic concepts within a video but do not provide reliable evidence that a specific video was used during training. |
| Approach: | They propose a black-box MIA framework that can provide reliable evidence of specific video data usage for training multimodal large language models. |
| Outcome: | The proposed framework can provide reliable evidence of specific video data usage for training multimodal large language models. |
Robust Membership Inference for Large Language Models under Adversarial Generative Corruption (2026.acl-long)
Copied to clipboard
Yuanhong Huang, Huili Wang, Xueying Bai, Jinrui Wang, Jiajun Liu, Ziqin Wang, Wanchun Ni, Shangguang Wang, Tao Qi
| Challenge: | Membership inference attacks are a promising tool for auditing training data of LLMs . existing methods rely on the assumption that LLM's assign higher confidence scores to training samples than to non-training ones. |
| Approach: | They propose a membership inference framework that can be robust against adversarial MIAs. |
| Outcome: | The proposed framework can be robust against adversarial MIA methods and AIGT detectors while maintaining the performance of baselines. |