Papers with membership inference attacks
Membership Inference Attacks on Sequence-to-Sequence Models: Is My Data In Your Machine Translation System? (2020.tacl-1)
Copied to clipboard
| Challenge: | Data privacy is an important issue for “machine learning as a service” providers. |
| Approach: | They propose an attack on membership inference attacks using a sequence-to-sequence model and a machine translation dataset to investigate the feasibility of a privacy attack. |
| Outcome: | The proposed model can infer sentence-level membership from the output of the model, but it is difficult to infer it. |
Fast-MIA: Efficient and Scalable Membership Inference for LLMs (2026.acl-demo)
Copied to clipboard
| Challenge: | a library for evaluating membership inference attacks against large language models (LLMs) has emerged as a crucial technique for auditing privacy risks and copyright infringement in LLMs. |
| Approach: | They propose a Python library for efficiently evaluating membership inference attacks against large language models (LLMs) they use a high-throughput batch inference via vLLM and a cross-method caching architecture that computes intermediate results once and shares them across methods. |
| Outcome: | The proposed library performs a 5 speedup in inference and a cross-method caching architecture that computes intermediate results once and shares them across methods. |
Granularity is crucial when applying differential privacy to text: An investigation for neural machine translation (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Differential privacy (DP) is a method that is increasingly popular in NLP but the choice of granularity at which it is applied is often neglected. |
| Approach: | They propose to apply differential privacy (DP) to a neural machine translation dataset to protect individual data points. |
| Outcome: | The proposed method is more resistant to membership inference attacks than the document-level NMT system. |
NLP Privacy Risk Identification in Social Media (NLP-PRISM): A Survey (2026.findings-eacl)
Copied to clipboard
| Challenge: | Social media platforms such as X (formerly Twitter), Facebook, and Reddit generate user-generated content. |
| Approach: | They propose a framework to assess privacy risks in social media by evaluating vulnerabilities across six dimensions: data collection, preprocessing, visibility, fairness, computational risk, and regulatory compliance. |
| Outcome: | The proposed framework assesses privacy risks across six dimensions . it achieves F1-scores of 0.58–0.84, but incurs 1% - 23% drop under fine-tuning . |
Domain Private Transformers for Multi-Domain Dialog Systems (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Large general purpose language models have demonstrated impressive performance across many different domains, but their outputs are not guaranteed to stay within the domain of a given input prompt. |
| Approach: | They propose to quantify how likely a conditional language model will leak across domains by defining domain privacy as a way to fine-tune a model's privacy. |
| Outcome: | The proposed method has comparable resiliency to methods adapted from recent literature on differentially private language models. |
Identifying Unlearned Data in LLMs via Membership Inference Attacks (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing work evaluates approximate unlearning under a retrieval paradigm, where adversaries attempt to extract residual knowledge given partial information of the unlearning target. |
| Approach: | They propose a framework to evaluate unlearning membership attacks using member inference techniques to exploit the forget set. |
| Outcome: | The proposed framework assesses whether unlearning leaves behind detectable artifacts that can be exploited to infer membership in the forget set. |
Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks (2022.emnlp-main)
Copied to clipboard
| Challenge: | Prior attempts at measuring leakage of MLMs via membership inference attacks have been inconclusive, implying potential robustness of Mlms to privacy attacks. |
| Approach: | They propose a stronger membership inference attack based on likelihood ratio hypothesis testing that involves an additional MLM to more accurately quantify the privacy risks of memorization in MLMs. |
| Outcome: | The proposed attack improves the AUC of prior membership inference attacks from 0.66 to an alarmingly high 0.90 level on models trained on medical notes. |
Public Data Assisted Differentially Private In-Context Learning (2025.findings-emnlp)
Copied to clipboard
| Challenge: | In-context learning has shown remarkable performance across tasks without fine-tuning . however, recent studies have highlighted the risk of private data leakage through the prompt in ICL . |
| Approach: | They propose a private in-context learning algorithm that effectively balances privacy protection and model utility. |
| Outcome: | The proposed algorithm is robust against membership inference attacks and is robust to membership infertility attacks. |
R.R.: Unveiling LLM Training Privacy through Recollection and Ranking (2025.findings-acl)
Copied to clipboard
| Challenge: | Existing privacy attacks focus on membership inference or data extraction, but reconstructing specific personally identifiable information (PII) in training data remains challenging. |
| Approach: | They propose a two-step privacy stealing attack that enables attackers to reconstruct PII entities from scrubbed training data where the PI I entities have been masked. |
| Outcome: | The proposed attack can reconstruct PII entities from scrubbed training data where the PI I entities have been masked. |
Personalized Language Models via Privacy-Preserving Evolutionary Model Merging (2025.emnlp-main)
Copied to clipboard
| Challenge: | Existing methods for personalization in language models lack explicit mechanisms for privacy preservation. |
| Approach: | They propose a Privacy-Preserving Model Merging via Evolutionary Algorithms to optimize utility while minimizing privacy risks. |
| Outcome: | The proposed approach outperforms baseline models on the LaMP benchmark and achieves 45% improvement in task performance. |
Black-Box Membership Inference Attacks for Video Training Data in Multimodal Large Language Models (2026.acl-long)
Copied to clipboard
Jinrui Wang, Zhenfeng Gao, Wendan Wang, Huili Wang, Zichen Qin, Linjie Zhu, Hongke Fu, Shangguang Wang, Tao Qi
| Challenge: | Existing methods assess model memorization of key semantic concepts within a video but do not provide reliable evidence that a specific video was used during training. |
| Approach: | They propose a black-box MIA framework that can provide reliable evidence of specific video data usage for training multimodal large language models. |
| Outcome: | The proposed framework can provide reliable evidence of specific video data usage for training multimodal large language models. |