Black-Box Membership Inference via Word-Level Probability Estimation

Shengjie Niu; Yeheng Ge; Jian Huang

cs.CRSep 8, 2026

Black-Box Membership Inference via Word-Level Probability Estimation

Authors: Shengjie Niu, Yeheng Ge, Jian Huang

Organizations: Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University, Hong Kong SAR, China · Department of Applied Mathematics The Hong Kong Polytechnic University, Hong Kong SAR, China

Abstract

Membership inference attacks (MIAs) have emerged as critical tools for auditing privacy risks in large language models (LLMs), aiming to determine whether a given text was included in a model's training corpus. However, most existing MIAs require access to per-token logits or probabilities, making them inapplicable in practice to proprietary LLMs that expose only textual continuations. To address this underexplored setting, we propose Word-level Probability MIA (WPMIA), a statistically principled MIA for strict black-box privacy auditing. WPMIA estimates word-level generation probabilities via Monte Carlo sampling with local kernel smoothing, then aggregates these estimates into a sequence-level likelihood estimator. Furthermore, WPMIA constructs the likelihood conditioned on different prefixes, thereby amplifying the distributional differences between members and non-members. We evaluate WPMIA across various open-source LLMs and find that it consistently outperforms existing black-box baselines. Importantly, we also evaluate WPMIA on modern proprietary LLMs, including GPT-5-Chat, Gemini-2.5-Flash, and Claude-4.5-Haiku, achieving an average TPR@5%FPR of 42.0 across these models. These results offer a sound foundation for future research on strict black-box membership inference. Code is available at https://github.com/niusj03/WPMIA.

Figures & tables

Figure 1: Adversary access levels. Gray-box : the adversary has access to tokenization results and per-token logits, but not to the model’s internal weights. Black-box (of interest) : the adversary has no access to model weights, tokenization results, or token logits, and can only observe textual continuations.

Figure 2: Visualization of normalized membership-score distributions. From left to right, we show min–max-normalized distributions of the unprefixed score $\mathcal{S}_{0}=\widehat{LL}^{0}(x)$ , the non-member-prefix relative score $\mathcal{S}_{nm}=\widehat{LL}^{nm}(x)/\widehat{LL}^{0}(x)$ , and the contrastive-prefix score $\mathcal{S}_{\mathrm{ctr}}=(\widehat{LL}^{nm}(x)-\widehat{LL}^{m}(x))/\widehat{LL}^{0}(x)$ . The contrastive-prefix score yields the largest separation between members and non-members.

Len	Method	OPT-6.7B		Pythia-6.9B		LLaMA-13B		GPT-NeoX-20B		Average
		AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR
32	PETAL	61.4	10.5	62.8	15.3	63.2	11.1	67.6	21.6	63.8	14.6
	SaMIA	55.4	5.3	55.2	8.7	59.4	10.0	60.1	10.8	57.5	8.7
	SimMIA ∗	85.1	28.9	82.8	27.4	60.0	8.9	85.9	34.5	78.5	24.9
	SimMIA	78.8	20.8	71.4	12.9	62.9	11.6	76.3	18.7	72.4	16.0
	WPMIA	89.1	38.7	84.8	27.9	75.9	21.6	89.5	52.6	84.8	35.2

Table 1: Black-box results on the WikiMIA benchmark. Complete results including gray-box baselines are provided in Tab. 15 . Bold and underlined values indicate the best and second-best results in each column, respectively. ∗ denotes scoring with Eq. ( 12 ) instead of Eq. ( 13 ).

Method	Pythia-6.9B		Qwen3-8B-Base		Claude-4.5-Haiku		Gemini-2.5-Flash		GPT-5-Chat
	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR
PETAL	72.2	30.1	62.8	18.6	-	-	67.1	23.9	78.0	35.4
SaMIA	57.8	8.8	50.3	2.7	62.6	8.0	57.0	15.0	65.7	13.3
SimMIA ∗	88.1	37.2	63.2	2.7	65.7	6.2	75.7	30.2	90.6	73.3
SimMIA	88.8	47.8	63.0	6.2	60.5	6.2	74.1	28.5	83.3	37.2
WPMIA	89.0	56.6	65.9	23.0	66.3	22.1	78.2	36.5	91.0	67.3

Table 2: Black-box results on the WikiMIA-25 benchmark. Complete results including gray-box baselines are provided in Tab. 17 . Bold and underlined values indicate the best and second-best results in each column, respectively. ∗ denotes scoring with Eq. ( 12 ) instead of Eq. ( 13 ).

Panel of Figure 3 — Figure 3: Attack performance under different continuation ratios, sample sizes, and prefix shots at Len. 32.

Method	Len. 32	Len. 64	Len. 128
LL ( $\mathcal{S}_{0}$ )	58.8	55.4	62.0
+NP, sequence ( $\mathcal{S}_{nm}$ )	75.5	77.2	76.2
+NP, word	52.0	46.9	54.7
+MP, word	51.4	48.8	48.8
+MP, sequence ( $\mathcal{S}_{\mathrm{ctr}}$ )	84.8	86.5	84.7

Table 3: Component-wise ablation of WPMIA.

Estimator	Prefix	Len. 32	Len. 64	Len. 128
Exact match	No prefix	59.87	58.01	65.08
	+NP	73.88	72.63	68.81
	+MP	81.00	80.58	75.50
Raw similarity	No prefix	57.93	54.86	59.86
	+NP	70.57	72.91	72.21
	+MP	79.80	82.65	81.12

Table 4: Crossed ablation of word-level estimators and prefix-conditioning strategies. +NP denotes non-member-prefix conditioning, whereas +MP additionally introduces member-prefix contrast.

Embedding Model	Len. 32	Len. 64	Len. 128
Word2Vec	61.5	58.2	62.2
fastText	80.9	82.1	82.2
bge-large-en-v1.5	86.3	88.0	84.9
all-MiniLM-L6-v2	84.8	86.5	84.7
UAE-Large-V1	86.5	88.3	85.1
mxbai-embed-large-v1	86.3	88.0	84.8

Table 5: Results with different embedding models.

Figure 4: Attack performance under different semantic-kernel temperature parameters $\tau$ .

Prefix condition	Construction	Mislabeled prefixes	AUC	TPR@5%FPR
Clean	Correct WikiMIA member/non-member prefix pools	0/14	84.78	27.89
Noisy-light	Swap one prefix from each pool	2/14	79.76	15.79
Noisy-heavy	Swap three prefixes from each pool	6/14	48.73	6.05
Fully shuffled	Randomly repartition all prefixes with a fixed score direction	8/14	48.14	5.08
GitHub OOD	Correctly labeled GitHub subset prefixes from MIMIR	N/A	56.54	8.11
Synthetic	Synthetic non-member and member-like prefixes	N/A	75.27	14.84

Table 6: Robustness to prefix-pool corruption and distribution shift at Len. 32. Each condition uses seven member and seven non-member prefixes.

Figure 5: Results under different contrast strengths $\gamma$ .

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Statistic	Text Length
Statistic	32	64	128
Total examples	776	542	250
Non-member Ratio	50.1%	47.6%	44.4%
Member Ratio	49.9%	52.4%	55.6%

Appendix

Table 7: WikiMIA dataset statistics.

Subset	Samples
wikipedia_(en)	2000
github	536
pile_cc	2000
pubmed_central	982
arxiv	1000
dm_mathematics	178

Appendix

Table 8: MIMIR dataset statistics under the 7-gram setting.

Text Length	Members	Non-members	Total Samples
32	120	120	240

Appendix

Table 9: WikiMIA-25 subset used for cost-efficient evaluation.

Setting	WikiMIA	MIMIR	WikiMIA-25
Monte Carlo samples $M$	100	100	10
Prefix shots $T$	7	10	7
Smoothing constant $\epsilon$	$10^{-8}$	$10^{-8}$	$10^{-8}$
Kernel temperature $\tau$	0.2	0.2	0.1

Appendix

Table 10: Hyperparameter settings used for WPMIA.

Budget	Method	$\boldsymbol{M}$	Avg. generated	AUC	TPR@5%FPR
Budget	Method	$\boldsymbol{M}$	tokens	AUC	TPR@5%FPR
Low	SaMIA	10	6,317.68	51.30	5.53
	SimMIA	30	6,313.98	69.99	11.58
	WPMIA	20	6,313.86	81.25	28.68
Medium	SaMIA	20	12,499.20	51.42	6.58
	SimMIA	60	12,627.62	70.88	13.16

Appendix

Table 11: Generated-token-budget-matched comparison of sampling-based black-box attacks on WikiMIA with Pythia-6.9B at length 32.

Model	HTTP	Runtime/	Monetary cost
Model	responses	record (s)	(USD)
GPT-5-Chat	241,492	216.43	$266.8
Gemini-2.5-Flash	238,649	119.81	$78.0
Claude-Haiku-4.5	239,293	86.25	$240.7

Appendix

Table 12: API statistics for WPMIA on WikiMIA-25 with

M=10

. HTTP response counts include retries; runtime is averaged per record at a concurrency level of 32, and monetary cost is reported in U.S. dollars.

$M$	Len. 32	Len. 64	Len. 128
10	$68.32\pm 1.10$	$71.74\pm 2.77$	$67.63\pm 1.44$
20	$71.84\pm 0.96$	$75.49\pm 1.82$	$72.12\pm 2.30$
30	$75.11\pm 0.83$	$79.00\pm 0.84$	$77.80\pm 1.75$
40	$78.32\pm 0.49$	$80.74\pm 0.72$	$80.58\pm 2.53$
50	$80.90\pm 0.64$	$83.04\pm 0.70$	$83.30\pm 2.12$
60	$82.31\pm 0.83$	$84.57\pm 0.72$	$84.66\pm 1.47$

Appendix

Table 13: Mean AUC (

\pm

standard deviation) over five sampling seeds for WPMIA on WikiMIA with Pythia-6.9B, across sample sizes

M

and sequence lengths.

$\tau$	Len. 32	Len. 64	Len. 128
0.10	84.69	85.00	81.56
0.15	85.30	86.52	84.26
0.20	84.78	86.48	84.67
0.25	84.16	86.17	84.74
0.30	83.63	85.84	84.44
0.35	83.21	85.58	84.17

Appendix

Table 14: AUC of WPMIA on WikiMIA with Pythia-6.9B under different semantic-kernel temperatures.

Len	Method	OPT-6.7B		Pythia-6.9B		LLaMA-13B		GPT-NeoX-20B		Average
		AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR
32	Gray-Box
	Loss	60.3	10.5	63.5	13.7	67.4	13.7	68.7	19.0	65.0	14.2
	Reference	64.0	7.9	63.8	6.3	58.2	4.7	67.9	16.6	63.5	8.9
	Lowercase	57.7	8.9	58.9	11.8	65.3	13.4	61.6	14.5	60.9	12.2
	Zlib	61.3	12.6	64.1	16.8	67.7	11.8	69.0	20.8	65.5	15.5

Appendix

Table 15: Results on the WikiMIA benchmark. Bold and underlined values indicate the best and second-best results in each column, respectively. ∗ denotes scoring with Eq. ( 12 ) instead of Eq. ( 13 ).

Method	Wikipedia				Github				Pile CC				PubMed Central
	160M	1.4B	2.8B	6.9B	160M	1.4B	2.8B	6.9B	160M	1.4B	2.8B	6.9B	160M	1.4B	2.8B	6.9B
Gray-Box
Loss	62.3	64.9	66.2	66.4	83.6	86.4	88.4	87.9	53.7	55.2	54.9	57.0	79.1	78.0	77.8	77.6
Reference	51.7	62.9	67.6	67.8	67.7	73.3	73.7	65.7	52.0	58.6	58.2	63.7	68.0	66.8	63.0	60.5
Lowercase	58.6	62.1	63.5	64.1	76.5	81.2	83.5	83.3	53.6	54.3	54.2	55.7	75.1	75.2	75.4	75.2
Zlib	56.5	60.9	63.0	63.0	87.9	89.8	91.2	90.9	51.9	53.9	53.7	55.6	77.8	76.9	76.7	76.7

Appendix

Table 16: AUC results on the MIMIR benchmark. Bold and underlined values indicate the best and second-best results in each column, respectively. ∗ denotes scoring with Eq. ( 12 ) instead of Eq. ( 13 ).

Method	Pythia-6.9B		Qwen3-8B-Base		Claude-4.5-Haiku		Gemini-2.5-Flash		GPT-5-Chat
	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR	AUC	TPR@5%FPR
Gray-Box
Loss	73.0	36.3	59.1	11.5	-	-	-	-	-	-
Reference	65.2	8.9	53.9	3.5	-	-	-	-	-	-
Lowercase	70.7	23.0	59.4	19.5	-	-	-	-	-	-
Zlib	72.2	31.9	57.5	8.9	-	-	-	-	-	-

Appendix

Table 17: Results on the WikiMIA-25 benchmark. Bold and underlined values indicate the best and second-best results in each column, respectively. ∗ denotes scoring with Eq. ( 12 ) instead of Eq. ( 13 ).

Membership Inference Attacks

Membership inference attacks test whether records or entities were used to train a machine-learning model, revealing potential privacy leakage.

See all 116 papers

Detecting Data Contamination in Large Language Models
Apr 21, 2026Juliusz Janicki, Savvas Chamezopoulos, Evangelos Kanoulas +1Membership Inference Attacks LLM Auditing
University of Amsterdam · Elsevier
CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models
Jun 16, 2026Jeffrey G. Wang, Jason Wang, Marvin Li +1LLM Evaluation Membership Inference Attacks
Harvard University · Harvard Business School
G-Drift MIA: Membership Inference via Gradient-Induced Feature Drift in LLMs
Apr 1, 2026Ravi Ranjan, Utkarsh Grover, Xiaomin Lin +1Membership Inference Attacks Privacy Leakage in Language Models
Florida International University, Miami, USA · University of South Florida, Tampa, USA

Apr 21, 2026J/K move · Enter open · S save

Detecting Data Contamination in Large Language Models

Juliusz Janicki, Savvas Chamezopoulos, Evangelos Kanoulas, Georgios Tsatsaronis

University of Amsterdam · Elsevier

Membership Inference Attacks LLM Auditing Privacy Leakage in Language Models

Open paper AskPDF arXiv

Large Language Models (LLMs) utilize large amounts of data for their training, some of which may come from copyrighted sources. Membership Inference Attacks (MIA) aim to detect those documents and whether they have been included in the training corpora of the LLMs. The black-box MIAs require a significant amount of data manipulation; therefore, their comparison is often challenging. We study state-of-the-art (SOTA) MIAs under the black-box assumptions and compare them to each other using a unified set of datasets to determine if any of them can reliably detect membership under SOTA LLMs. In addition, a new method, called the Familiarity Ranking, was developed to showcase a possible approach to black-box MIAs, thereby giving LLMs more freedom in their expression to understand their reasoning better. The results indicate that none of the methods are capable of reliably detecting membership in LLMs, as shown by an AUC-ROC of approximately 0.5 for all methods across several LLMs. The higher TPR and FPR for more advanced LLMs indicate higher reasoning and generalizing capabilities, showcasing the difficulty of detecting membership in LLMs using black-box MIAs.

Abstract

Membership Inference Attacks

Explore similar work

Detecting Data Contamination in Large Language Models

CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models

G-Drift MIA: Membership Inference via Gradient-Induced Feature Drift in LLMs