Membership Inference Attacks

Also known as MIA

Membership inference attacks ask whether a particular record, person, or dataset contributed to a model’s training, helping assess privacy risks. Black-box attacks use outputs such as loss, confidence, or generated text, while white-box methods analyze gradients and internal representations; LiRA and RMIA are prominent reference-model approaches. Researchers apply these methods to language, vision, generative, recommender, and federated models, and study defenses including differential privacy, regularization, and limits on exposed signals. A central challenge is that results can change sharply with attacker access, distribution shift, and false-positive rates, so reliable audits must distinguish practical privacy risks from apparent attack success under unrealistic assumptions.

Latest papers

116 papers15 papers in the last four weeks, up 25% on the four weeks before. 0.1% of all new papers.

MemGuard-Alpha: Limits of Membership Inference for Detecting and Filtering Memorization-Contaminated Signals in LLM-Based Financial Forecasting
Mar 26, 2026Anisha Roy, Dip RoyMembership Inference Attacks LLM Auditing
Department of Electronics and Communication Engineering, Jaypee Institute of Information Technology, Noida, India · Department of Computer Science and Engineering, Indian Institute of Technology Patna, India
Uncovering Memorization in Timeseries Imputation models: LBRM Membership Inference and its link to attribute Leakage
Mar 25, 2026Faiz Taleb, Ivan Gazeau, Maryline LaurentUser Attribute Inference Attacks Membership Inference Attacks
EDF SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris, 91120 Palaiseau, France · EDF, 91120 Palaiseau, France · SAMOVAR, Télécom SudParis, Institut Polytechnique de Paris
A Critical Review on the Effectiveness and Privacy Threats of Membership Inference Attacks
Mar 24, 2026Najeeb Jebreel, David Sánchez, Josep Domingo-FerrerMembership Inference Attacks Privacy-Preserving ML
Universitat Rovira i Virgili, Department of Computer Engineering and Mathematics, CYBERCAT-Center for Cybersecurity Research of Catalonia, ComSCIAM-Center for Computational Science and Applied Mathematics Av. Països Catalans 26, 43007 Tarragona, Catalonia
Automated Membership Inference Attacks (AutoMIA): Discovering MIA Signal Computations using LLM Agents
Mar 19, 2026Toan Tran, Olivera Kotevska, Li XiongMembership Inference Attacks
Emory University · Oak Ridge National Laboratory
MIDST Challenge at SaTML 2025: Membership Inference over Diffusion-models-based Synthetic Tabular data
Mar 19, 2026Masoumeh Shafieinejad, Xi He, Mahshid Alinoori +6Synthetic Data Evaluation Membership Inference Attacks
Vector Institute · University of Waterloo · McGill University
Membership Inference for Contrastive Pre-training Models with Text-only PII Queries
Mar 15, 2026Ruoxi Cheng, Yizhong Ding, Jian Zhao +5Membership Inference Attacks Black-Box Model Auditing
Beijing Electronic Science and Technology Institute, Beijing 100070, China · Institute of Artificial Intelligence, China Telecom (TeleAI), Beijing 100032, China · Nanyang Technological University, Singapore 637371, Singapore +2
Learnability and Privacy Vulnerability are Entangled in a Few Critical Weights
Mar 13, 2026Xingli Fang, Jung-Eun KimPrivacy-Preserving ML Privacy-Utility Tradeoff
Department of Computer Science, North Carolina State University, Raleigh, NC 27695, USA
Generalization and Memorization in Rectified Flow
Mar 12, 2026Mingxing Rao, Daniel MoyerRectified Flow Membership Inference Attacks
Vanderbilt University, Nashville TN 37235, USA
Exponential-Family Membership Inference: From LiRA and RMIA to BaVarIA
Mar 12, 2026Rickard BrännvallExponential Family Membership Inference Attacks
RISE Research Institutes of Sweden
Quantifying Membership Disclosure Risk for Tabular Synthetic Data Using Kernel Density Estimators
Mar 11, 2026Rajdeep Pathak, Amit Basak, Sayantee JanaMembership Inference Attacks Synthetic Data Evaluation
SCAI, Sorbonne Université, Paris, France · SAFIR, Sorbonne University Abu Dhabi, UAE · Indian Institute of Technology Hyderabad, India
Quantifying Memorization and Privacy Risks in Genomic Language Models
Mar 9, 2026Alexander Nemecek, Wenbiao Li, Xiaoqian Jiang +2Memorization in Language Models Privacy Leakage in Language Models
Case Western Reserve University Cleveland, Ohio, USA · The University of Texas Health Science Center at Houston Houston, Texas, USA · Rutgers University Newark, New Jersey, USA
Revisiting the LiRA Membership Inference Attack Under Realistic Assumptions
Mar 8, 2026Najeeb Jebreel, Mona Khalil, David Sánchez +1Membership Inference Attacks Privacy Auditing
Universitat Rovira i Virgili, Catalonia
From Unfamiliar to Familiar: Detecting Pre-training Data via Gradient Deviations in Large Language Models
Mar 5, 2026Ruiqi Zhang, Lingxiang Wang, Hainan Zhang +2Membership Inference Attacks LLM Auditing
Beijing Advanced Innovation Center for Future Blockchain and Privacy Computing, Beihang University · School of Artificial Intelligence, Beihang University
Extracting Training Dialogue Data from Large Language Model based Task Bots
Mar 2, 2026Shuo Zhang, Junzhou Zhao, Junji Hou +3Training Data Extraction Attacks Privacy Leakage in Language Models
MOE Key Laboratory for Intelligent Networks and Network Security, Xi’an Jiaotong University, P.O. Box 1088, No. 28, Xianning West Road, Xi’an, Shaanxi 710049, China.
Curation Leaks: Membership Inference Attacks against Data Curation for Machine Learning
Feb 28, 2026Dariush Wahdany, Matthew Jagielski, Adam Dziedzic +1Privacy-Preserving ML Training Data Curation
CISPA Helmholtz Center for Information Security · Anthropic
No Caption, No Problem: Caption-Free Membership Inference via Model-Fitted Embeddings
Feb 26, 2026Joonsung Jeon, Woo Jae Kim, Suhyeon Ha +2Membership Inference Attacks T2I Diffusion Models
Korea Advanced Institute of Science and Technology (KAIST)
Mitigating Membership Inference in Intermediate Representations with Differentially Private Training
Feb 26, 2026Jiayang Meng, Tao Huang, Chen Hou +2Differentially Private Stochastic Gradient Descent Membership Inference Attacks
School of Information, Renmin University of China, Beijing, China · School of Computer Science and Big Data, Minjiang University, Fuzhou, Fujian, China
Learning to Detect Language Model Training Data via Active Reconstruction
Feb 22, 2026Junjie Oscar Yin, John X. Morris, Vitaly Shmatikov +2Membership Inference Attacks Privacy Leakage in Language Models
University of Washington · Cornell University · UC Berkeley +1
LoMime: Query-Efficient Membership Inference using Model Extraction in Label-Only Settings
Feb 21, 2026Abdullah Caglar Oksuz, Anisa Halimi, Erman AydayMembership Inference Attacks
Case Western Reserve University · IBM Research
Sequential Membership Inference Attacks
Feb 18, 2026Thomas Michel, Debabrota Basu, Emilie KaufmannMembership Inference Attacks Privacy Auditing
Univ. Lille, Inria, CNRS, Centrale Lille UMR 9189-CRIStAL, France
Assessing Per-Sample Membership Inference Vulnerability without Retraining
Feb 17, 2026Valentin Dorseuil, Jamal Atif, Olivier CappéMembership Inference Attacks
DI-ENS · DI ENS, École normale supérieure, Université PSL, CNRS · CMAP +1
Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning
Jan 10, 2026Quan Minh Nguyen, Min-Seon Kim, Hoang M. Ngo +3Membership Inference Attacks Federated Fine-Tuning
CISE, University of Florida, FL, USA · North Carolina State University, NC, USA · Washington State University, WA, USA +1
Estimating Model-Level Membership Inference Vulnerability Without Reference Models
Oct 22, 2025Euodia Dodd, Nataša Krčo, Igor Shilov +2Membership Inference Attacks
Imperial College London
Auditing Information Disclosure During Large-Scale Gradient-Based Training via Gradient Uniqueness
Oct 13, 2025Sleem Abdelghafar, Maryam Aliakbarpour, Christopher JermaineData Leakage Privacy Auditing
Rice University Houston, USA
Membership Inference Attacks on Recommender System: A Survey
Sep 14, 2025Jiajie He, Xintong Chen, Xinyang Fang +4Membership Inference Attacks Privacy-Preserving ML
Mcmaster University, Canada · Nanyang Technological University, SG
The Sample Complexity of Membership Inference and Privacy Auditing
Aug 26, 2025Mahdi Haghifam, Adam Smith, Jonathan UllmanMembership Inference Attacks Sample Complexity
Khoury College of Computer Sciences, Northeastern University. · Department of Computer Science, Boston University.

Mar 26, 2026J/K move · Enter open · S save

MemGuard-Alpha: Limits of Membership Inference for Detecting and Filtering Memorization-Contaminated Signals in LLM-Based Financial Forecasting

Anisha Roy, Dip Roy

Department of Electronics and Communication Engineering, Jaypee Institute of Information Technology, Noida, India · Department of Computer Science and Engineering, Indian Institute of Technology Patna, India

Membership Inference Attacks LLM Auditing LLM-Based Time Series Forecasting LLM Training Finance

Open paper AskPDF arXiv

Large language models are increasingly used to generate financial alpha signals, but many have memorized the historical data in their training corpora, producing apparent accuracy that collapses out of sample. Membership inference attacks (MIA) have been proposed as a diagnostic. What has not been established is whether MIA scores are informative about memorization in this setting, or whether signal-level filtering built on them helps once realistic costs are applied.We introduce MemGuard-Alpha, comprising a composite contamination score combining five MIA methods with a temporal proximity feature, and Cross-Model Memorization Disagreement, which exploits variation in training cutoffs across models. We then audit both. Across seven LLMs (124M-7B), 50 S&P 100 constituents, 42,800 prompts and 299,600 prompt-model MIA scores spanning 2019-2024, three findings emerge.First, where in-sample status is defined by a training cutoff, a temporal proximity feature recovers that label perfectly (ROC-AUC 1.000) because it is a monotone transform of the defining variable; any composite score containing such a feature reports separation that is arithmetic rather than detection. Second, the discriminative power of the MIA scores is largely attributable to scale differences between models: asked at a fixed date which models had that date in training, raw scores appear highly informative (AUC up to 0.99), but under three independent within-model normalizations discrimination falls to 0.487-0.537. Third, with transaction costs applied symmetrically, no filtering variant improves risk-adjusted performance over the unfiltered ensemble, none attains significant Fama-French five-factor alpha, and excluding the single weakest model outperforms every contamination-based filter.We report these as negative results with the failure modes that produced them, and release all artifacts needed to reproduce them.