The study re‑runs the OLMo 2 1B language model with controlled training exposure, swapping selected training chunks with matched documents to assess membership inference. Using a counterfactual run from the same seed, the authors find that a single exposure modestly increases a document’s likelihood but rarely allows reliable identification; the reference‑ratio method achieves an AUC of 0.767 and detects 3.8 % of members at a 1 % false‑positive rate. Even with matched references, document‑level variability limits individual inference, and the authors plan to release checkpoints, log‑probabilities, and evaluation data.
By Ali Banaei, Muhammad Shahab Shahzad, Gerald Q. Maguire Jr., Marco Chiesa, Dejan Kosti\'c
The paper demonstrates that fine‑tuning large language models on a single author’s works can trigger the models to reproduce large verbatim excerpts from copyrighted books, even when prompted only with semantic descriptions. Experiments on GPT‑4o, Gemini‑2.5‑Pro, and DeepSeek‑V3.1 show up to 85‑90% recall of held‑out books, with spans exceeding 460 words, and this effect generalizes across authors and model providers. The findings suggest that fine‑tuning reactivates latent memorization from pre‑training, revealing a widespread vulnerability in industry models.
By Xinyue Liu, Niloofar Mireshghallah, Jane C. Ginsburg, Tuhin Chakrabarty
arXiv:2608. 00144v2 Announce Type: replace Abstract: Membership inference (MIA) on language models is usually summarised by aggregate ROC-AUC, but such evaluations are confounded: model-free blind baselines can separate members from non-members using surface text alone.
By Victor Maricato
arXiv:2608. 00144v1 Announce Type: new Abstract: Membership inference (MIA) on language models is usually summarised by an aggregate ROC-AUC, but such evaluations are confounded: model-free blind baselines separate members from non-members from surface text alone.
By Victor Maricato
The paper introduces Word-level Probability MIA (WPMIA), a black-box membership inference attack that estimates word-level generation probabilities via Monte Carlo sampling and local kernel smoothing, then aggregates them into a sequence-level likelihood estimator. By conditioning on different prefixes, WPMIA amplifies distributional differences between member and non-member texts, outperforming existing black-box baselines on open-source LLMs and achieving an average TPR@5%FPR of 42.0 on proprietary models such as GPT‑5‑Chat, Gemini‑2.5‑Flash, and Claude‑4.5‑Haiku.
By Shengjie Niu, Yeheng Ge, Jian Huang
arXiv:2606. 07996v1 Announce Type: cross Abstract: Pretraining is fundamental to the development of Large Language Models (LLMs), yet the opacity of pretraining data complicates model analysis and raises ethical, legal, and fairness concerns.
By Kaixin Lan, Mu You, Tao Fang, Binkai Ou, Lidia S. Chao, Derek F. Wong
arXiv:2607. 12649v1 Announce Type: new Abstract: Recent work on extractable memorization in LLMs suffers from two contrasting validity problems.
By A. Feder Cooper, Marika Swanberg, Jamie Hayes, Lea Duesterwald, Christopher De Sa, Daniel E. Ho, Mark A. Lemley, Percy Liang
The paper introduces inLoRA-MINT, an extension of the LoRA-MINT framework that uses intermediate model representations—such as activations and parameter-dependent signals—to perform Membership Inference Tests on large language models fine‑tuned with LoRA. By leveraging these representations, the method can distinguish training from non‑training samples without full parameter access, achieving 95–98% accuracy across four LLMs (Qwen, Phi‑4, DeepSeek‑V3, LLaMA 3.2‑3B) on medical, mathematical, and academic reasoning datasets. The approach offers a scalable way to audit sensitive training data and supports compliance with emerging privacy and AI governance regulations.
By Gonzalo Mancera, Julian Fierrez, Aythami Morales, Ruben Tolosana, Daniel DeAlcala, Francisco Jurado
arXiv:2506.01732v4 Announce Type: replace
Abstract: Large Language Models (LLMs) are pre-trained on large amounts of data from different sources and domains. Such datasets often contain trillions of...
By Pierre-Carl Langlais, Pavel Chizhov, Catherine Arnett, Carlos Rosas-Hinostroza, Mattia Nee, Eliot Krzystof Jones, Ir\`ene Girard, David Mach, Anastasia Stasenko, Ivan P. Yamshchikov
The paper introduces ATLAS, a likelihood‑based method for model authorship attribution (MAA) that learns how each source family generates text and attributes new text by comparing token‑level likelihoods. It also presents MAABench, a benchmark for evaluating MAA under out‑of‑distribution scenarios such as unseen domains and future model versions. Experiments show ATLAS outperforms existing baselines, achieving 74.27% accuracy on the hardest MAABench setting and correctly identifying teacher models in distillation experiments.
By Minseok Ko, Hyunseok Lee, Woomin Song, Beomjun Kim, Jinwoo Shin, Kunwoong Kim
Large Language Models (LLMs) raise growing concerns about privacy leakage and copyright compliance. Membership inference is a key tool for assessing such risks, but existing studies mainly focus on whether specific samples or sample-based data units are used for training.
arXiv:2606. 17464v1 Announce Type: new Abstract: Membership inference attacks (MIAs) are a canonical way to assess a machine learning model's privacy properties.
By Jeffrey G. Wang, Jason Wang, Marvin Li, Seth Neel