arXiv:2608. 00144v2 Announce Type: replace Abstract: Membership inference (MIA) on language models is usually summarised by aggregate ROC-AUC, but such evaluations are confounded: model-free blind baselines can separate members from non-members using surface text alone.
By Victor Maricato
arXiv:2608. 00144v1 Announce Type: new Abstract: Membership inference (MIA) on language models is usually summarised by an aggregate ROC-AUC, but such evaluations are confounded: model-free blind baselines separate members from non-members from surface text alone.
By Victor Maricato
The paper investigates whether language models can identify sentences from their training data by using exact duplication counts from publicly released corpora for two model families, OLMo‑2 and Pythia. It finds that for typical duplication levels, models show only a weak trace of exposure, with a rank correlation near –0.08, and that strong signals only appear when a sentence appears roughly a thousand times, at which point fame rather than memory dominates. The study also demonstrates that common membership tests can be misleading, as changing a single word does not alter the model’s preference, and that controlling for register can significantly improve detector performance.
By Arman Nik Khah
OLMo-Detect is a new benchmark for membership inference attacks (MIAs) on large language models, covering pre‑training, mid‑training, and post‑training stages. It aligns member and non‑member samples on key axes and rigorously filters non‑members using infini‑gram, also offering a shifted variant to test distribution robustness. Evaluation of 15 unsupervised and 3 supervised MIAs on the OLMo 2 family shows limited overall performance (best AUC 0.68), peak detection at mid‑training driven by data type, and sensitivity to distribution shifts, with findings generalizing to OLMo 3 and other models.
By Tao Shi, Chaoyi Xiang, Qiongkai Xu, Jey Han Lau
The study uses a legally obtained dataset of 34 O’Reilly Media books to apply the DE-COP membership inference attack, testing whether OpenAI models recognize non-public, pay-walled content they were not licensed to train on. Results show GPT‑4o exhibits significant recognition of these non-public books (AUROC 0.82), while GPT‑3.5 Turbo and GPT‑4o Mini perform near chance. The findings are robust across paraphrasers and sensitivity analyses, suggesting a need for disclosure of pre‑training data provenance and formal licensing markets for training content.
By Sruly Rosenblat, Tim O'Reilly, Ilan Strauss
The paper introduces Word-level Probability MIA (WPMIA), a black-box membership inference attack that estimates word-level generation probabilities via Monte Carlo sampling and local kernel smoothing, then aggregates them into a sequence-level likelihood estimator. By conditioning on different prefixes, WPMIA amplifies distributional differences between member and non-member texts, outperforming existing black-box baselines on open-source LLMs and achieving an average TPR@5%FPR of 42.0 on proprietary models such as GPT‑5‑Chat, Gemini‑2.5‑Flash, and Claude‑4.5‑Haiku.
By Shengjie Niu, Yeheng Ge, Jian Huang