Search Results for « Membership Inference »

Retrieval-Augmented Generation (RAG) enables Large Language Models (LLMs) to generate grounded responses by leveraging external knowledge databases without altering model parameters. Although the absence of weight tuning prevents leakage via model parameters, it introduces the risk of inference adversaries exploiting retrieved documents in the model's context. Existing methods for membership inference and data extraction often rely on jailbreaking or carefully crafted unnatural queries, which can be easily detected or thwarted with query rewriting techniques common in RAG systems. In this work, we present Interrogation Attack (IA), a membership inference technique targeting documents in the RAG datastore. By crafting natural-text queries that are answerable only with the target document's presence, our approach demonstrates successful inference with just 30 queries while remaining stealthy; straightforward detectors identify adversarial prompts from existing methods up to ~76x more frequently than those generated by our attack. We observe a 2x improvement in TPR@1%FPR over prior inference attacks across diverse RAG configurations, all while costing less than $0.02 per document inference.

Membership inference asks whether a candidate example participated in a model's training set and provides an important tool for empirical privacy auditing. Many strong attacks rely on statistics observed only at the final model checkpoint, potentially discarding information contained in how a candidate's behavior evolves during optimization. We introduce MA-LiRA, a checkpoint-aware membership-inference attack that exploits this training history. For each labeled candidate, MA-LiRA constructs a compact five-dimensional representation from its checkpoint-wise loss trajectory, capturing endpoint fit, overall learning progress, local trajectory irregularity, and temporally weighted changes. Each feature is calibrated using candidate-specific member and non-member shadow distributions, and the resulting likelihood-ratio coordinates are combined by a fusion model trained exclusively from shadow-derived pseudo-target examples, without using target membership labels for fitting or threshold selection. We evaluate MA-LiRA on CIFAR-10, CIFAR-100, and SVHN against a broad set of score-based, calibrated, likelihood-ratio, and trajectory-based membership-inference baselines. Across the evaluated datasets, MA-LiRA consistently improves overall membership discrimination and low-falsepositive-rate detection under the stated checkpoint-aware access model. These results indicate that training-history information can provide membership evidence beyond that available from a final-checkpoint statistic alone.

Self-supervised learning shows promise in harnessing extensive unlabeled data, but it also confronts significant privacy concerns, especially in vision. In this paper, we perform membership inference on visual self-supervised models in a more realistic setting: self-supervised training method and details are unknown for an adversary when attacking as he usually faces a black-box system in practice. In this setting, considering that self-supervised model could be trained by completely different self-supervised paradigms, e.g., masked image modeling and contrastive learning, with complex training details, we propose a unified membership inference method called PartCrop. It is motivated by the shared part-aware capability among models and stronger part response on the training data. Specifically, PartCrop crops parts of objects in an image to query responses within the image in representation space. We conduct extensive attacks on self-supervised models with different training protocols and structures using three widely used image datasets. The results verify the effectiveness and generalization of PartCrop. Moreover, to defend against PartCrop, we evaluate two common approaches, i.e., early stop and differential privacy, and propose a tailored method called shrinking crop scale range. The defense experiments indicate that all of them are effective. Finally, besides prototype testing on toy visual encoders and small-scale image datasets, we quantitatively study the impacts of scaling from both data and model aspects in a realistic scenario and propose a scalable PartCrop-v2 by introducing two structural improvements to PartCrop. Our code is at https://github.com/JiePKU/PartCrop.

We study causal inference for spatial aggregates when treatment changes not only outcomes within places but also who belongs where. A valid experimental or quasi-experimental design may identify the treatment-specific distribution of spatial membership while leaving latent the joint counterfactual coupling that links each individual's location across regimes. This distinction matters for geographic scale: a move between fine locations inside the same coarse area is visible at the fine scale but disappears after coarsening. We represent all couplings consistent with the identified margins by a transportation polytope and derive sharp bounds for fine-level, cross-boundary, and within-block reallocation. Although fine reallocation decomposes into cross-boundary and within-block movement for any fixed coupling, the separately optimized sharp endpoints need not decompose; we derive a closed-form lower bound for the within-block component. The endpoint map is piecewise linear and can be non-smooth at equal-margin and multiple-optimum configurations, so we establish directional differentiability and feasible multiplier inference based on estimated directional derivatives. Monte Carlo experiments show that ordinary bootstrap inference works in regular interiors but can severely under-cover at nonregular boundaries, whereas the directional procedure maintains high coverage. In the randomized seasonal-migration experiment of Bryan et al. (2014), the complete-case destination margins under incentive assignment imply a fine-destination reallocation identified set of [0.222, 0.933], showing that experimentally generated spatial margins can remain sharply informative without identifying household-level cross-regime matching. In a separate randomized destination assignment, the Bogra-Tangail contrast has a fine lower bound of 0.274 and a coarse migrate/stay lower bound of 0.019, an attenuation of 0.255; its simultaneous directional interval is [0.133, 0.377], and the observed contrast is also extreme under the strictest restricted familywise randomization reference used in the analysis.

We characterize twisted right-angled Artin groups (T-RAAGs) that are subgroup separable using only their defining mixed graphs: such a group is subgroup separable if and only if the underlying simplicial graph contains neither induced paths nor squares on four vertices. This generalizes the results of Metaftsis-Raptis on classical right-angled Artin groups. Additionally, we show that the subgroup membership problem is decidable when the group is coherent, which occurs precisely when the defining mixed graph is chordal. We also address the rational and submonoid membership problems by exhibiting a cone-family of graphs for which the corresponding T-RAAGs have decidable rational and submonoid membership problems.

Membership inference asks whether a candidate example participated in a model's training set and provides an important tool for empirical privacy auditing. Many strong attacks rely on statistics observed only at the final model checkpoint, potentially discarding information contained in how a candidate's behavior evolves during optimization. We introduce MA-LiRA, a checkpoint-aware membership-inference attack that exploits this training history. For each labeled candidate, MA-LiRA constructs a compact five-dimensional representation from its checkpoint-wise loss trajectory, capturing endpoint fit, overall learning progress, local trajectory irregularity, and temporally weighted changes. Each feature is calibrated using candidate-specific member and non-member shadow distributions, and the resulting likelihood-ratio coordinates are combined by a fusion model trained exclusively from shadow-derived pseudo-target examples, without using target membership labels for fitting or threshold selection. We evaluate MA-LiRA on CIFAR-10, CIFAR-100, and SVHN against a broad set of score-based, calibrated, likelihood-ratio, and trajectory-based membership-inference baselines. Across the evaluated datasets, MA-LiRA consistently improves overall membership discrimination and low-falsepositive-rate detection under the stated checkpoint-aware access model. These results indicate that training-history information can provide membership evidence beyond that available from a final-checkpoint statistic alone.

We consider the bit-probe complexity of the set membership problem, where a set S of size at most n from a universe of size m is to be represented as a short bit vector in order to answer membership queries of the form "Is x in S?" by adaptively probing the bit vector at t places. Let s(m,n,t) be the minimum number of bits of storage needed for such a scheme. Several recent works investigate s(m,n,t) for various ranges of the parameter; we obtain improvements over some of the bounds shown by Buhrman, Miltersen, Radhakrishnan, and Srinivasan (2002) and Alon and Feige (2009).

Generative artificial intelligence has transformed the generation of synthetic data, providing innovative solutions to challenges like data scarcity and privacy, which are particularly critical in fields such as medicine. However, the effective use of this synthetic data to train high-performance models remains a significant challenge. This paper addresses this issue by introducing Knowledge Recycling (KR), a pipeline designed to optimise the generation and use of synthetic data for training downstream classifiers. At the heart of this pipeline is Generative Knowledge Distillation, the proposed technique that significantly improves the quality and usefulness of the information provided to classifiers through a synthetic dataset regeneration and soft labelling mechanism. The KR pipeline has been tested on a variety of datasets, with a focus on six highly heterogeneous medical image datasets, ranging from retinal images to organ scans. The results show a significant reduction in the performance gap between models trained on real and synthetic data, with models based on synthetic data outperforming those trained on real data in some cases. Furthermore, the resulting models show almost complete immunity to Membership Inference Attacks, manifesting privacy properties missing in models trained with conventional techniques.

Stellar streams provide one of the most promising avenues for constraining the global mass distribution of the Milky Way and the nature of dark matter (DM). The stream stars' kinematic "track" enables inference of large-scale properties of the DM distribution, while density variations and anomalies provide information about local DM clumps (e.g., from DM subhalos). Using precise astrometric data from the Gaia Mission, which enables clean selections of Milky Way stream stars, we now know of a few streams with perturbations and density anomalies. A full accounting of the density tracks and substructures within all $>100$ Milky Way stellar streams will therefore enable powerful new constraints on DM. However, methods for discovering and characterizing membership of streams are heterogeneous and often highly customized to individual streams. Here, we present a new, flexible framework for modeling stellar stream density and membership. With it, one can empirically model a given stream in a variety of coordinate spaces (\eg on-sky position and velocity) using probability distributions, thereby generating membership probabilities. The most significant improvement over previous methods is the inclusion of off-track or non-Gaussian components to the stream density, meaning we can capture anomalous features (such as the GD-1 steam's spur). We test our model on GD-1, where we characterize previously-known features and provide the largest catalog of probable member stars to date (1689 stars). We then use the derived model to provide measurements of GD-1's density and kinematic tracks, velocity dispersion, as well as its initial and current mass. Our framework (built on JAX and numpyro) provides a path toward uniform analysis of all Milky Way streams, enabling tight constraints on the Galactic mass distribution and its dark matter.