Research map / Large language models / Language, safety and interpretability
Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SPV-MIA, a membership inference attack on fine-tuned LLMs that builds a self-prompt reference model from the target's own generations and uses a paraphrase-based probabilistic variation signal tied to memorization rather than overfitting.
Problem
Membership inference against fine-tuned LLMs is unreliable in practice: reference-based attacks need a reference dataset closely matching training data, and probability-based signals depend on overfitting, leading to high false-positive rates.
Approach
Fine-tune a reference model on texts the target LLM generates when prompted with domain text chunks (self-prompt calibration), and score membership by probabilistic variation: the average probability of symmetric paraphrases minus the original probability, approximating a second-order derivative to capture memorization-induced local maxima.
Key results
- SPV-MIA reaches average AUC 0.924 across four LLMs and three datasets, versus 0.707 for the best baseline LiRA-Candidate.
- SPV-MIA achieves average TPR@1%FPR of 61.1% on Wiki, 38.7% on AG News and 40.9% on XSum, versus at most 15.8% for baselines.
- Under DP-SGD with epsilon=60, SPV-MIA AUC averages 0.865 on LLaMA, still above baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace LiRA-Candidate with SPV-MIA | Membership inference attack · Wiki, four-model average | AUC: 0.744 -> 0.938 | Helped |
| replace LiRA-Candidate with SPV-MIA | Membership inference attack · AG News, four-model average | AUC: 0.707 -> 0.909 | Helped |
| replace LiRA-Candidate with SPV-MIA | Membership inference attack · XSum, four-model average | AUC: 0.797 -> 0.924 | Helped |
| add practical difficulty calibration (PDC) (ablation) | SPV-MIA · Wiki, GPT-J and LLaMA | AUC: 0.648 -> 0.929; 0.653 -> 0.951 | Helped |
| add practical difficulty calibration (PDC) (ablation) | SPV-MIA · AG News, GPT-J and LLaMA | AUC: 0.632 -> 0.885; 0.641 -> 0.903 | Helped |
| add practical difficulty calibration (PDC) (ablation) | SPV-MIA · XSum, GPT-J and LLaMA | AUC: 0.653 -> 0.897; 0.661 -> 0.937 | Helped |
| add probabilistic variation assessment (PVA) (ablation) | SPV-MIA · Wiki, GPT-J and LLaMA | AUC: 0.901 -> 0.929; 0.913 -> 0.951 | Helped |
| add probabilistic variation assessment (PVA) (ablation) | SPV-MIA · AG News, GPT-J and LLaMA | AUC: 0.864 -> 0.885; 0.885 -> 0.903 | Helped |
| add probabilistic variation assessment (PVA) (ablation) | SPV-MIA · XSum, GPT-J and LLaMA | AUC: 0.873 -> 0.897; 0.919 -> 0.937 | Helped |
| use embedding-domain instead of semantic-domain paraphrasing (ablation) | SPV-MIA · Wiki | AUC: 0.951 -> 0.965 | Helped |
| use embedding-domain instead of semantic-domain paraphrasing (ablation) | SPV-MIA · AG News | AUC: 0.903 -> 0.926 | Helped |
| use embedding-domain instead of semantic-domain paraphrasing (ablation) | SPV-MIA · XSum | AUC: 0.937 -> 0.949 | Helped |
Surprising findings
- Self-prompt reference models trained on text generated from unrelated prompts lose only up to 3.6% AUC, suggesting the attack is largely insensitive to the prompt source.
- Removing the probabilistic variation module only modestly reduces performance, indicating the self-prompt calibration contributes most of the gain.
Limitations
- Designed only for causal language models; adaptation to other LLM types left to future work.
- Relies on fine-tuning with LoRA or full fine-tuning under a fixed recipe (10 epochs, lr 1e-4), with models that do not overfit.
Experimental setup
Datasets: Wikitext-103 AG News XSum Wikicorpus TLDR News CNNDM
Benchmarks: Wikitext-103 AG News XSum
Metrics: AUC TPR@1%FPR TPR@0.1%FPR
Baselines: Loss Attack Neighbour Attack DetectGPT Min-K% Min-K%++ LiRA-Base LiRA-Candidate
Builds on: LiRA neighbour attack Min-K% DetectGPT LoRA
Closest papers by meaning
- Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.93)
- DF-MIA: A Distribution-Free Membership Inference Attack on Fine-Tuned Large Language Models (AAAI 2025 · similarity 0.93)
- MIA-Tuner: Adapting Large Language Models as Pre-training Text Detector (AAAI 2025 · similarity 0.92)
- LLM Dataset Inference: Did you train on my dataset? (NeurIPS 2024 · similarity 0.91)
- Membership Inference Attacks against Large Vision-Language Models (NeurIPS 2024 · similarity 0.90)
- Causal Evaluation of Membership Inference Attacks (NeurIPS 2026 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.