Research map / Adversarial robustness and security / Black-box and transfer attacks
Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes KCMP, a black-box membership inference attack on LVLMs that probes memorization via masked shape/color multiple-choice tasks filtered by prior-knowledge calibration, using only generated text.
Problem
Membership inference against large vision-language models under black-box access (only generated text), where existing MIAs need logits or likelihoods and memorization is confounded with generalization from world knowledge.
Approach
Build semantic mask-prediction and color-recovery multiple-choice probes for segmented objects with confounding distractors, filter out probes solvable from general knowledge (CLIP relevance plus LLM rationality scores), and score membership by the target LVLM's accuracy on the retained probes.
Key results
- On VL-MIA/Flickr at K=10, KCMP averages 0.794 AUC for LLaVA versus 0.514 for the black-box Image Infer baseline (Rouge).
- At K=50 on MiniGPT-4, KCMP reaches 0.980 AUC against 0.997 for gray-box MaxRényi-K%.
- On closed-source GPT-4o-mini, Gemini-1.5 and Claude-3 pilot benchmark, KCMP reaches AUC 0.566, 0.572 and 0.561.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use KCMP instead of Image Infer (Rouge) | VL-MIA membership inference · VL-MIA/Flickr, K=10 | AUC: 0.514 -> 0.794 | Helped |
| Use KCMP instead of Image Infer (Rouge) | VL-MIA membership inference · VL-MIA/DALL-E, K=10 | AUC: 0.511 -> 0.700 | Helped |
| Add prior-knowledge filtering (ablation) | KCMP · VL-MIA/DALL-E | AUC | Helped |
| Combine object and color probes rather than using either alone (ablation) | KCMP · VL-MIA/DALL-E | AUC | Helped |
| Increase the number of confidence-evaluation tasks up to N = 12 (ablation) | KCMP · VL-MIA/DALL-E | AUC | Helped |
| Use object-level rather than image-level color probes (ablation) | KCMP-Color · VL-MIA/Flickr and VL-MIA/DALL-E | AUC: 0.496 -> 0.534; 0.487 -> 0.567; 0.505 -> 0.530; 0.503 -> 0.547; 0.477 -> 0.533; 0.511 -> 0.569 | Helped |
| Reduce repeated queries from R=4 to R=2 (ablation) | KCMP · VL-MIA/Flickr | AUC: 0.598 -> 0.585; 0.573 -> 0.560; 0.544 -> 0.515 | Mixed |
| Simplify KCMP by removing CLIP ranking and calibration and replacing the probe generator (ablation) | KCMP · VL-MIA/Flickr and VL-MIA/DALL-E | AUC: 0.598 -> 0.565; 0.573 -> 0.554; 0.544 -> 0.539; 0.565 -> 0.551; 0.568 -> 0.522; 0.543 -> 0.515 | Hurt |
| Replace sam2.1_hiera_large with sam2.1_hiera_tiny (ablation) | KCMP · VL-MIA/Flickr and VL-MIA/DALL-E | AUC: 0.598 -> 0.597; 0.573 -> 0.570; 0.544 -> 0.545; 0.565 -> 0.561; 0.568 -> 0.550; 0.543 -> 0.545 | No clear effect |
| Use lower-parameter CLIP encoders for saliency ranking (ablation) | KCMP · VL-MIA/Flickr and VL-MIA/DALL-E | AUC: 0.598 -> 0.585; 0.573 -> 0.555; 0.544 -> 0.547; 0.565 -> 0.558; 0.568 -> 0.560; 0.543 -> 0.527 | No clear effect |
| Increase sampling temperature from 0.3 to 0.8 (ablation) | KCMP · VL-MIA/Flickr | AUC: 0.598 -> 0.614; 0.573 -> 0.574; 0.544 -> 0.541 | Mixed |
Surprising findings
- At sample level (K=1), KCMP AUC is near chance on most models, and performance depends on aggregating many samples into dataset-level inference.
- On the DAM-based benchmark, KCMP does not reach the accuracy of gray-box Min-K% and only approaches Max-Prob-Gap.
Limitations
- Designed for natural images with rich semantics; less applicable to medical scans or document images.
- Sample-level AUC is modest (about 0.57 average at K=1), with strong gains only after aggregating across samples.
- Relies on GPT-4o and GPT-o1 for probe generation and rationality scoring, adding API cost and dependence on closed models.
Experimental setup
Datasets: VL-MIA/Flickr VL-MIA/DALL-E DAM COCOStuff-based benchmark
Benchmarks: VL-MIA/Flickr VL-MIA/DALL-E DAM-based benchmark
Metrics: AUC accuracy TPR/FPR
Baselines: Perplexity Aug-KL Max-Prob-Gap Min-K% ModRényi MaxRényi-K% Image Infer
Builds on: Min-K% MaxRényi-K% Image Infer SAM
Closest papers by meaning
- Membership Inference Attacks against Large Vision-Language Models (NeurIPS 2024 · similarity 0.92)
- Vid-SME: Membership Inference Attacks against Large Video Understanding Models (NeurIPS 2025 · similarity 0.89)
- Pandora's Box: Towards Building Universal Attackers against Real-World Large Vision-Language Models (NeurIPS 2024 · similarity 0.89)
- A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1 (NeurIPS 2025 · similarity 0.89)
- MIA-Tuner: Adapting Large Language Models as Pre-training Text Detector (AAAI 2025 · similarity 0.88)
- Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.