Research map / Large language models / Instruction and fine-tuning
DF-MIA: A Distribution-Free Membership Inference Attack on Fine-Tuned Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DF-MIA, a distribution-free membership inference attack on fine-tuned LLMs that builds a reference dataset from the test samples via weight-based augmentation and perturbation, then fine-tunes the base model on it for loss calibration.
Problem
Membership inference against fine-tuned LLMs is hard because reference-based calibration typically requires the training data distribution, and low-loss non-members may come from the pretraining data.
Approach
Use the samples under test as the reference dataset for fine-tuning the base model; upweight likely non-members via softmax-weighted replication using a primary attack's scores, and perturb high-weight samples to reduce the influence of false-negative members, then calibrate losses with the resulting reference model.
Key results
- DF-MIA reaches AUC 0.879 on GPT-Neo-1.3B AGNews versus 0.821 for the strongest baseline (LiRA-Candidate).
- On XSum with GPT-Neo, TPR@1%FPR is 26.9% for DF-MIA versus 11.3% for LiRA-Candidate.
- Ablation on GPT-Neo-1.3B AGNews shows AUC drops from 0.879 to 0.803 without data augmentation and to 0.844 without perturbation.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply DF-MIA instead of LiRA-Candidate | MIA on fine-tuned LLMs · AGNews, Wikitext-103, and XSum | AUC: 0.821 -> 0.879; 0.813 -> 0.884; 0.767 -> 0.836; 0.743 -> 0.849; 0.726 -> 0.839; 0.696 -> 0.810; 0.879 -> 0.903; 0.794 -> | Helped |
| Apply DF-MIA instead of LiRA-Candidate | MIA on fine-tuned LLMs · AGNews, Wikitext-103, and XSum | TPR@1%FPR: 4.6% -> 9.8%; 3.0% -> 10.2%; 3.2% -> 7.4%; 3.7% -> 5.9%; 3.3% -> 5.8%; 3.4% -> 8.4%; 11.3% -> 26.9%; 10.2% -> 22.8%; 9.1 | Helped |
| Add weight-based data augmentation (ablation) | DF-MIA on GPT-Neo-1.3B · AGNews | AUC: 0.803 -> 0.879 | Helped |
| Add perturbation on high-weight data (ablation) | DF-MIA on GPT-Neo-1.3B · AGNews | AUC: 0.844 -> 0.879 | Helped |
| Add weight-based data augmentation and perturbation (ablation) | Neighbor Attack on GPT-Neo-1.3B · AGNews | AUC: 0.754 -> 0.879 | Helped |
| Add weight-based data augmentation and perturbation (ablation) | Neighbor Attack on GPT-Neo-1.3B · AGNews | TPR@1%FPR: 2.1% -> 9.8% | Helped |
Surprising findings
- Reference-based calibration with the target's own test samples outperforms LiRA-Candidate, which uses a distribution-matched reference dataset.
Limitations
- Performance depends on the choice of primary attack and is capped by false-negative members in the reference set.
- Tested only on three datasets and three models with black-box access assumptions; robustness shown only against DP-SGD.
Experimental setup
Datasets: Wikitext-103 AGNews XSum
Benchmarks: Wikitext-103 AGNews XSum
Metrics: AUC TPR@1%FPR
Baselines: Loss Attack Neighbor Attack Min-k% Attack LiRA-Base LiRA-Candidate
Builds on: Loss Attack Neighbor Attack LiRA Min-k% Prob
Closest papers by meaning
- Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration (NeurIPS 2024 · similarity 0.93)
- LLM Dataset Inference: Did you train on my dataset? (NeurIPS 2024 · similarity 0.91)
- MIA-Tuner: Adapting Large Language Models as Pre-training Text Detector (AAAI 2025 · similarity 0.91)
- Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.91)
- Membership Inference Attacks against Large Vision-Language Models (NeurIPS 2024 · similarity 0.89)
- Impact of Dataset Properties on Membership Inference Vulnerability of Deep Transfer Learning (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.