Research map / Large language models / Language, safety and interpretability
MIA-Tuner: Adapting Large Language Models as Pre-training Text Detector
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MIA-Tuner, which instruction- and soft-prompt-tunes LLMs to act as their own pre-training data detectors, and introduces WIKIMIA-24 (March 2024 cutoff) as an updated membership inference benchmark, plus two defensive safeguards.
Problem
Detecting whether a text was in an LLM's pre-training data (membership inference) is hard for recent LLMs and especially for aligned models, where existing score-based attacks degrade and the WikiMIA benchmark (pre-2023 cutoff) is outdated.
Approach
Instead of designing external MIA score functions, fine-tune a soft prompt plus LoRA-free SFT so the LLM itself answers "Yes"/"No" on whether a text is in its training set (aligned models), or amplifies member/non-member loss gaps via a contrastive loss (unaligned models); also reverse the objectives to defend against MIAs.
Key results
- MIA-Tuner reaches average AUC 0.971 on aligned and 0.980 on unaligned LLMs on WIKIMIA-24, versus about 0.63 and 0.78 for the best baselines.
- Defensive safeguard lowers average AUC of baselines on the privacy-preserving LLM from 0.626 to 0.570 with little MMLU accuracy change.
- With only 60 tuning samples MIA-Tuner exceeds AUC 0.95 on LLaMA-2.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| instruct aligned and unaligned LLMs with MIA-Tuner rather than use the strongest corresponding baseline | LLMs evaluated on WIKIMIA-24 · WIKIMIA-24, aligned LLMs (average) | AUC: 0.633 -> 0.971 | Helped |
| instruct aligned and unaligned LLMs with MIA-Tuner rather than use the strongest corresponding baseline | LLMs evaluated on WIKIMIA-24 · WIKIMIA-24, unaligned LLMs (average) | AUC: 0.775 -> 0.980 | Helped |
| apply the privacy-preserving safeguard before release | LLaMA-2 · pre-training data detection, baselines average | AUC: 0.626 to 0.570 | Hurt |
| apply the privacy-preserving safeguard before release | LLaMA-2 · MMLU | accuracy | No clear effect |
| fine-tune with only 60 labeled samples, 30 member and 30 non-member | MIA-Tuner · LLaMA-2, aligned and unaligned | AUC: exceeding 0.95 | Helped |
| increase pending text length | MIA-Tuner · WIKIMIA-24, text lengths 32, 64, 128, and 256 | AUC | Helped |
| increase target model parameter scale | MIA-Tuner and baselines · WIKIMIA-24, varying model scales | AUC | Helped |
| apply the fine-tuning-stage safeguard after a malicious user's fine-tuning | MIA-Tuner · pre-training data detection | AUC | Hurt |
| apply the fine-tuning-stage safeguard after a benign user's fine-tuning | benign fine-tuning users · customized fine-tuning dataset | PPL | Hurt |
Surprising findings
- All baselines perform noticeably worse on aligned LLMs than on their unaligned counterparts, which the authors attribute to catastrophic forgetting from alignment.
- The reported table shows a 'MIA-Prompter' name for the method in the appendix, inconsistent with 'MIA-Tuner' in the main text.
Limitations
- Requires access to a small labeled set of member and non-member samples and the ability to fine-tune the target model or its API.
- Results rely on a single fixed random seed with no variance or significance tests.
- Defense experiments only use one type of safeguard fine-tuning and the MMLU check covers limited utility effects.
Experimental setup
Datasets: WikiMIA WIKIMIA-24
Benchmarks: WIKIMIA-24 WikiMIA MMLU
Metrics: AUC accuracy fine-tuning PPL
Baselines: PPL Min-K% Min-K%++ Zlib Lowercase Neighbor Smaller Ref
Builds on: Min-K%++ Min-K% prompt tuning instruction tuning NT-Xent
Closest papers by meaning
- Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibration (NeurIPS 2024 · similarity 0.92)
- Exploring the limits of strong membership inference attacks on large language models (NeurIPS 2025 · similarity 0.92)
- Membership Inference Attacks against Large Vision-Language Models (NeurIPS 2024 · similarity 0.91)
- DF-MIA: A Distribution-Free Membership Inference Attack on Fine-Tuned Large Language Models (AAAI 2025 · similarity 0.91)
- LLM Dataset Inference: Did you train on my dataset? (NeurIPS 2024 · similarity 0.89)
- Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.