mlsanityData to 7 Oct 2026

Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks

arXiv 2203.03929 ↗First posted 8 Mar 2022cs.LG cs.AI cs.CRcited by 168

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

The wide adoption and application of Masked language models~(MLMs) on sensitive data (from legal to medical) necessitates a thorough quantitative investigation into their privacy vulnerabilities -- to what extent do MLMs leak information about their training data? Prior attempts at measuring leakage of MLMs via membership inference attacks have been inconclusive, implying the potential robustness of MLMs to privacy attacks. In this work, we posit that prior attempts were inconclusive because they based their attack solely on the MLM's model score. We devise a stronger membership inference attack based on likelihood ratio hypothesis testing that involves an additional reference MLM to more accurately quantify the privacy risks of memorization in MLMs. We show that masked language models are extremely susceptible to likelihood ratio membership inference attacks: Our empirical results, on models trained on medical notes, show that our attack improves the AUC of prior membership inference attacks from 0.66 to an alarmingly high 0.90 level, with a significant improvement in the low-error region: at 1% false positive rate, our attack is 51X more powerful than prior work.

Key facts. Cited by 168 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 35 of its 47 references that are in the map. First posted on arXiv 8 Mar 2022.

Builds on

35 of 47 references.

Closest ancestors · 4

Same direction, newest first

  1. 2021Membership Inference Attacks From First Principles7 Dec
  2. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov
  3. 2021Membership Inference on Word Embedding and Beyond21 Jun
  4. 2021Membership Inference Attack Susceptibility of Clinical Language Models16 Apr

Other references · 31

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  3. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  4. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  7. 2020Extracting Training Data from Large Language Modelscited by 2,144
  8. 2019BioBERT: a pre-trained biomedical language representation model for biomedical text miningcited by 1,935
  9. 2020Domain-Specific Language Model Pretraining for Biomedical Natural Language Processingcited by 996
  10. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
  11. 2020A Primer in BERTology: What we know about how BERT workscited by 807
  12. 2022Quantifying Memorization Across Neural Language Modelscited by 755
19 more
  1. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 475
  2. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
  3. 2019Transfer Learning in Biomedical Natural Language Processing: An Evaluation of BERT and ELMo on Ten Benchmarking Datasetscited by 298
  4. 2020Information Leakage in Embedding Modelscited by 199
  5. 2022What Does it Mean for a Language Model to Preserve Privacy?cited by 194
  6. 2021Adversary Instantiation: Lower Bounds for Differentially Private Machine Learningcited by 193
  7. 2020FinBERT: A Pretrained Language Model for Financial Communicationscited by 161
  8. 2019Updates-Leak: Data Set Inference and Reconstruction Attacks in Online Learningcited by 117
  9. 2020Revisiting Membership Inference Under Realistic Assumptionscited by 108
  10. 2021Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?cited by 91
  11. 2019Analyzing Information Leakage of Updates to Natural Language Modelscited by 89
  12. 2016De-identification of Patient Notes with Recurrent Neural Networkscited by 88
  13. 2020Privacy in Deep Learning: A Surveycited by 70
  14. 2019Membership Inference Attacks on Sequence-to-Sequence Models: Is My Data In Your Machine Translation System?cited by 68
  15. 2020ML Privacy Meter: Aiding Regulatory Compliance by Quantifying the Privacy Risks of Machine Learningcited by 66
  16. 2021Exposing the Implicit Energy Networks behind Masked Language Models via Metropolis--Hastingscited by 37
  17. 2021Privacy Regularization: Joint Privacy-Utility Optimization in Language Modelscited by 29
  18. 2017Towards Measuring Membership Privacycited by 27
  19. 2018Auditing Data Provenance in Text-Generation Modelscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 6; 2023: 31; 2024: 56; 2025: 46; 2026: 29.

168 papers.

Sort:

By area:

  1. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  2. 2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 380
  3. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  4. 2023Analyzing Leakage of Personally Identifiable Information in Language Modelscited by 278
  5. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparisoncited by 249
  6. 2023Large Language Model Alignment: A Surveycited by 241
  7. 2022Memorization Without Overfitting: Analyzing the Training Dynamics of Large Language Modelscited by 218
  8. 2025Large Language Model Agent: A Survey on Methodology, Applications and Challengescited by 194
  9. 2024Do Membership Inference Attacks Work on Large Language Models?cited by 188
  10. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 179
  11. 2024Min-K%++: Improved Baseline for Detecting Pre-Training Data from Large Language Modelscited by 102
  12. 2022Truth Serum: Poisoning Machine Learning Models to Reveal Their Secretscited by 94
38 more
  1. 2024Investigating Data Contamination for Pre-training Language Modelscited by 91
  2. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 90
  3. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 87
  4. 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Modelscited by 77
  5. 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 72
  6. 2023Jais and Jais-chat: Arabic-Centric Foundation and Instruction-Tuned Open Generative Large Language Modelscited by 68
  7. 2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 61
  8. 2023DP-OPT: Make Large Language Model Your Privacy-Preserving Prompt Engineercited by 56
  9. 2024UNDIAL: Self-Distillation with Adjusted Logits for Robust Unlearning in Large Language Modelscited by 49
  10. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  11. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 44
  12. 2022Memorization in NLP Fine-tuning Methodscited by 43
  13. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
  14. 2023Bounding Training Data Reconstruction in DP-SGDcited by 42
  15. 2024Private Fine-tuning of Large Language Models with Zeroth-order Optimizationcited by 41
  16. 2024LLM-PBE: Assessing Data Privacy in Large Language Modelscited by 38
  17. 2023Ethicist: Targeted Training Data Extraction Through Loss Smoothed Soft Prompting and Calibrated Confidence Estimationcited by 36
  18. 2023User Inference Attacks on Large Language Modelscited by 36
  19. 2024Copyright Traps for Large Language Modelscited by 36
  20. 2023Smaller Language Models are Better Black-box Machine-Generated Text Detectorscited by 35
  21. 2024Elephants Never Forget: Memorization and Learning of Tabular Data in Large Language Modelscited by 34
  22. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 34
  23. 2024ConStat: Performance-Based Contamination Detection in Large Language Modelscited by 33
  24. 2023Identifying and Mitigating Privacy Risks Stemming from Language Models: A Surveycited by 30
  25. 2024Evading Data Contamination Detection for Language Models is (too) Easycited by 30
  26. 2024Evaluation data contamination in LLMs: how do we measure it and (when) does it matter?cited by 30
  27. 2024Undesirable Memorization in Large Language Models: A Surveycited by 29
  28. 2023Traces of Memorisation in Large Language Models for Codecited by 26
  29. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  30. 2024Does Data Contamination Detection Work (Well) for LLMs? A Survey and Evaluation on Detection Assumptionscited by 26
  31. 2024Digger: Detecting Copyright Content Mis-usage in Large Language Model Trainingcited by 24
  32. 2024Probing Language Models for Pre-training Data Detectioncited by 24
  33. 2024Data Contamination Calibration for Black-box LLMscited by 23
  34. 2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
  35. 2024Generated Data with Fake Privacy: Hidden Dangers of Fine-tuning Large Language Models on Generated Datacited by 21
  36. 2024Con-ReCall: Detecting Pre-training Data in LLMs via Contrastive Decodingcited by 20
  37. 2024Context-Aware Membership Inference Attacks against Pre-trained Large Language Modelscited by 20
  38. 2025The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaborationcited by 19

50 most cited of 168 All 168 (JSON)