mlsanityData to 7 Oct 2026

Sampling-based Pseudo-Likelihood for Membership Inference Attacks

arXiv 2404.11262 ↗First posted 17 Apr 2024cs.CLcited by 18

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Large Language Models (LLMs) are trained on large-scale web data, which makes it difficult to grasp the contribution of each text. This poses the risk of leaking inappropriate data such as benchmarks, personal information, and copyrighted texts in the training data. Membership Inference Attacks (MIA), which determine whether a given text is included in the model's training data, have been attracting attention. Previous studies of MIAs revealed that likelihood-based classification is effective for detecting leaks in LLMs. However, the existing methods cannot be applied to some proprietary models like ChatGPT or Claude 3 because the likelihood is unavailable to the user. In this study, we propose a Sampling-based Pseudo-Likelihood (SPL) method for MIA (SaMIA) that calculates SPL using only the text generated by an LLM to detect leaks. The SaMIA treats the target text as the reference text and multiple outputs from the LLM as text samples, calculates the degree of n-gram match as SPL, and determines the membership of the text in the training data. Even without likelihoods, SaMIA performed on par with existing likelihood-based methods.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 26 of its 39 references that are in the map. First posted on arXiv 17 Apr 2024.

Builds on

26 of 39 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparison29 May

Other references · 25

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  4. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  5. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  6. 2020Extracting Training Data from Large Language Modelscited by 2,144
  7. 2023Pythia: A Suite for Analyzing Large Language Models Across Training and Scalingcited by 1,734
  8. 2023The Falcon Series of Open Language Modelscited by 526
  9. 2023Who's Harry Potter? Approximate Unlearning in LLMscited by 366
  10. 2022Deduplicating Training Data Mitigates Privacy Risks in Language Modelscited by 309
  11. 2022Are Large Pre-Trained Language Models Leaking Your Personal Information?cited by 195
  12. 2023Don't Make Your LLM an Evaluation Benchmark Cheatercited by 194
13 more
  1. 2023DNA-GPT: Divergent N-Gram Analysis for Training-Free Detection of GPT-Generated Textcited by 127
  2. 2021How much do language models copy from their training data? Evaluating linguistic novelty in text generation using RAVENcited by 124
  3. 2022Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacycited by 97
  4. 2024DE-COP: Detecting Copyrighted Content in Language Models Training Datacited by 72
  5. 2023Bag of Tricks for Training Data Extraction from Language Modelscited by 67
  6. 2024Evaluating Gender Bias in Large Language Models via Chain-of-Thought Promptingcited by 49
  7. 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
  8. 2023Evaluating Gender Bias of Pre-trained Language Models in Natural Language Inference by Considering All Labelscited by 16
  9. 2021Revisiting Simple Neural Probabilistic Language Modelscited by 10
  10. 2024A Little Leak Will Sink a Great Ship: Survey of Transparency for Large Language Models from Start to Finishcited by 6
  11. 2024The Gaps between Pre-train and Downstream Settings in Bias Evaluation and Debiasingcited by 5
  12. 2024Eagle: Ethical Dataset Given from Real Interactionscited by 3
  13. 2022Are Neighbors Enough? Multi-Head Neural n-gram can be Alternative to Self-attentioncited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 5; 2025: 6; 2026: 7.

18 papers.

Sort:

By area:

  1. 2024SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It)cited by 54
  2. 2024Detecting Training Data of Large Language Models via Expectation Maximizationcited by 13
  3. 2024A Statistical and Multi-Perspective Revisiting of the Membership Inference Attack in Large Language Modelscited by 5
  4. 2025Revisiting Privacy, Utility, and Efficiency Trade-offs when Fine-Tuning Large Language Modelscited by 5
  5. 2025Can We Infer Confidential Properties of Training Data from LLMs?cited by 4
  6. 2024Quantifying Memorization and Detecting Training Data of Pre-trained Language Models using Japanese Newspapercited by 2
  7. 2024How Privacy-Savvy Are Large Language Models? A Case Study on Compliance and Privacy Technical Reviewcited by 2
  8. 2026Membership Inference on LLMs in the Wildcited by 2
  9. 2026Reverse-Engineering Model Editing on Language Modelscited by 2
  10. 2025Learning-to-Context Slope: Evaluating In-Context Learning Effectiveness Beyond Performance Illusionscited by 1
  11. 2025Layer-Wise Perturbations via Sparse Autoencoders for Adversarial Text Generationcited by 1
  12. 2025Bits Leaked per Query: Information-Theoretic Bounds on Adversarial Attacks against LLMscited by 1
6 more
  1. 2026AI Security in the Foundation Model Era: A Comprehensive Survey from a Unified Perspectivecited by 1
  2. 2026Pretraining Data Exposure in Large Language Models: A Survey of Membership Inference, Data Contamination, and Security Implicationscited by 1
  3. 2025EL-MIA: Quantifying Membership Inference Risks of Sensitive Entities in LLMscited by 0
  4. 2026Provable Joint Decontamination for Benchmarking Multiple Large Language Modelscited by 0
  5. 2026In-Context Learning as Implicit Policy Gradientcited by 0
  6. 2026Leak It: Per-Document Extraction Beyond Aggregate Membership Inferencecited by 0