mlsanityData to 7 Oct 2026

Ward: Provable RAG Dataset Inference via LLM Watermarks

arXiv 2410.03537 ↗First posted 4 Oct 2024cs.LG cs.AI cs.CRcited by 15

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

RAG enables LLMs to easily incorporate external data, raising concerns for data owners regarding unauthorized usage of their content. The challenge of detecting such unauthorized usage remains underexplored, with datasets and methods from adjacent fields being ill-suited for its study. We take several steps to bridge this gap. First, we formalize this problem as (black-box) RAG Dataset Inference (RAG-DI). We then introduce a novel dataset designed for realistic benchmarking of RAG-DI methods, alongside a set of baselines. Finally, we propose Ward, a method for RAG-DI based on LLM watermarks that equips data owners with rigorous statistical guarantees regarding their dataset's misuse in RAG corpora. Ward consistently outperforms all baselines, achieving higher accuracy, superior query efficiency and robustness. Our work provides a foundation for future studies of RAG-DI and highlights LLM watermarks as a promising approach to this problem.

Key facts. Cited by 15 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 37 of its 51 references that are in the map. First posted on arXiv 4 Oct 2024.

Builds on

37 of 51 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Models23 Jun
  2. 2024LLM Dataset Inference: Did you train on my dataset?10 Jun
  3. 2024Phantom: General Backdoor Attacks on Retrieval Augmented Language Generation30 May
  4. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  5. 2024Do Membership Inference Attacks Work on Large Language Models?12 Feb
  6. 2021Membership Inference Attacks From First Principles7 Dec
  7. 2021Dataset Inference: Ownership Resolution in Machine Learning21 Apr

Other references · 30

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,462
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  4. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
  5. 2023A Watermark for Large Language Modelscited by 667
  6. 2020Label-Only Membership Inference Attackscited by 371
  7. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  8. 2023Robust Distortion-free Watermarks for Language Modelscited by 279
  9. 2023Provable Robust Watermarking for AI-Generated Textcited by 259
  10. 2023Proving Test Set Contamination in Black Box Language Modelscited by 227
  11. 2023Undetectable Watermarks for Language Modelscited by 208
  12. 2023On the Reliability of Watermarks for Large Language Modelscited by 170
18 more
  1. 2024FlashRAG: A Modular Toolkit for Efficient Retrieval-Augmented Generation Researchcited by 165
  2. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)cited by 159
  3. 2020MedDialog: Two Large-scale Medical Dialogue Datasetscited by 157
  4. 2022Preventing Verbatim Memorization in Language Models Gives a False Sense of Privacycited by 97
  5. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 84
  6. 2023Protecting Language Generation Models via Invisible Watermarkingcited by 81
  7. 2023Flocks of Stochastic Parrots: Differentially Private Prompt Learning for Large Language Modelscited by 80
  8. 2024Watermark Stealing in Large Language Modelscited by 79
  9. 2023The Data Provenance Initiative: A Large Scale Audit of Dataset Licensing & Attribution in AIcited by 73
  10. 2020Radioactive data: tracing through trainingcited by 67
  11. 2023Mark My Words: Analyzing and Evaluating Language Model Watermarkscited by 62
  12. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  13. 2024Watermarking Makes Language Models Radioactivecited by 52
  14. 2024Proving membership in LLM pretraining data via data watermarkscited by 38
  15. 2022Dataset Inference for Self-Supervised Modelscited by 36
  16. 2024Evading Data Contamination Detection for Language Models is (too) Easycited by 30
  17. 2024RepLiQA: A Question-Answering Dataset for Benchmarking LLMs on Unseen Reference Contentcited by 26
  18. 2021Paraphrastic Representations at Scalecited by 19

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 11; 2026: 4.

15 papers.

Sort:

By area:

  1. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 29
  2. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generationcited by 26
  3. 2025Watermarking Autoregressive Image Generationcited by 15
  4. 2025Who Stole Your Data? A Method for Detecting Unauthorized RAG Theftcited by 15
  5. 2025LLM Fingerprinting via Semantically Conditioned Watermarkscited by 7
  6. 2025Position: LLM Watermarking Should Align Stakeholders' Incentives for Practical Adoptioncited by 7
  7. 2025RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Modelscited by 6
  8. 2025Detecting Benchmark Contamination Through Watermarkingcited by 6
  9. 2025ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generationcited by 4
  10. 2025How Good is Post-Hoc Watermarking With Language Model Rephrasing?cited by 2
  11. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systemscited by 2
  12. 2026TextSeal: A Localized LLM Watermark for Provenance & Distillation Protectioncited by 2
3 more
  1. 2025Safeguarding Multimodal Knowledge Copyright in the RAG-as-a-Service Environmentcited by 1
  2. 2026Retrieved But Not Reliable: A Survey on Attacks, and Defenses in Retrieval-Augmented Generationcited by 0
  3. 2026Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAGcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025RAGPulse: An Open-Source RAG Workload Trace to Optimize RAG Serving Systems
  2. 2026SentinelRAG: Synthetic Sentinel Knowledge for RAG Database Copyright Protection
  3. 2025QE-RAG: A Robust Retrieval-Augmented Generation Benchmark for Query Entry Errors
  4. 2024Enhancing LLM Factual Accuracy with RAG to Counter Hallucinations: A Case Study on Domain-Specific Queries in Private Knowledge-Bases
  5. 2024RAG Foundry: A Framework for Enhancing LLMs for Retrieval Augmented Generation
  6. 2025Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs
  7. 2025Worse than Zero-shot? A Fact-Checking Dataset for Evaluating the Robustness of RAG Against Misleading Retrievals
  8. 2026ScalableRAG: High-Quality RAG at Zero Ingestion Cost