# Exploring the limits of strong membership inference attacks on large language models

arXiv: https://arxiv.org/abs/2505.18773 · HTML: https://mlsanity.com/paper/2505.18773/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- Placed in Membership inference attacks, one of 12 directions in LLM safety and security.
- First posted on arXiv 24 May 2025.

## Placed in

- LLM safety and security / [Membership inference attacks](https://mlsanity.com/safety/membership-inference-attacks/)

## Built on by (most cited first, 22 of 22)

- [Extracting books from production language models](https://mlsanity.com/paper/2601.02671/) (2026)
- [Extracting alignment data in open models](https://mlsanity.com/paper/2510.18554/) (2025)
- [G-Drift MIA: Membership Inference via Gradient-Induced Feature Drift in LLMs](https://mlsanity.com/paper/2604.00419/) (2026)
- [Unlocking Post-hoc Dataset Inference with Synthetic Data](https://mlsanity.com/paper/2506.15271/) (2025)
- [Antidistillation Fingerprinting](https://mlsanity.com/paper/2602.03812/) (2026)
- [TSFMAudit: Data Contamination Auditing in Forecasting Time Series Foundation Models](https://mlsanity.com/paper/2605.26161/) (2026)
- [Quantifying the Effect of Test Set Contamination on Generative Evaluations](https://mlsanity.com/paper/2601.04301/) (2026)
- [VLALeaks: Membership Inference Attacks against Vision-Language-Action Models](https://mlsanity.com/paper/2606.15165/) (2026)
- [Data Compressibility Quantifies LLM Memorization](https://mlsanity.com/paper/2507.06056/) (2025)
- [Estimating near-verbatim extraction risk in language models with decoding-constrained beam search](https://mlsanity.com/paper/2603.24917/) (2026)
- [Privacy Risks in Time Series Forecasting: User- and Record-Level Membership Inference](https://mlsanity.com/paper/2509.04169/) (2025)
- [On the Effectiveness of Membership Inference in Targeted Data Extraction from Large Language Models](https://mlsanity.com/paper/2512.13352/) (2025)
- [Automated Membership Inference Attacks (AutoMIA): Discovering MIA Signal Computations using LLM Agents](https://mlsanity.com/paper/2603.19375/) (2026)
- [Membership Inference Attacks on Vision-Language-Action Models](https://mlsanity.com/paper/2605.07088/) (2026)
- [Reconstruction of Personally Identifiable Information from Proprietary Data in Supervised Fine-Tuned Models](https://mlsanity.com/paper/2605.12264/) (2026)
- [Watermarking for Proprietary Dataset Protection](https://mlsanity.com/paper/2607.00325/) (2026)
- [Extractable Memorization From First Principles](https://mlsanity.com/paper/2607.12649/) (2026)
- [Implicit Reasoning Steering via Concept Chaining](https://mlsanity.com/paper/2607.14242/) (2026)
- [Leak It: Per-Document Extraction Beyond Aggregate Membership Inference](https://mlsanity.com/paper/2608.00144/) (2026)
- [Membership Inference via Pairwise Likelihood Ratios](https://mlsanity.com/paper/2609.12367/) (2026)
- [Memorisation bias in medical AI](https://mlsanity.com/paper/2609.17223/) (2026)
- [The Privacy Fallacy of Crowdsourced Fine-Tuning: Extracting Proprietary Data via Topic-Based Poisoning](https://mlsanity.com/paper/2609.33985/) (2026)

## Abstract (arXiv)

State-of-the-art membership inference attacks (MIAs) typically require training many reference models, making it difficult to scale these attacks to large pre-trained language models (LLMs). As a result, prior research has either relied on weaker attacks that avoid training references (e.g., fine-tuning attacks), or on stronger attacks applied to small models and datasets. However, weaker attacks have been shown to be brittle and insights from strong attacks in simplified settings do not translate to today's LLMs. These challenges prompt an important question: are the limitations observed in prior work due to attack design choices, or are MIAs fundamentally ineffective on LLMs? We address this question by scaling LiRA--one of the strongest MIAs--to GPT-2 architectures ranging from 10M to 1B parameters, training references on over 20B tokens from the C4 dataset. Our results advance the understanding of MIAs on LLMs in four key ways. While (1) strong MIAs can succeed on pre-trained LLMs, (2) their effectiveness, remains limited (e.g., AUC<0.7) in practical settings. (3) Even when strong MIAs achieve better-than-random AUC, aggregate metrics can conceal substantial per-sample MIA decision instability: due to training randomness, many decisions are so unstable that they are statistically indistinguishable from a coin flip. Finally, (4) the relationship between MIA success and related LLM privacy metrics is not as straightforward as prior work has suggested.