mlsanityData to 7 Oct 2026

What Really is a Member? Discrediting Membership Inference via Poisoning

arXiv 2506.06003 ↗First posted 6 Jun 2025cs.LG cs.CRcited by 2

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Membership inference tests aim to determine whether a particular data point was included in a language model's training set. However, recent works have shown that such tests often fail under the strict definition of membership based on exact matching, and have suggested relaxing this definition to include semantic neighbors as members as well. In this work, we show that membership inference tests are still unreliable under this relaxation - it is possible to poison the training dataset in a way that causes the test to produce incorrect predictions for a target point. We theoretically reveal a trade-off between a test's accuracy and its robustness to poisoning. We also present a concrete instantiation of this poisoning attack and empirically validate its effectiveness. Our results show that it can degrade the performance of existing tests to well below random.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 23 of its 39 references that are in the map. First posted on arXiv 6 Jun 2025.

Builds on

23 of 39 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024Membership Inference Attacks Cannot Prove that a Model Was Trained On Your Data29 Sep
  2. 2024Noisy Neighbors: Efficient membership inference attacks against LLMs24 Jun
  3. 2024Blind Baselines Beat Membership Inference Attacks for Foundation Models23 Jun
  4. 2024LLM Dataset Inference: Did you train on my dataset?10 Jun
  5. 2024Do Membership Inference Attacks Work on Large Language Models?12 Feb
  6. 2023Membership Inference Attacks against Language Models via Neighbourhood Comparison29 May
  7. 2021Enhanced Membership Inference Attacks against Machine Learning Models18 Nov

Other references · 16

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2020Extracting Training Data from Large Language Modelscited by 2,144
  6. 2023Pythia: A Suite for Analyzing Large Language Models Across Training and Scalingcited by 1,734
  7. 2022MTEB: Massive Text Embedding Benchmarkcited by 623
  8. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  9. 2024Multilingual E5 Text Embeddings: A Technical Reportcited by 357
  10. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  11. 2022What Does it Mean for a Language Model to Preserve Privacy?cited by 194
  12. 2024Persistent Pre-Training Poisoning of LLMscited by 46
4 more
  1. 2017Adversarial Example Defenses: Ensembles of Weak Defenses are not Strongcited by 32
  2. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 28
  3. 2025Language Models May Verbatim Complete Text They Were Not Explicitly Trained Oncited by 20
  4. 2025PoisonedParrot: Subtle Data Poisoning Attacks to Elicit Copyright-Infringing Content from Large Language Modelscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Information-Theoretic Privacy Control for Sequential Multi-Agent LLM Systemscited by 8
  2. 2026Quantifying the Effect of Test Set Contamination on Generative Evaluationscited by 1