mlsanityData to 14 Oct 2026

SMA: Who Said That? Auditing Membership Leakage in Semi-Black-box RAG Controlling

arXiv 2508.09105 ↗First posted 12 Aug 2025cs.AIcited by 3

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval-Augmented Generation (RAG) and its Multimodal Retrieval-Augmented Generation (MRAG) significantly improve the knowledge coverage and contextual understanding of Large Language Models (LLMs) by introducing external knowledge sources. However, retrieval and multimodal fusion obscure content provenance, rendering existing membership inference methods unable to reliably attribute generated outputs to pre-training, external retrieval, or user input, thus undermining privacy leakage accountability To address these challenges, we propose the first Source-aware Membership Audit (SMA) that enables fine-grained source attribution of generated content in a semi-black-box setting with retrieval control capabilities. To address the environmental constraints of semi-black-box auditing, we further design an attribution estimation mechanism based on zero-order optimization, which robustly approximates the true influence of input tokens on the output through large-scale perturbation sampling and ridge regression modeling. In addition, SMA introduces a cross-modal attribution technique that projects image inputs into textual descriptions via MLLMs, enabling token-level attribution in the text modality, which for the first time facilitates membership inference on image retrieval traces in MRAG systems. This work shifts the focus of membership inference from 'whether the data has been memorized' to 'where the content is sourced from', offering a novel perspective for auditing data provenance in complex generative systems.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 73 of its 85 references that are in the map. First posted on arXiv 12 Aug 2025.

Builds on

73 of 85 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Privacy-Preserving LLM Embedding Transmission for End-Cloud Collaboration17 Mar
  2. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation1 Feb
  3. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
  4. 2024Mask-based Membership Inference Attacks for Retrieval-Augmented Generation26 Oct
  5. 2024Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation30 May
  6. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 67

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2023GPT-4 Technical Reportcited by 18,396
  4. 2024The Llama 3 Herd of Modelscited by 14,715
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  6. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  7. 2020Scaling Laws for Neural Language Modelscited by 6,586
  8. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  9. 2025Qwen2.5-VL Technical Reportcited by 5,587
  10. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,070
  11. 2024Qwen2.5 Technical Reportcited by 4,942
  12. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
38 more
  1. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  2. 2023A Survey of Large Language Modelscited by 2,576
  3. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  4. 2019PubMedQA: A Dataset for Biomedical Research Question Answeringcited by 1,288
  5. 2023A Survey on Multimodal Large Language Modelscited by 909
  6. 2021Membership Inference Attacks From First Principlescited by 878
  7. 2025Janus-Pro: Unified Multimodal Understanding and Generation with Data and Model Scalingcited by 812
  8. 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 792
  9. 2023Towards General Text Embeddings with Multi-stage Contrastive Learningcited by 723
  10. 2023Instruction Tuning for Large Language Models: A Surveycited by 623
  11. 2020Captum: A unified and generic model interpretability library for PyTorchcited by 547
  12. 2018ML-Leaks: Model and Data Independent Membership Inference Attacks and Defenses on Machine Learning Modelscited by 498
  13. 2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
  14. 2020Label-Only Membership Inference Attackscited by 388
  15. 2023Detecting Pretraining Data from Large Language Modelscited by 387
  16. 2023Explainability for Large Language Models: A Surveycited by 333
  17. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 321
  18. 2021WIT: Wikipedia-based Image Text Dataset for Multimodal Multilingual Machine Learningcited by 287
  19. 2024MM-LLMs: Recent Advances in MultiModal Large Language Modelscited by 278
  20. 2023Adapted Large Language Models Can Outperform Medical Experts in Clinical Text Summarizationcited by 246
  21. 2020A Primer on Zeroth-Order Optimization in Signal Processing and Machine Learningcited by 162
  22. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 115
  23. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 109
  24. 2024Making Text Embedders Few-Shot Learnerscited by 79
  25. 2024MME-Survey: A Comprehensive Survey on Evaluation of Multimodal LLMscited by 72
  26. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 49
  27. 2025Towards Label-Only Membership Inference Attack against Pre-trained Large Language Modelscited by 37
  28. 2025A Survey of Multimodal Retrieval-Augmented Generationcited by 37
  29. 2023Using Captum to Explain Generative Language Modelscited by 33
  30. 2024Membership Inference Attacks against Large Vision-Language Modelscited by 33
  31. 2023Privacy Implications of Retrieval-Based Language Modelscited by 32
  32. 2023RAMM: Retrieval-augmented Biomedical Visual Question Answering with Multi-modal Pre-trainingcited by 31
  33. 2024GenderBias-VL: Benchmarking Gender Bias in Vision Language Models via Counterfactual Probingcited by 31
  34. 2024Membership Inference Attacks and Defenses in Federated Learning: A Surveycited by 31
  35. 2025Membership Inference Attacks Against Vision-Language Modelscited by 29
  36. 2018Performing Co-Membership Attacks Against Deep Generative Modelscited by 26
  37. 2024Model Internals-based Answer Attribution for Trustworthy Retrieval-Augmented Generationcited by 25
  38. 2024Manifold Integrated Gradients: Riemannian Geometry for Feature Attributioncited by 21

50 most cited of 67 All 67 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailmentcited by 4
  2. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  3. 2026Adaptive Defense Orchestration for RAG: A Sentinel-Strategist Architecture against Multi-Vector Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Evaluation of Attribution Bias in Generator-Aware Retrieval-Augmented Large Language Models
  2. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Survey
  3. 2024Generating Is Believing: Membership Inference Attacks against Retrieval-Augmented Generation
  4. 2025BudgetLeak: Membership Inference Attacks on RAG Systems via the Generation Budget Side Channel
  5. 2024Retrieval-Augmented Generation with Estimation of Source Reliability
  6. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  7. 2026E-MIA: Exam-Style Black-Box Membership Inference Attacks against RAG Systems
  8. 2025Worse than Zero-shot? A Fact-Checking Dataset for Evaluating the Robustness of RAG Against Misleading Retrievals