mlsanityData to 14 Oct 2026

Membership Inference Attacks on In-Context Examples in LLM-based Recommender Systems

arXiv 2508.18665 ↗First posted 26 Aug 2025cs.IR cs.AI cs.CLcited by 0

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Large language models (LLMs) based recommender systems (RecSys) can adapt flexibly across different domains. It uses in-context learning (ICL), i.e., prompts, including sensitive historical user-specific item interactions, to customize the recommendation functions. However, no study has examined whether such private information may be exposed by novel privacy attacks. We design two membership inference attacks (MIAs): ItemMem, and RecInertia, aiming to identify whether system prompts contain the victim's information. We have carefully evaluated them on the latest open-source LLMs and three well-known RecSys datasets. The results confirm that the MIA threat to LLM RecSys is realistic and can be more sophisticated than prompt extraction. They utilize the unique prompt structures in ICL RecSys and cannot be easily mitigated with existing defense methods on prompt extraction.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 52 references that are in the map. First posted on arXiv 26 Aug 2025.

Builds on

32 of 52 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024On the Privacy Risk of In-context Learning15 Nov
  2. 2023Last One Standing: A Comparative Analysis of Security and Privacy of Soft Prompt Tuning, LoRA, and In-Context Learning17 Oct
  3. 2023Membership Inference Attacks against Diffusion Models7 Feb
  4. 2022Membership Inference Attacks by Exploiting Loss Trajectory31 Aug
  5. 2022Debiasing Learning for Membership Inference Attacks Against Recommender Systems24 Jun
  6. 2021Membership Inference Attacks From First Principles7 Dec
  7. 2021Membership Inference Attacks Against Recommender Systems16 Sep

Other references · 25

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  2. 2020Extracting Training Data from Large Language Modelscited by 2,189
  3. 2020Making Pre-trained Language Models Better Few-shot Learnerscited by 1,256
  4. 2020LightGCN: Simplifying and Powering Graph Convolution Network for Recommendationcited by 1,139
  5. 2022Large Language Models Are Human-Level Prompt Engineerscited by 1,045
  6. 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 864
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  8. 2020Label-Only Membership Inference Attackscited by 388
  9. 2023A Survey on Large Language Models for Recommendationcited by 379
  10. 2024StruQ: Defending Against Prompt Injection with Structured Queriescited by 375
  11. 2023Large Language Models are Zero-Shot Rankers for Recommender Systemscited by 309
  12. 2023Is ChatGPT a Good Recommender? A Preliminary Studycited by 193
13 more
  1. 2020Membership Leakage in Label-Only Exposurescited by 168
  2. 2023Uncovering ChatGPT's Capabilities in Recommender Systemscited by 161
  3. 2020A Survey on Conversational Recommender Systemscited by 143
  4. 2023Large Language Models as Zero-Shot Conversational Recommenderscited by 127
  5. 2023Large Language Models are Competitive Near Cold-start Recommenders for Language- and Item-based Preferencescited by 66
  6. 2024SelfDefend: LLMs Can Defend Themselves against Jailbreaking in a Practical Mannercited by 63
  7. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Datacited by 52
  8. 2023Interaction-level Membership Inference Attack Against Federated Recommender Systemscited by 25
  9. 2023BookGPT: A General Framework for Book Recommendation Empowered by Large Language Modelcited by 22
  10. 2024Data Poisoning for In-context Learningcited by 21
  11. 2024LLMTreeRec: Unleashing the Power of Large Language Models for Cold-Start Recommendationscited by 13
  12. 2025Do LLMs Memorize Recommendation Datasets? A Preliminary Study on MovieLens-1Mcited by 12
  13. 2025RecPS: Privacy Risk Scoring for Recommender Systemscited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Membership Inference Attack against Large Language Model-based Recommendation Systems: A New Distillation-based Paradigm
  2. 2025Membership Inference Attacks on Recommender System: A Survey
  3. 2025Membership Inference Attacks on Large-Scale Models: A Survey
  4. 2026On the Privacy of LLMs: An Ablation Study
  5. 2025Exploring Backdoor Attack and Defense for LLM-empowered Recommendations
  6. 2024Membership Inference Attacks Against In-Context Learning
  7. 2024Shadow-Free Membership Inference Attacks: Recommender Systems Are More Vulnerable Than You Thought
  8. 2025Reference Recommendation based Membership Inference Attack against Hybrid-based Recommender Systems ↗