mlsanityData to 14 Oct 2026

Ensemble Privacy Defense for Knowledge-Intensive LLMs against Membership Inference Attacks

arXiv 2512.03100 ↗First posted 1 Dec 2025cs.CR cs.AIcited by 1

On the map: Retrieval-augmented generation → Privacy and security of RAG

also in 1 more
Abstract (arXiv)

Retrieval-Augmented Generation (RAG) and Supervised Finetuning (SFT) have become the predominant paradigms for equipping Large Language Models (LLMs) with external knowledge for diverse, knowledge-intensive tasks. However, while such knowledge injection improves performance, it also exposes new attack surfaces. Membership Inference Attacks (MIAs), which aim to determine whether a given data sample was included in a model's training set, pose serious threats to privacy and trust in sensitive domains. To this end, we first systematically evaluate the vulnerability of RAG- and SFT-based LLMs to various MIAs. Then, to address the privacy risk, we further introduce a novel, model-agnostic defense framework, Ensemble Privacy Defense (EPD), which aggregates and evaluates the outputs of a knowledge-injected LLM, a base LLM, and a dedicated judge model to enhance resistance against MIAs. Comprehensive experiments show that, on average, EPD reduces MIA success by up to 27.8% for SFT and 526.3% for RAG compared to inference-time baseline, while maintaining answer quality.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 24 of its 33 references that are in the map. First posted on arXiv 1 Dec 2025.

Builds on

24 of 33 references.

References · 24

  1. 2017Attention Is All You Needcited by 60,361
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  3. 2020Language Models are Few-Shot Learnerscited by 32,419
  4. 2022Training language models to follow instructions with human feedbackcited by 15,971
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  6. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  7. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  8. 2020Scaling Laws for Neural Language Modelscited by 6,586
  9. 2022Large Language Models are Zero-Shot Reasonerscited by 4,374
  10. 2016SQuAD: 100,000+ Questions for Machine Comprehension of Textcited by 4,148
  11. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  12. 2017TriviaQA: A Large Scale Distantly Supervised Challenge Dataset for Reading Comprehensioncited by 2,955
12 more
  1. 2016Deep Learning with Differential Privacycited by 2,728
  2. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  3. 2020Extracting Training Data from Large Language Modelscited by 2,189
  4. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  5. 2021Membership Inference Attacks From First Principlescited by 878
  6. 2023Fine-Tuning or Retrieval? Comparing Knowledge Injection in LLMscited by 178
  7. 2023Practical Membership Inference Attacks against Fine-tuned Large Language Models via Self-prompt Calibrationcited by 98
  8. 2024ReCaLL: Membership Inference via Relative Conditional Log-Likelihoodscited by 64
  9. 2023Overconfidence is a Dangerous Thing: Mitigating Membership Inference Attacks by Enforcing Less Confident Predictioncited by 29
  10. 2020Sampling Attacks: Amplification of Membership Inference Attacks by Repeated Queriescited by 16
  11. 2025Tokens for Learning, Tokens for Unlearning: Mitigating Membership Inference Attacks in Large Language Models via Dual-Purpose Trainingcited by 15
  12. 2024Dual-Model Defense: Safeguarding Diffusion Models from Membership Inference Attacks through Disjoint Data Splittingcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2

Similar, not cited

Close in wording, no citation either way

  1. 2024Order of Magnitude Speedups for LLM Membership Inference
  2. 2025Safeguarding Privacy of Retrieval Data against Membership Inference Attacks: Is This Query Too Close to Home?
  3. 2024EM-MIAs: Enhancing Membership Inference Attacks in Large Language Models through Ensemble Modeling
  4. 2025Membership Inference Attacks on Large-Scale Models: A Survey
  5. 2025SOFT: Selective Data Obfuscation for Protecting LLM Fine-tuning against Membership Inference Attacks
  6. 2026CheckMIABench: Firm Foundations For Membership Inference Attacks on Language Models
  7. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  8. 2026On the Privacy of LLMs: An Ablation Study