mlsanityData to 7 Oct 2026

MemGuard-Alpha: Limits of Membership Inference for Detecting and Filtering Memorization-Contaminated Signals in LLM-Based Financial Forecasting

arXiv 2603.26797 ↗First posted 26 Mar 2026cs.LGcited by 0

On the map: LLM safety and security → Membership inference attacks

Abstract (arXiv)

Large language models are increasingly used to generate financial alpha signals, but many have memorized the historical data in their training corpora, producing apparent accuracy that collapses out of sample. Membership inference attacks (MIA) have been proposed as a diagnostic. What has not been established is whether MIA scores are informative about memorization in this setting, or whether signal-level filtering built on them helps once realistic costs are applied.We introduce MemGuard-Alpha, comprising a composite contamination score combining five MIA methods with a temporal proximity feature, and Cross-Model Memorization Disagreement, which exploits variation in training cutoffs across models. We then audit both. Across seven LLMs (124M-7B), 50 S&P 100 constituents, 42,800 prompts and 299,600 prompt-model MIA scores spanning 2019-2024, three findings emerge.First, where in-sample status is defined by a training cutoff, a temporal proximity feature recovers that label perfectly (ROC-AUC 1.000) because it is a monotone transform of the defining variable; any composite score containing such a feature reports separation that is arithmetic rather than detection. Second, the discriminative power of the MIA scores is largely attributable to scale differences between models: asked at a fixed date which models had that date in training, raw scores appear highly informative (AUC up to 0.99), but under three independent within-model normalizations discrimination falls to 0.487-0.537. Third, with transaction costs applied symmetrically, no filtering variant improves risk-adjusted performance over the unfiltered ensemble, none attains significant Fama-French five-factor alpha, and excluding the single weakest model outperforms every contamination-based filter.We report these as negative results with the failure modes that produced them, and release all artifacts needed to reproduce them.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Membership inference attacks, one of 12 directions in LLM safety and security. Builds on 14 of its 25 references that are in the map. First posted on arXiv 26 Mar 2026.

Builds on

14 of 25 references.

Closest ancestors · 1

Same direction, newest first

  1. 2021Membership Inference Attacks From First Principles7 Dec

Other references · 13

  1. 2022Quantifying Memorization Across Neural Language Modelscited by 755
  2. 2023Detecting Pretraining Data from Large Language Modelscited by 375
  3. 2024Financial Statement Analysis with Large Language Modelscited by 31
  4. 2024Large Language Models: An Applied Econometric Frameworkcited by 30
  5. 2023Assessing Look-Ahead Bias in Stock Return Predictions Generated By GPT Sentiment Analysiscited by 29
  6. 2025Can LLM-based Financial Investing Strategies Outperform the Market in Long Run?cited by 19
  7. 2025Your AI, Not Your View: The Bias of LLMs in Investment Analysiscited by 16
  8. 2026Look-Ahead-Bench: a Standardized Benchmark of Look-ahead Bias in Point-in-Time LLMs for Financecited by 11
  9. 2026Evaluating LLMs in Finance Requires Explicit Bias Considerationcited by 11
  10. 2025A Fast and Effective Solution to the Problem of Look-ahead Bias in LLMscited by 8
  11. 2024Time Machine GPTcited by 7
  12. 2025Detecting Lookahead Bias in LLM Forecastscited by 7
1 more
  1. 2026Can Blindfolded LLMs Still Trade? An Anonymization-First Framework for Portfolio Optimizationcited by 4

Built on by

Not cited yet.