Dataset Usage Inference without Shadow Models or Held-out Data
Not on the map. Why?
Abstract (arXiv)
How much of my data was used to train a machine learning model? Dataset Usage Inference (DUI) aims to answer this by estimating what fraction of a dataset contributed to a model's training. However, existing DUI methods rely on assumptions that rarely hold in practice: they require training expensive shadow models to imitate the target model, and they assume access to both known training samples and an in-distribution held-out set confirmed to be absent from training. These conditions make current approaches impractical for modern large models and real data ownership disputes. We introduce a practical DUI framework that removes these constraints. Our method requires neither shadow models nor real held-out data. Instead, it generates synthetic non-member samples, extracts diverse membership signals, and casts DUI as a mixture proportion estimation problem to estimate what share of the candidate dataset was used during training. Experiments on large image generative models show that our method reliably quantifies dataset usage, providing a practical tool for data owners to determine how much of their data was used to train a model.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 32 of its 53 references that are in the map. First posted on arXiv 24 Jun 2026.
Builds on
32 of 53 references.
References · 32
- 2017Attention Is All You Needcited by 59,932
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
- 2020Denoising Diffusion Implicit Modelscited by 9,655
- 2017Neural Discrete Representation Learningcited by 4,650
- 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,229
- 2024Visual Autoregressive Modeling: Scalable Image Generation via Next-Scale Predictioncited by 1,005
- 2023Extracting Training Data from Diffusion Modelscited by 723
- 2023Detecting Pretraining Data from Large Language Modelscited by 375
- 2017Positive-Unlabeled Learning with Non-Negative Risk Estimatorcited by 217
- 2023Are Diffusion Models Vulnerable to Membership Inference Attacks?cited by 135
- 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
20 more
- 2023Low-Cost High-Power Membership Inference Attackscited by 99
- 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
- 2016Mixture Proportion Estimation via Kernel Embedding of Distributionscited by 67
- 2024Scaling Diffusion Transformers to 16 Billion Parameterscited by 65
- 2021On the Frequency Bias of Generative Modelscited by 60
- 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 57
- 2023An Efficient Membership Inference Attack for the Diffusion Model by Proximal Initializationcited by 53
- 2023Towards More Realistic Membership Inference Attacks on Large Diffusion Modelscited by 41
- 2024Membership Inference on Text-to-Image Diffusion Models via Conditional Likelihood Discrepancycited by 38
- 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
- 2018Beyond the Selected Completely At Random Assumption for Learning from Positive and Unlabeled Datacited by 36
- 2022Dataset Inference for Self-Supervised Modelscited by 36
- 2020Open-sourced Dataset Protection via Backdoor Watermarkingcited by 30
- 2022Membership Inference via Backdooringcited by 24
- 2024Context-Aware Membership Inference Attacks against Pre-trained Large Language Modelscited by 20
- 2024CDI: Copyrighted Data Identification in Diffusion Modelscited by 17
- 2025Privacy Attacks on Image AutoRegressive Modelscited by 15
- 2016Nonparametric semi-supervised learning of class proportionscited by 13
- 2024Adaptive Pre-training Data Detection for Large Language Models via Surprising Tokenscited by 10
- 2025Unlocking Post-hoc Dataset Inference with Synthetic Datacited by 7
Built on by
Not cited yet.