Source-linked AI summary
Quantifying Privacy Risks of Masked Language Models Using Membership Inference Attacks
Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Berg-Kirkpatrick, Reza Shokri
TL;DR
Masked language models are widely applied to sensitive data, but prior membership-inference attacks gave inconclusive evidence about their privacy leakage. The paper uses likelihood-ratio testing with a reference MLM to quantify memorization more accurately. On masked clinical language models, the attack substantially outperforms the prior baseline, while the authors note that broader privacy analysis also requires reconstruction and property-inference attacks.
Problem
Prior MLM membership-inference results were inconclusive, limiting quantitative understanding of training-data leakage from models trained on sensitive data.
Method
The paper models MLMs with an energy-based formulation and compares target- and reference-model signals in a likelihood-ratio membership-inference test.
Results
The attack improves ClinicalBERT-Base AUC from 0.66 to 0.90 and is 51× more powerful than prior work at 1% false positive rate.
Takeaways & Limitations
The results show that MLMs are significantly prone to memorization and support the need for privacy-mitigation algorithms for such models.
Takeaways & Limitations
Membership inference alone is insufficient for thorough privacy analysis; reconstruction and property-inference attacks also need to be studied.
Abstract
from arXiv · showhide
The wide adoption and application of Masked language models~(MLMs) on sensitive data (from legal to medical) necessitates a thorough quantitative investigation into their privacy vulnerabilities -- to what extent do MLMs leak information about their training data? Prior attempts at measuring leakage of MLMs via membership inference attacks have been inconclusive, implying the potential robustness of MLMs to privacy attacks. In this work, we posit that prior attempts were inconclusive because they based their attack solely on the MLM's model score. We devise a stronger membership inference attack based on likelihood ratio hypothesis testing that involves an additional reference MLM to more accurately quantify the privacy risks of memorization in MLMs. We show that masked language models are extremely susceptible to likelihood ratio membership inference attacks: Our empirical results, on models trained on medical notes, show that our attack improves the AUC of prior membership inference attacks from 0.66 to an alarmingly high 0.90 level, with a significant improvement in the low-error region: at 1% false positive rate, our attack is 51X more powerful than prior work.
1 Introduction
Masked language models are widely used on sensitive data, but prior membership-inference studies provided inconclusive evidence about their training-data leakage. The paper addresses this gap with a reference-based likelihood-ratio attack and finds substantially greater vulnerability than loss-only attacks.
- Prior MLM membership-inference and reconstruction attacks were inconclusive or concluded that sensitive-data memorization was limited.
- Target-model loss is confounded by sample difficulty, limiting its ability to distinguish training members from non-members.
- Reference-based likelihood ratios recalibrate the statistic by comparing target- and reference-model likelihoods, reducing spurious effects of intrinsic sample complexity.
- The proposed attack improves ClinicalBERT-Base AUC from 0.66 to 0.90 over the prior loss-only baseline.
- At 10% false positive rate, the attack reaches 79.2% recall versus 15.6% for the baseline, and at 1% false positive rate it is 51× more powerful.
- Additional analyses examine model size, sample length, reference-model choice, and sample features associated with memorization.
2 Membership Inference Attacks
The attack tests membership by comparing a target MLM with a reference model under a likelihood-ratio framework. MLMs are represented as energy-based sequence models, with practical approximations used to compute the statistic, set thresholds, and evaluate error–power trade-offs.
- 2.1 Problem Formulation: Membership inference tests whether a sample was used to train the target model, measuring attack success through true-positive power and false-positive error.
- 2.2 Likelihood Ratio Test: The likelihood-ratio test compares membership and non-membership hypotheses using likelihoods from the target model and a reference model trained on independent population data.
- 2.2 Likelihood Ratio Test: The attack rejects non-membership when L(s) ≤ t and otherwise classifies the sample as a non-member.
- 2.3 Likelihood Ratio Test for MLMs: MLMs are treated as energy-based probability distributions so likelihood-ratio testing can be applied despite their lack of an explicit sequence probability distribution.
- 2.3 Likelihood Ratio Test for MLMs: For fixed target and reference models, the test statistic depends only on the difference between their assigned sample energies because the normalization-constant difference is global.
- 2.3 Likelihood Ratio Test for MLMs: The MLM energy is parameterized over all masking patterns covering 15% of a sequence’s tokens.
- 2.3 Likelihood Ratio Test for MLMs: Because enumerating every masking pattern is expensive, the implementation approximates the energy using K random patterns with K ≪ |C|.
- 2.4 Evaluation: Thresholds are selected from the null distribution using population samples to achieve a specified false-positive rate, while ROC curves show power–error trade-offs across thresholds.
3 Experimental Setup
The experiments evaluate membership inference on ClinicalBERT models trained on MIMIC-III, using MIMIC and i2b2-based member/non-member samples, reference models, and baseline loss-based metrics. They compare likelihood-ratio and model-loss attacks using ROC-based measures and a 10% false-positive threshold.
- 3.1 Datasets: Members come from target-model training data, while non-members are either held-out MIMIC data or samples from the similar i2b2 dataset.The target models use MIMIC-III clinical notes; access to both datasets requires a license.
- 3.2 Models: The attack is evaluated on four pre-trained ClinicalBERT models trained on MIMIC-III with different training procedures.Table 1 summarizes the model and baseline notations used in the results.
- 3.3 Reference Models: PubMed-BERT serves as the main domain-specific reference model, while bert-base-uncased is used as a general-domain reference for ablation.PubMed-BERT is trained on PubMed text that excludes MIMIC-III training data but is similar in domain.
- 3.3 Baselines: The baseline attack uses the target model’s loss, with thresholds chosen from either training-loss means or population losses.The paper labels this baseline Model loss in its tables.
- 3.4 Metrics: AUC measures threshold-independent attack strength, while precision and recall are reported at a 10% false-positive rate.The ROC curve measures true-positive rate against false-positive rate across thresholds.
- 3.4 Metrics: Figure 3 contrasts likelihood-ratio and loss histograms for members and non-members at a threshold selected for α=10% false-positive rate.The likelihood-ratio threshold correctly labels the illustrated member, whereas the baseline loss threshold does not.
4 Results
The experiments compare the likelihood-ratio attack with loss-based baselines across datasets, sample lengths, model sizes, reference models, name insertion, and memorized-sample correlations. The results show stronger leakage detection when the reference model distinguishes intrinsic sample difficulty from target-model behavior.
- Experimental scope: The evaluation compares attack performance across sample- and patient-level settings, non-member datasets, sample lengths, model sizes, references, and name insertion.Table 2 covers sample and patient membership; later analyses vary the target sample, target model, reference model, and training-data names.
- Comparison with Baseline: Reference-based scoring is especially effective when members and non-members both come from MIMIC-III and are difficult to distinguish using target-model loss alone.The reference magnifies behavioral differences between similar members and non-members.
- Effect of Sample Length and Model Size: Long sentences show more leakage than short sequences, while Large++ has consistently higher AUC than Base across the evaluated models.The paper attributes the length pattern partly to the greater uniqueness of longer sentences and notes that larger models may have greater memorization capacity.
- Effect of Changing the Reference Model: PubMed-BERT is a stronger reference than BERT-base because domain overlap better characterizes the target data’s intrinsic sample complexity.A reference trained on a different distribution can assign similar scores to easy and difficult samples, reducing recall.
- Effect of Inserting Names: Name insertion raises average member loss from 1.61 to 2.14, hurting the baseline while the reference-based attack separates these harder samples.Non-members retain an average loss threshold of 1.32 because names are absent from them.
5 Related Work
Prior privacy-leakage work uses membership inference and extraction attacks, with MLM studies relying mainly on target-model loss. This paper instead incorporates a reference model through a likelihood-ratio attack.
- Membership inference attacks determine whether individual samples were used to train a target model and help assess memorization and privacy risk.
- Membership inference: Loss-threshold attacks classify samples as members using only the target model’s loss.
- Membership inference: The proposed approach adds a reference model through an energy-based likelihood-ratio attack and achieves higher AUC than loss-based methods.
- Training data extraction attacks probe trained language models to quantify the risk of recovering training examples.
6 Conclusions
The paper introduces a likelihood-ratio membership inference attack for measuring training-data leakage in masked language models. Using both the target and a reference model reveals substantial MLM memorization, including in hard-to-fit data points.
- The paper introduces a membership inference attack based on likelihood-ratio testing to measure training-data leakage in MLMs.
- The attack uses signals from both the model under attack and an additional reference model to determine sample membership.
- The method enables successful inference on data points that are difficult for the target model to fit.
- The results show that MLMs are significantly prone to memorization.
- The findings motivate the design of robust privacy-mitigation algorithms for masked language models.
Limitations
Membership inference attacks efficiently identify privacy vulnerabilities associated with individual records, but they do not provide a complete privacy analysis. The paper therefore identifies reconstruction and property inference attacks as necessary extensions.
- Membership inference attacks form the foundation of privacy auditing and memorization analysis in machine learning.
- Recent work and this paper show that membership inference attacks efficiently identify model privacy vulnerabilities involving individual data records.
- A thorough data-privacy analysis cannot rely only on membership inference attacks.
- The analysis should be extended to reconstruction attacks and property inference attacks.
Ethics Statement
The study uses sensitive medical datasets governed by access, confidentiality, and training requirements. Reproduction materials are correspondingly restricted to authorized researchers, while several privacy-protection approaches are identified.
- The paper uses the sensitive medical datasets MIMIC-III and i2b2.
- Access to both datasets requires a request, agreement to data-usage and confidentiality terms, and proper training for ethical and privacy-preserving use.
- Reproduction code is available only by request and for research purposes to researchers who provide proof of authorized dataset access.
- Differentially private training algorithms are described as theoretically protecting each data record's membership against membership inference attacks.
- Adversarial training and personally identifiable information scrubbing are also identified as possible protection methods, without the stated worst-case guarantee.
A.1 Notations
The paper adds Table 8 to summarize and clarify the notation used to explain its attack.
- Table 8 summarizes the paper’s attack notation.
- The table is intended to clarify notation used in the attack explanation.
- The notation summary supports interpretation of the paper’s attack description.
A.2.1 Code and Data Access
The appendix documents data access, evaluation datasets, model variants, implementation details, and comparisons between the proposed likelihood-ratio attack and loss-based baselines. It also reports qualitative separation, low-false-positive behavior, and an alternative normalized-energy analysis.
- Code and Data Access: MIMIC-III and i2b2 contain sensitive medical data requiring authorized access, confidentiality agreements, and ethical-use training.Reproduction code is available only by request for authorized researchers.
- Target Data: The attack compares MIMIC-III members with held-out MIMIC-III or domain-similar i2b2 non-members.The MIMIC evaluation balances 4072 member and non-member sequences.
- Models: Five pretrained ClinicalBERT variants trained on MIMIC-III are evaluated, including base, large, extended-training, and name-insertion models.The name-insertion model prepends each patient’s surrogate name to every sentence.
- Attack Comparison: The proposed likelihood-ratio attack applies a reference model and differs from prior target-loss thresholding through likelihood-ratio testing and an energy-based likelihood formulation.Its likelihood-ratio statistic subtracts reference-model loss from target-model loss, using 15% masking averaged over 10 repetitions.
- Qualitative and Alternative Analyses: The likelihood-ratio statistic separates member and non-member histograms more distinctly than target-model loss, while normalized energy has higher AUC overall than loss.The reference model helps account for how difficult each sample is in general.