PaperlayerView exact revision on arXiv

Source-linked AI summary

Black-Box Membership Inference via Word-Level Probability Estimation

Shengjie Niu, Yeheng Ge, Jian Huang

arXiv:2609.10611v1cs.CRcs.LGstat.ML

TL;DR

Proprietary LLMs often expose only textual continuations, limiting existing likelihood-based membership inference attacks. WPMIA estimates word-level probabilities from black-box samples, aggregates them into sequence-level likelihoods, and strengthens the signal with contrastive prefixes. It achieves the strongest reported black-box performance on open-source models and 42.0 average TPR@5%FPR across evaluated commercial models.

  • Problem

    Existing membership inference methods commonly require tokenization results and per-token logits, which are unavailable when proprietary LLMs expose only textual continuations.

  • Method

    WPMIA uses Monte Carlo sampling with semantic kernel smoothing to estimate word-level probabilities, aggregates them into sequence-level likelihoods, and contrasts member and non-member prefix conditioning.

  • Results

    42.0 average TPR@5%FPR across commercial models accompanies the strongest black-box performance on open-source LLMs.

  • Takeaways & Limitations

    The results demonstrate the practical feasibility of strict black-box privacy auditing for proprietary LLMs without target tokenizers or per-token logits.

  • Takeaways & Limitations

    WPMIA requires repeated sampling and additional prefix-conditioned queries, increasing computation, latency, and monetary cost, especially for long texts and proprietary APIs.

Abstract

from arXiv · show

Membership inference attacks (MIAs) have emerged as critical tools for auditing privacy risks in large language models (LLMs), aiming to determine whether a given text was included in a model's training corpus. However, most existing MIAs require access to per-token logits or probabilities, making them inapplicable in practice to proprietary LLMs that expose only textual continuations. To address this underexplored setting, we propose Word-level Probability MIA (WPMIA), a statistically principled MIA for strict black-box privacy auditing. WPMIA estimates word-level generation probabilities via Monte Carlo sampling with local kernel smoothing, then aggregates these estimates into a sequence-level likelihood estimator. Furthermore, WPMIA constructs the likelihood conditioned on different prefixes, thereby amplifying the distributional differences between members and non-members. We evaluate WPMIA across various open-source LLMs and find that it consistently outperforms existing black-box baselines. Importantly, we also evaluate WPMIA on modern proprietary LLMs, including GPT-5-Chat, Gemini-2.5-Flash, and Claude-4.5-Haiku, achieving an average TPR@5\%FPR of 42.0 across these models. These results offer a sound foundation for future research on strict black-box membership inference. Code is available at \href{https://github.com/niusj03/WPMIA}{https://github.com/niusj03/WPMIA}.

1 Introduction

WPMIA addresses the gap between likelihood-based gray-box attacks and practical black-box auditing, where only textual continuations are observable. It estimates likelihood signals from words and prefix-conditioned comparisons, achieving strong results across open-source and proprietary LLMs.

  • Motivation: Growing LLM pretraining corpora may contain copyrighted or personally identifiable content despite data filtering, motivating membership-based privacy audits.Pretraining data detection seeks to determine whether a text was included in a target model’s training corpus.
  • Motivation: Existing likelihood-based attacks generally require tokenization results and per-token logits, which proprietary LLM APIs typically do not expose.This access constraint motivates a black-box approach based only on generated textual continuations.
  • Contribution: WPMIA estimates sequence-level likelihood from word probabilities sampled from textual continuations, then contrasts member and non-member prefixes to amplify membership signals.The method is designed for strict black-box access and avoids requiring target tokenizers or per-token logits.
  • Results: WPMIA achieves the strongest black-box MIA performance on open-source LLMs and matches or exceeds many gray-box methods across three benchmarks.The benchmarks are WikiMIA, MIMIR, and WikiMIA-25.
  • Results: 42.0 average TPR@5%FPR across commercial models demonstrates WPMIA’s effectiveness on proprietary LLMs without target tokenizers or per-token logits.The evaluated models include GPT-5-Chat, Gemini-2.5-Flash, and Claude-4.5-Haiku.

2 Method

The method estimates word-level probabilities from black-box samples, smooths sparse estimates semantically, and aggregates them into likelihood scores. Contrastive prefix conditioning then compares sequence-level likelihood shifts to strengthen membership separation.

  • Preliminary: Membership inference uses likelihood-derived scores and a threshold to decide whether a target text belongs to the training corpus.Average log-likelihood is used for numerical stability, while black-box access prevents direct recovery of token-level likelihoods.
  • Threat Model: WPMIA operates under black-box access, where the adversary observes textual continuations but lacks model weights, tokenization results, and logits.This setting corresponds to API interactions with proprietary LLMs such as ChatGPT, Gemini, and Claude.
  • Estimating Sequence-level Likelihood: Word-level probabilities are estimated from repeated samples, with kernel weighting assigning probability mass to the target word based on generated words.The number of samples is M, and the kernel K determines how sampled words contribute.
  • Estimating Sequence-level Likelihood: Semantic kernel smoothing reduces sparse or near-zero estimates by weighting semantically closer generated words more heavily.The temperature parameter controls kernel smoothness, improving stability under limited sampling budgets.
  • Enhancing with Contrastive Prefixes: Contrastive prefix scores produce the largest separation between member and non-member score distributions.Relative comparison is applied after constructing prefix-conditioned sequence-level likelihoods.
  • Enhancing with Contrastive Prefixes: Word-level log-probabilities are aggregated into sequence-level likelihoods before relative conditional comparison, preserving additive log-likelihood structure and avoiding unstable ratios.The paper attributes instability to word-level values that can be close to zero.

3 Comparison with Heuristic Methods

The section contrasts WPMIA’s sequence-level log-likelihood formulation with black-box baselines that use heuristic continuation or word-level scores. WPMIA preserves additive log-likelihood structure and avoids instability from directly aggregating raw word-level ratios.

  • SaMIA: SaMIA averages ROUGE-N overlap between generated continuations and a reference suffix as a continuation-level pseudo-probability mass.The score measures expected surface overlap rather than decomposing into additive word-level log-probabilities.
  • SaMIA: SaMIA can suffer distribution shift because later generated words depend on model-generated history rather than the original target context.This limits how directly its continuation-level score reflects the target text’s context.
  • SimMIA: SimMIA includes hard empirical-frequency and soft semantic-similarity word-level scores before aggregating them into an overall membership score.The soft score uses cosine similarity between word embeddings.
  • SimMIA: SimMIA’s raw frequency or embedding-similarity scores produce a heuristic relative score rather than a sequence-level log-likelihood estimator.Its aggregation operates on raw score ratios instead of log-probabilities.
  • WPMIA aggregates word-level probability estimates into sequence-level log-likelihood before contrastive prefix normalization, preserving additivity and avoiding near-zero denominator instability.This differs from directly averaging word-level scores or ratios.

4 Experiments

Across open-source and proprietary evaluations, WPMIA consistently achieves strong black-box membership inference performance, while ablations show gains from prefix conditioning, semantic-kernel estimation, and sequence-level likelihood contrast.

  • 4.2 Main Results: WPMIA consistently outperforms existing black-box baselines across WikiMIA and MIMIR, improving WikiMIA performance by 4.6 AUC points and 14.1 TPR@5%FPR points on average.It also surpasses the strongest gray-box method in several WikiMIA settings and remains best across most MIMIR domain-model-size pairs.
  • 4.2 Main Results: WPMIA achieves AUCs of 66.3, 78.2, and 91.0 on Claude-4.5-Haiku, Gemini-2.5-Flash, and GPT-5-Chat, respectively, with TPR@5%FPR scores of 22.1, 36.5, and 67.3.These results support black-box auditing of proprietary LLMs without target tokenizers or per-token logits.
  • 4.3 Analysis: Prefix conditioning and semantic-kernel estimation provide complementary gains, raising average AUC from 59.1 to 73.3 with non-member prefixes and to 81.8 with member-prefix contrast.Under full contrastive conditioning, the semantic kernel reaches 85.3 average AUC, outperforming raw embedding similarity and exact matching by 4.1 and 6.3 points.
  • 4.3 Analysis: Increasing continuation ratios, Monte Carlo samples, and prefix shots generally improves attack performance, with WPMIA consistently outperforming SimMIA and SimMIA* across these settings.Performance stabilizes around T = 8 prefix shots; WPMIA reaches around 85 AUC after M = 70 samples.
  • 4.3 Analysis: Dense embedding choices yield stable average AUCs from 85.3 to 86.6, while Word2Vec performs substantially worse and all-MiniLM-L6-v2 reaches 85.3 despite roughly one-fifteenth as many parameters as larger dense encoders.Smoothing improves AUC up to near τ = 0.2, but excessive smoothing at τ = 0.5 slightly reduces performance.
  • 4.3 Analysis: Meaningful contrastive prefix pools are necessary: light label corruption reduces AUC by 5.0 points, whereas severe corruption and complete shuffling produce a mean AUC of 48.4.The results indicate that WPMIA depends on label-aligned contrast between member and non-member prefix pools.

5 Conclusion

WPMIA is a strict black-box membership inference attack that recovers likelihood-based signals from textual continuations rather than tokenizers or logits. Across open-source and proprietary LLMs, it achieves strong black-box performance and demonstrates the feasibility of strict black-box privacy auditing.

  • WPMIA achieves the strongest black-box performance on open-source LLMs and remains effective on recent proprietary LLMs.

Limitations

WPMIA requires repeated sampling to estimate membership signals, and its prefix mechanism further increases the query budget. The evaluation is also restricted to English text, leaving multilingual effectiveness unresolved.

  • Repeated sampling and member/non-member prefix conditioning increase WPMIA's query, computation, latency, and monetary costs, especially for long texts and proprietary APIs.
  • The evaluation is restricted to English text, so multilingual effectiveness and language-specific adaptations remain open questions.

Ethical Considerations

WPMIA is intended for authorized privacy auditing and controlled research on training-data leakage. Because membership inference is dual-use, it could also be misused to probe for sensitive or private texts.

  • Because membership inference is dual-use, WPMIA should be applied only in authorized auditing, controlled research, and privacy-risk evaluation settings.

A Dataset Statistics

The appendix summarizes dataset statistics for WikiMIA, MIMIR, and WikiMIA-25 in Tables 7–9.

  • Dataset statistics for WikiMIA, MIMIR, and WikiMIA-25 are summarized in Tables 7–9.

B Additional Implementation Details

WPMIA uses benchmark-specific prefix pools and prompts that constrain proprietary models to return a single next word or punctuation mark. Prefix pools can be built from verified examples, high-confidence proxies, or synthetic proxies depending on audit access.

  • Benchmark Prefix Construction: Prefix pools reserve equal-sized member and non-member examples, excluding them from evaluation to ensure fair comparisons.WikiMIA and WikiMIA-25 use T = 7 prefix shots, while MIMIR uses T = 10.
  • Prompt Template for Proprietary LLMs: For proprietary LLMs, the prompt constrains generation to a single next word or punctuation mark for the supplied prefix.The system prompt requests only one next token, without spaces, quotes, or extra text.
  • Authorized Audits with Verified Prefixes: Auditors can construct prefixes from verified member and non-member documents when membership status is known.Examples include training-corpus or canary documents for members and newly created private documents for non-members.
  • External Audits with Proxies: Without direct training-set access, auditors can use high-confidence public proxies or synthetic passages matched to target characteristics.Synthetic approaches include GPT-4o-generated non-member-like passages and member-like prefix construction without the original training set.

D Additional Experiments

Additional experiments show that WPMIA remains strong under complete benchmark comparisons and matched generation budgets, while its performance reflects trade-offs in sampling cost and stability across hyperparameters.

  • Complete Benchmark Results: WPMIA is the strongest black-box method in most benchmark settings and remains competitive with gray-box methods across three benchmarks.The complete comparisons cover WikiMIA, MIMIR, and WikiMIA-25.
  • Budget-Matched Comparison: 83.1 AUC and 27.9 TPR@5%FPR averaged across matched budgets exceed SimMIA by 12.4 and 15.4 points, respectively.WPMIA achieves the best performance at low, medium, and high generated-token budgets.
  • Proprietary API Statistics: For WikiMIA-25, WPMIA requires approximately Q = 3ML requests because each scored position uses three conditioning settings.With M = 10, the benchmark contains 7,898 scored positions and an expected retry-free total of 236,940 requests.
  • Stability across Sample Sizes: Increasing the sample count improves mean AUC, but gains diminish around M = 70–80 while sampling cost continues to matter.Five-seed evaluation reports moderate variability even at M = 10 and identifies a cost-performance trade-off.
  • Fine-Grained Temperature Sensitivity: Average AUC varies from 83.6 to 85.4 across temperatures 0.10–0.50, with τ = 0.2 achieving 85.3.Variation is smaller within τ ∈[0.15, 0.30], supporting uniform use of τ = 0.2 on the evaluated benchmarks.

E Pseudocode

The WPMIA pseudocode takes a target text, language model, sampling and prefix parameters, then outputs a membership score and binary membership decision. Its pipeline estimates word-level probabilities, aggregates them into sequence likelihoods, and contrasts prefix-conditioned likelihoods.

  • Inputs: The algorithm inputs a target word sequence, language model, sample count, member and non-member prefix pools, kernel parameters, smoothing constant, and threshold.The target text is represented as x = (x1, x2, . . . , xL).
  • Outputs: WPMIA outputs a membership score S(θ, x) and a binary decision about whether the target text was included in training.The decision is represented as 1 or 0.
  • Prefix Construction: The pseudocode constructs member and non-member prefix sequences by concatenating prefix examples for conditioning.The member pool is shown as a concatenation of prefix components.
  • Scoring Pipeline: The pipeline estimates word-level probability mass before aggregating word-level log-probabilities into a sequence-level log-likelihood.The algorithm also contrasts prefix-conditioned log-likelihoods as part of the scoring procedure.
Loading 2609.10611v1…