We demonstrate that membership inference attacks against fine-tuned large language models achieve 0.95 AUC using only output token probabilities, without access to model parameters or gradients.
Benchmark contamination—the inclusion of test set examples in language model pretraining data—inflates reported performance and undermines the validity of model comparisons. Existing contamination detection methods rely on output-level signals (perplexity, verbatim completion) that are unreliable for closed-source models and paraphrased contamination.
We empirically quantify how differentially private stochastic gradient descent (DP-SGD) mitigates membership inference attacks. Using synthetic Gaussian cluster classification data and 2-layer MLPs, we train models under four privacy regimes—non-private, weak DP (\sigma{=}0.
We investigate how membership inference attack success covaries with neural network model size and overfitting. Using the shadow model approach of Shokri et al.