Near-Duplicate Families Break Exact-Record Membership Inference
Near-duplicates make LiRA membership inference mark 99.7% of exact non-members as members on CC-News.
The paper shows standard membership inference can confuse exact-record training with exposure to near-duplicate families such as syndicated articles or mirrored pages. A four-world audit separates exact-record inclusion from family presence. On CC-News, a clean-reference LiRA auditor labeled 99.70% of family-present exact non-members as members at a 1% false-positive rate. The failure persisted across scores, architectures, deduplication, and retraining; classification families largely substituted for the exact record, while autoregressive models retained a residual exact-sequence signal.
- Clean-reference audits miss family-present exact non-members
- LiRA labeled 99.70% of those CC-News cases at 1% FPR
- Failure persisted across scores, architectures, and retraining
- Positive evidence may show family exposure, not exact provenance
From the original article
1 min read at arxiv.orgMembership inference (MI) asks whether a specific record appeared in a model's training set and is increasingly used as evidence for data provenance and copyright auditing. These applications require determining whether the exact queried record was used for training, rather than merely whether the model was exposed to similar content.
By Yiyong Liu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.