@inproceedings{zheng-etal-2026-deconstructing,
title = "Deconstructing Memorization and Generalization: Dual-Level Calibration of Membership Inference Attacks for Large Vision-Language Models",
author = "Zheng, Xiaofan and
Wang, Xinghao and
Luo, Minnan",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.2680/",
pages = "60954--60969",
ISBN = "979-8-89176-459-0",
abstract = "Large Vision-Language Models (LVLMs) achieve remarkable progress but raise privacy concerns due to vendors' secretive data practices. Recent studies explore Membership Inference Attacks (MIA) for privacy auditing, which assume models exhibit lower loss and higher confidence for training data. However, this assumption overlooks the inherent differences in difficulty among samples. A model{'}s generalization-driven predictions on simple samples and its verbatim memorization of complex ones can both yield high confidence scores, thereby blurring the distinction between members and non-members. Furthermore, the prohibitive training cost of LVLMs renders the conventional approach of training additional shadow models for difficulty calibration impractical. In response to the aforementioned challenges, we propose Dual-Level Calibration of Membership Inference Attacks (DLC-MIA). Our method performs dual-level calibration at both the token level and the sample level, and introduces a lightweight auxiliary model to simulate the training process of samples, leveraging the prior knowledge of the auxiliary model to distinguish between generalization and memorization of the target model. Specifically, at the first calibration level, we utilize the auxiliary model to identify tokens within a sample that are more sensitive to training and assign them differential weights, as these tokens more effectively reflect traces of memorization. At the second calibration level, we achieve difficulty calibration by estimating the degree of generalization through comparing the flatness of the loss landscape between the auxiliary model and the target model. Extensive experiments validate the effectiveness of our proposed method."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zheng-etal-2026-deconstructing">
<titleInfo>
<title>Deconstructing Memorization and Generalization: Dual-Level Calibration of Membership Inference Attacks for Large Vision-Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Xiaofan</namePart>
<namePart type="family">Zheng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xinghao</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Minnan</namePart>
<namePart type="family">Luo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>Large Vision-Language Models (LVLMs) achieve remarkable progress but raise privacy concerns due to vendors’ secretive data practices. Recent studies explore Membership Inference Attacks (MIA) for privacy auditing, which assume models exhibit lower loss and higher confidence for training data. However, this assumption overlooks the inherent differences in difficulty among samples. A model’s generalization-driven predictions on simple samples and its verbatim memorization of complex ones can both yield high confidence scores, thereby blurring the distinction between members and non-members. Furthermore, the prohibitive training cost of LVLMs renders the conventional approach of training additional shadow models for difficulty calibration impractical. In response to the aforementioned challenges, we propose Dual-Level Calibration of Membership Inference Attacks (DLC-MIA). Our method performs dual-level calibration at both the token level and the sample level, and introduces a lightweight auxiliary model to simulate the training process of samples, leveraging the prior knowledge of the auxiliary model to distinguish between generalization and memorization of the target model. Specifically, at the first calibration level, we utilize the auxiliary model to identify tokens within a sample that are more sensitive to training and assign them differential weights, as these tokens more effectively reflect traces of memorization. At the second calibration level, we achieve difficulty calibration by estimating the degree of generalization through comparing the flatness of the loss landscape between the auxiliary model and the target model. Extensive experiments validate the effectiveness of our proposed method.</abstract>
<identifier type="citekey">zheng-etal-2026-deconstructing</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.2680/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>60954</start>
<end>60969</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Deconstructing Memorization and Generalization: Dual-Level Calibration of Membership Inference Attacks for Large Vision-Language Models
%A Zheng, Xiaofan
%A Wang, Xinghao
%A Luo, Minnan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zheng-etal-2026-deconstructing
%X Large Vision-Language Models (LVLMs) achieve remarkable progress but raise privacy concerns due to vendors’ secretive data practices. Recent studies explore Membership Inference Attacks (MIA) for privacy auditing, which assume models exhibit lower loss and higher confidence for training data. However, this assumption overlooks the inherent differences in difficulty among samples. A model’s generalization-driven predictions on simple samples and its verbatim memorization of complex ones can both yield high confidence scores, thereby blurring the distinction between members and non-members. Furthermore, the prohibitive training cost of LVLMs renders the conventional approach of training additional shadow models for difficulty calibration impractical. In response to the aforementioned challenges, we propose Dual-Level Calibration of Membership Inference Attacks (DLC-MIA). Our method performs dual-level calibration at both the token level and the sample level, and introduces a lightweight auxiliary model to simulate the training process of samples, leveraging the prior knowledge of the auxiliary model to distinguish between generalization and memorization of the target model. Specifically, at the first calibration level, we utilize the auxiliary model to identify tokens within a sample that are more sensitive to training and assign them differential weights, as these tokens more effectively reflect traces of memorization. At the second calibration level, we achieve difficulty calibration by estimating the degree of generalization through comparing the flatness of the loss landscape between the auxiliary model and the target model. Extensive experiments validate the effectiveness of our proposed method.
%U https://aclanthology.org/2026.emnlp-main.2680/
%P 60954-60969
Markdown (Informal)
[Deconstructing Memorization and Generalization: Dual-Level Calibration of Membership Inference Attacks for Large Vision-Language Models](https://aclanthology.org/2026.emnlp-main.2680/) (Zheng et al., EMNLP 2026)
ACL