@inproceedings{zhang-etal-2026-tracemia,
title = "{T}race{MIA}: Interpretable Membership Inference Attack via Lexical Patterns in Reasoning Traces",
author = "Zhang, Bo and
Wu, Yongtang and
Liu, Ning and
Zhang, Jun and
Luo, Zhunchen and
Cao, Yunbo and
Bai, Xiaoying and
Geng, Guotong and
Wang, Zhong",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.emnlp-main.532/",
pages = "12273--12289",
ISBN = "979-8-89176-459-0",
abstract = "As large language models (LLMs) increasingly rely on web-scale corpora, membership inference attacks (MIAs) have become essential tools for auditing unauthorized data usage. However, traditional token-level MIAs fail to generalize to large reasoning models (LRMs) due to data distribution shifts introduced during fine-tuning. While recent studies address this by encoding reasoning traces into latent semantic spaces, they sacrifice the interpretability strictly required for real-world copyright verification. In this paper, we demonstrate that an LRM{'}s internal memory states are explicitly leaked through its stylistic word choices. Our analysis reveals a distinct lexical dichotomy: non-member traces tend toward a ``guessing-like'' tone, whereas member traces exhibit a ``remember-like'' style. Motivated by this interesting phenomenon, we propose TraceMIA, an interpretable MIA framework that audits training corpora by computing membership scores based on the relative frequencies of discriminative cue words. Extensive empirical evaluations across representative LRMs and diverse datasets demonstrate that TraceMIA achieves robust detection efficacy while providing the transparent, human-readable evidence critical for practical auditing scenarios."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="zhang-etal-2026-tracemia">
<titleInfo>
<title>TraceMIA: Interpretable Membership Inference Attack via Lexical Patterns in Reasoning Traces</title>
</titleInfo>
<name type="personal">
<namePart type="given">Bo</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yongtang</namePart>
<namePart type="family">Wu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ning</namePart>
<namePart type="family">Liu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhunchen</namePart>
<namePart type="family">Luo</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Yunbo</namePart>
<namePart type="family">Cao</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Xiaoying</namePart>
<namePart type="family">Bai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Guotong</namePart>
<namePart type="family">Geng</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhong</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-459-0</identifier>
</relatedItem>
<abstract>As large language models (LLMs) increasingly rely on web-scale corpora, membership inference attacks (MIAs) have become essential tools for auditing unauthorized data usage. However, traditional token-level MIAs fail to generalize to large reasoning models (LRMs) due to data distribution shifts introduced during fine-tuning. While recent studies address this by encoding reasoning traces into latent semantic spaces, they sacrifice the interpretability strictly required for real-world copyright verification. In this paper, we demonstrate that an LRM’s internal memory states are explicitly leaked through its stylistic word choices. Our analysis reveals a distinct lexical dichotomy: non-member traces tend toward a “guessing-like” tone, whereas member traces exhibit a “remember-like” style. Motivated by this interesting phenomenon, we propose TraceMIA, an interpretable MIA framework that audits training corpora by computing membership scores based on the relative frequencies of discriminative cue words. Extensive empirical evaluations across representative LRMs and diverse datasets demonstrate that TraceMIA achieves robust detection efficacy while providing the transparent, human-readable evidence critical for practical auditing scenarios.</abstract>
<identifier type="citekey">zhang-etal-2026-tracemia</identifier>
<location>
<url>https://aclanthology.org/2026.emnlp-main.532/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>12273</start>
<end>12289</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T TraceMIA: Interpretable Membership Inference Attack via Lexical Patterns in Reasoning Traces
%A Zhang, Bo
%A Wu, Yongtang
%A Liu, Ning
%A Zhang, Jun
%A Luo, Zhunchen
%A Cao, Yunbo
%A Bai, Xiaoying
%A Geng, Guotong
%A Wang, Zhong
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F zhang-etal-2026-tracemia
%X As large language models (LLMs) increasingly rely on web-scale corpora, membership inference attacks (MIAs) have become essential tools for auditing unauthorized data usage. However, traditional token-level MIAs fail to generalize to large reasoning models (LRMs) due to data distribution shifts introduced during fine-tuning. While recent studies address this by encoding reasoning traces into latent semantic spaces, they sacrifice the interpretability strictly required for real-world copyright verification. In this paper, we demonstrate that an LRM’s internal memory states are explicitly leaked through its stylistic word choices. Our analysis reveals a distinct lexical dichotomy: non-member traces tend toward a “guessing-like” tone, whereas member traces exhibit a “remember-like” style. Motivated by this interesting phenomenon, we propose TraceMIA, an interpretable MIA framework that audits training corpora by computing membership scores based on the relative frequencies of discriminative cue words. Extensive empirical evaluations across representative LRMs and diverse datasets demonstrate that TraceMIA achieves robust detection efficacy while providing the transparent, human-readable evidence critical for practical auditing scenarios.
%U https://aclanthology.org/2026.emnlp-main.532/
%P 12273-12289
Markdown (Informal)
[TraceMIA: Interpretable Membership Inference Attack via Lexical Patterns in Reasoning Traces](https://aclanthology.org/2026.emnlp-main.532/) (Zhang et al., EMNLP 2026)
ACL
- Bo Zhang, Yongtang Wu, Ning Liu, Jun Zhang, Zhunchen Luo, Yunbo Cao, Xiaoying Bai, Guotong Geng, and Zhong Wang. 2026. TraceMIA: Interpretable Membership Inference Attack via Lexical Patterns in Reasoning Traces. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 12273–12289, Budapest, Hungary. Association for Computational Linguistics.