@inproceedings{song-etal-2026-gi,
title = "{GI}-{MIA}: Group-Invariant Membership Inference Attacks Against Large Language Models",
author = "Song, Zichen and
Ali, Farman and
Abuhmed, Tamer",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.2/",
pages = "13--28",
ISBN = "979-8-89176-462-0",
abstract = "Membership inference attacks (MIAs) assess whether a sample was used to train a model, posing privacy risks for large language models (LLMs). Existing MIAs typically rely on single loss or confidence signals, which are often unstable and easily confounded by noise, leading to limited robustness and generalization. In this paper, we propose Group-Invariant Membership Inference Attack (GI-MIA) that explicitly exploits semantic-preserving transformations to capture stability differences between members and non-members. Our method constructs an orbit of paraphrased variants for each input using LLM-driven transformations, and extracts invariant statistics (mean, maximum, and variance of normalized losses) across the orbit. A simple decision rule based on these statistics effectively discriminates members from non-members by leveraging the model{'}s inherent invariance on training data. We conducted extensive experiments on the Pythia family of LLMs (different model parameter sizes) across six datasets. Results show that GI-MIA consistently outperforms strong baselines, achieving state-of-the-art performance while maintaining robustness against semantic-preserving transformations. Our study highlights new directions for MIAs and calls for further research into LLM privacy protection, emphasizing the need for developing reliable models with better privacy resilience."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="song-etal-2026-gi">
<titleInfo>
<title>GI-MIA: Group-Invariant Membership Inference Attacks Against Large Language Models</title>
</titleInfo>
<name type="personal">
<namePart type="given">Zichen</namePart>
<namePart type="family">Song</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Farman</namePart>
<namePart type="family">Ali</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tamer</namePart>
<namePart type="family">Abuhmed</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Membership inference attacks (MIAs) assess whether a sample was used to train a model, posing privacy risks for large language models (LLMs). Existing MIAs typically rely on single loss or confidence signals, which are often unstable and easily confounded by noise, leading to limited robustness and generalization. In this paper, we propose Group-Invariant Membership Inference Attack (GI-MIA) that explicitly exploits semantic-preserving transformations to capture stability differences between members and non-members. Our method constructs an orbit of paraphrased variants for each input using LLM-driven transformations, and extracts invariant statistics (mean, maximum, and variance of normalized losses) across the orbit. A simple decision rule based on these statistics effectively discriminates members from non-members by leveraging the model’s inherent invariance on training data. We conducted extensive experiments on the Pythia family of LLMs (different model parameter sizes) across six datasets. Results show that GI-MIA consistently outperforms strong baselines, achieving state-of-the-art performance while maintaining robustness against semantic-preserving transformations. Our study highlights new directions for MIAs and calls for further research into LLM privacy protection, emphasizing the need for developing reliable models with better privacy resilience.</abstract>
<identifier type="citekey">song-etal-2026-gi</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.2/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>13</start>
<end>28</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T GI-MIA: Group-Invariant Membership Inference Attacks Against Large Language Models
%A Song, Zichen
%A Ali, Farman
%A Abuhmed, Tamer
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F song-etal-2026-gi
%X Membership inference attacks (MIAs) assess whether a sample was used to train a model, posing privacy risks for large language models (LLMs). Existing MIAs typically rely on single loss or confidence signals, which are often unstable and easily confounded by noise, leading to limited robustness and generalization. In this paper, we propose Group-Invariant Membership Inference Attack (GI-MIA) that explicitly exploits semantic-preserving transformations to capture stability differences between members and non-members. Our method constructs an orbit of paraphrased variants for each input using LLM-driven transformations, and extracts invariant statistics (mean, maximum, and variance of normalized losses) across the orbit. A simple decision rule based on these statistics effectively discriminates members from non-members by leveraging the model’s inherent invariance on training data. We conducted extensive experiments on the Pythia family of LLMs (different model parameter sizes) across six datasets. Results show that GI-MIA consistently outperforms strong baselines, achieving state-of-the-art performance while maintaining robustness against semantic-preserving transformations. Our study highlights new directions for MIAs and calls for further research into LLM privacy protection, emphasizing the need for developing reliable models with better privacy resilience.
%U https://aclanthology.org/2026.findings-emnlp.2/
%P 13-28
Markdown (Informal)
[GI-MIA: Group-Invariant Membership Inference Attacks Against Large Language Models](https://aclanthology.org/2026.findings-emnlp.2/) (Song et al., Findings 2026)
ACL