{"id":"https://openalex.org/W7212287809","doi":"https://doi.org/10.18653/2026.emnlp-main.446","title":"Black-Box Membership Inference via Word-Level Probability Estimation","display_name":"Black-Box Membership Inference via Word-Level Probability Estimation","publication_year":2026,"publication_date":"2026-01-01","ids":{"openalex":"https://openalex.org/W7212287809","doi":"https://doi.org/10.18653/2026.emnlp-main.446"},"language":"en","primary_location":{"id":"doi:10.18653/2026.emnlp-main.446","doi":"https://doi.org/10.18653/2026.emnlp-main.446","is_oa":true,"landing_page_url":"https://doi.org/10.18653/2026.emnlp-main.446","pdf_url":"https://aclanthology.org/2026.emnlp-main.446.pdf","source":{"id":"https://openalex.org/S4363608991","display_name":"Conference on Empirical Methods in Natural Language Processing (EMNLP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing","raw_type":"proceedings-article"},"volume":null,"type":"conference-paper","is_traditional":true,"indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"bronze","oa_url":"https://aclanthology.org/2026.emnlp-main.446.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5153486799","display_name":"Shengjie Niu","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Shengjie Niu","raw_affiliation_strings":["Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University , Hong Kong SAR , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University , Hong Kong SAR , China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051771646","display_name":"Yeheng Ge","orcid":"https://orcid.org/0009-0007-4982-0068","observed_orcids":["https://orcid.org/0009-0007-4982-0068"]},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Yeheng Ge","raw_affiliation_strings":["Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University , Hong Kong SAR , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University , Hong Kong SAR , China","institution_ids":["https://openalex.org/I14243506"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5151652576","display_name":"Jian Huang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I14243506","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98","country_code":"HK","type":"education","lineage":["https://openalex.org/I14243506"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Jian Huang","raw_affiliation_strings":["Department of Applied Mathematics The Hong Kong Polytechnic University , Hong Kong SAR , China","Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University , Hong Kong SAR , China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Applied Mathematics The Hong Kong Polytechnic University , Hong Kong SAR , China","institution_ids":["https://openalex.org/I14243506"]},{"raw_affiliation_string":"Department of Data Science and Artificial Intelligence The Hong Kong Polytechnic University , Hong Kong SAR , China","institution_ids":["https://openalex.org/I14243506"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I14243506"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.59673434,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"10271","last_page":"10287"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9028000235557556,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.9028000235557556,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.08269999921321869,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.003100000089034438,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/membership-inference-attacks","display_name":"membership inference attacks","score":0.9739999771118164},{"id":"https://openalex.org/keywords/large-language-models","display_name":"large language models","score":0.9860000014305115},{"id":"https://openalex.org/keywords/training-data-leakage","display_name":"training data leakage","score":0.5979999899864197},{"id":"https://openalex.org/keywords/likelihood-estimation","display_name":"likelihood estimation","score":0.6050000190734863},{"id":"https://openalex.org/keywords/kernel-smoothing","display_name":"kernel smoothing","score":0.6819999814033508},{"id":"https://openalex.org/keywords/privacy-risk-assessment","display_name":"privacy risk assessment","score":0.46000000834465027}],"concepts":[{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.64410001039505},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6366000175476074},{"id":"https://openalex.org/C96250715","wikidata":"https://www.wikidata.org/wiki/Q965330","display_name":"Estimation","level":2,"score":0.5149000287055969},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.47429999709129333},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4625999927520752},{"id":"https://openalex.org/C74193536","wikidata":"https://www.wikidata.org/wiki/Q574844","display_name":"Kernel (algebra)","level":2,"score":0.42149999737739563},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.39989998936653137},{"id":"https://openalex.org/C149782125","wikidata":"https://www.wikidata.org/wiki/Q160039","display_name":"Econometrics","level":1,"score":0.373199999332428},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36800000071525574},{"id":"https://openalex.org/C52740198","wikidata":"https://www.wikidata.org/wiki/Q1539564","display_name":"Importance sampling","level":3,"score":0.3580000102519989},{"id":"https://openalex.org/C95167961","wikidata":"https://www.wikidata.org/wiki/Q4483495","display_name":"Fiducial inference","level":5,"score":0.35420000553131104},{"id":"https://openalex.org/C134261354","wikidata":"https://www.wikidata.org/wiki/Q938438","display_name":"Statistical inference","level":2,"score":0.33880001306533813},{"id":"https://openalex.org/C140779682","wikidata":"https://www.wikidata.org/wiki/Q210868","display_name":"Sampling (signal processing)","level":3,"score":0.33180001378059387},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.32179999351501465},{"id":"https://openalex.org/C158600405","wikidata":"https://www.wikidata.org/wiki/Q5054566","display_name":"Causal inference","level":2,"score":0.3068999946117401},{"id":"https://openalex.org/C105795698","wikidata":"https://www.wikidata.org/wiki/Q12483","display_name":"Statistics","level":1,"score":0.29600000381469727},{"id":"https://openalex.org/C52421305","wikidata":"https://www.wikidata.org/wiki/Q1151499","display_name":"Particle filter","level":3,"score":0.2921999990940094},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.2799000144004822},{"id":"https://openalex.org/C71134354","wikidata":"https://www.wikidata.org/wiki/Q458825","display_name":"Kernel density estimation","level":3,"score":0.2741999924182892},{"id":"https://openalex.org/C149441793","wikidata":"https://www.wikidata.org/wiki/Q200726","display_name":"Probability distribution","level":2,"score":0.2702000141143799},{"id":"https://openalex.org/C2780966255","wikidata":"https://www.wikidata.org/wiki/Q5474306","display_name":"Foundation (evidence)","level":2,"score":0.2606000006198883},{"id":"https://openalex.org/C917703","wikidata":"https://www.wikidata.org/wiki/Q7239668","display_name":"Predictive inference","level":5,"score":0.2578999996185303},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.2547999918460846},{"id":"https://openalex.org/C106131492","wikidata":"https://www.wikidata.org/wiki/Q3072260","display_name":"Filter (signal processing)","level":2,"score":0.2540000081062317}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.18653/2026.emnlp-main.446","doi":"https://doi.org/10.18653/2026.emnlp-main.446","is_oa":true,"landing_page_url":"https://doi.org/10.18653/2026.emnlp-main.446","pdf_url":"https://aclanthology.org/2026.emnlp-main.446.pdf","source":{"id":"https://openalex.org/S4363608991","display_name":"Conference on Empirical Methods in Natural Language Processing (EMNLP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2609.10611","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.10611","pdf_url":"https://arxiv.org/pdf/2609.10611","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.10611","doi":"https://doi.org/10.48550/arxiv.2609.10611","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.10611","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.18653/2026.emnlp-main.446","doi":"https://doi.org/10.18653/2026.emnlp-main.446","is_oa":true,"landing_page_url":"https://doi.org/10.18653/2026.emnlp-main.446","pdf_url":"https://aclanthology.org/2026.emnlp-main.446.pdf","source":{"id":"https://openalex.org/S4363608991","display_name":"Conference on Empirical Methods in Natural Language Processing (EMNLP)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing","raw_type":"proceedings-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G1258512577","display_name":null,"funder_award_id":"P0046811","funder_id":"https://openalex.org/F4320322598","funder_display_name":"Hong Kong Polytechnic University"}],"funders":[{"id":"https://openalex.org/F4320322598","display_name":"Hong Kong Polytechnic University","ror":"https://ror.org/0030zas98"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7212287809.pdf","grobid_xml":"https://content.openalex.org/works/W7212287809.grobid-xml"},"referenced_works_count":5,"referenced_works":["https://openalex.org/W1614298861","https://openalex.org/W4386185470","https://openalex.org/W4389157038","https://openalex.org/W4414939355","https://openalex.org/W7124755153"],"related_works":["https://openalex.org/W7124755153","https://openalex.org/W7166852558","https://openalex.org/W7155164840","https://openalex.org/W7125260976","https://openalex.org/W4404783485","https://openalex.org/W7126185189","https://openalex.org/W7125800646","https://openalex.org/W7165871665","https://openalex.org/W7166807663","https://openalex.org/W7166821776"],"abstract_inverted_index":{"Membership":[0],"inference":[1],"attacks":[2],"(MIAs)":[3],"have":[4],"emerged":[5],"as":[6],"critical":[7],"tools":[8],"for":[9,69,152],"auditing":[10],"privacy":[11,72],"risks":[12],"in":[13,27,45],"large":[14],"language":[15],"models":[16],"(LLMs),":[17],"aiming":[18],"to":[19,37,47],"determine":[20],"whether":[21],"a":[22,28,65,91,149],"given":[23],"text":[24],"was":[25],"included":[26],"model's":[29],"training":[30],"corpus.However,":[31],"most":[32],"existing":[33,124],"MIAs":[34],"require":[35],"access":[36],"per-token":[38],"logits":[39],"or":[40],"probabilities,":[41],"making":[42],"them":[43],"inapplicable":[44],"practice":[46],"proprietary":[48,133],"LLMs":[49,117],"that":[50,120],"expose":[51],"only":[52],"textual":[53],"continuations.To":[54],"address":[55],"this":[56],"underexplored":[57],"setting,":[58],"we":[59,127],"propose":[60],"Word-level":[61],"Probability":[62],"MIA":[63,68],"(WPMIA),":[64],"statistically":[66],"principled":[67],"strict":[70,156],"black-box":[71,125,157],"auditing.WP-MIA":[73],"estimates":[74,89],"word-level":[75],"generation":[76],"probabilities":[77],"via":[78],"Monte":[79],"Carlo":[80],"sampling":[81],"with":[82],"local":[83],"kernel":[84],"smoothing,":[85],"then":[86],"aggregates":[87],"these":[88,145],"into":[90],"sequence-level":[92],"likelihood":[93,98],"estimator.Furthermore,":[94],"WPMIA":[95,113],"constructs":[96],"the":[97,105],"conditioned":[99],"on":[100,131,155],"different":[101],"prefixes,":[102],"thereby":[103],"amplifying":[104],"distributional":[106],"differences":[107],"between":[108],"members":[109],"and":[110,118],"non-members.We":[111],"evaluate":[112,129],"across":[114,144],"various":[115],"open-source":[116],"find":[119],"it":[121],"consistently":[122],"outperforms":[123],"baselines.Importantly,":[126],"also":[128],"WP-MIA":[130],"modern":[132],"LLMs,":[134],"including":[135],"GPT-5-Chat,":[136],"Gemini-2.5-Flash,and":[137],"Claude-4.5-Haiku,achieving":[138],"an":[139],"average":[140],"TPR@5%FPR":[141],"of":[142],"42.0":[143],"models.These":[146],"results":[147],"offer":[148],"sound":[150],"foundation":[151],"future":[153],"research":[154],"membership":[158],"inference.Code":[159],"is":[160],"available":[161],"at":[162],"https://github.com/niusj03/WPMIA.":[163]},"counts_by_year":[],"updated_date":"2026-11-08T12:12:28.789561","created_date":"2026-09-12T00:00:00"}