{"id":"https://openalex.org/W7108732436","doi":"https://doi.org/10.1109/tifs.2025.3640876","title":"Falcon: A Universal Text-Only Membership Inference Attack Framework Against In-Context Learning","display_name":"Falcon: A Universal Text-Only Membership Inference Attack Framework Against In-Context Learning","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W7108732436","doi":"https://doi.org/10.1109/tifs.2025.3640876"},"language":null,"primary_location":{"id":"doi:10.1109/tifs.2025.3640876","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3640876","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Haitao Su","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Haitao Su","raw_affiliation_strings":["Qiuzhen College, Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Qiuzhen College, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yue Qin","orcid":"https://orcid.org/0000-0002-7857-2936"},"institutions":[{"id":"https://openalex.org/I137867983","display_name":"Central University of Finance and Economics","ror":"https://ror.org/008e3hf02","country_code":"CN","type":"education","lineage":["https://openalex.org/I137867983"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yue Qin","raw_affiliation_strings":["School of Information, Central University of Finance and Economics, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-7857-2936","affiliations":[{"raw_affiliation_string":"School of Information, Central University of Finance and Economics, Beijing, China","institution_ids":["https://openalex.org/I137867983"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhenhua Li","orcid":"https://orcid.org/0000-0001-7286-122X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhenhua Li","raw_affiliation_strings":["School of Software, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-7286-122X","affiliations":[{"raw_affiliation_string":"School of Software, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Xin Miao","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xin Miao","raw_affiliation_strings":["School of Software, Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Software, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":null,"display_name":"Yuan Zhou","orcid":"https://orcid.org/0009-0008-1706-6539"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuan Zhou","raw_affiliation_strings":["Department of Mathematical Sciences, Yau Mathematical Sciences Center, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0008-1706-6539","affiliations":[{"raw_affiliation_string":"Department of Mathematical Sciences, Yau Mathematical Sciences Center, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.71931776,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"20","issue":null,"first_page":"12964","last_page":"12979"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.35679998993873596,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.35679998993873596,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.18559999763965607,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.06469999998807907,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7856000065803528},{"id":"https://openalex.org/keywords/safeguarding","display_name":"Safeguarding","score":0.6444000005722046},{"id":"https://openalex.org/keywords/codebase","display_name":"Codebase","score":0.6216999888420105},{"id":"https://openalex.org/keywords/obfuscation","display_name":"Obfuscation","score":0.6101999878883362},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.5855000019073486},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.541700005531311},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.4300000071525574},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3522999882698059}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8565000295639038},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7856000065803528},{"id":"https://openalex.org/C2776743756","wikidata":"https://www.wikidata.org/wiki/Q5097921","display_name":"Safeguarding","level":2,"score":0.6444000005722046},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.6216999888420105},{"id":"https://openalex.org/C40305131","wikidata":"https://www.wikidata.org/wiki/Q2616305","display_name":"Obfuscation","level":2,"score":0.6101999878883362},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5855000019073486},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.541700005531311},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4641000032424927},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.4300000071525574},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.36070001125335693},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3522999882698059},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3522000014781952},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.34700000286102295},{"id":"https://openalex.org/C183322885","wikidata":"https://www.wikidata.org/wiki/Q17007702","display_name":"Context model","level":3,"score":0.3353999853134155},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33340001106262207},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.3276999890804291},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3255999982357025},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.29649999737739563},{"id":"https://openalex.org/C2778755073","wikidata":"https://www.wikidata.org/wiki/Q10858537","display_name":"Scale (ratio)","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.2687000036239624},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.2644999921321869},{"id":"https://openalex.org/C145644426","wikidata":"https://www.wikidata.org/wiki/Q169411","display_name":"Unified Modeling Language","level":3,"score":0.2603999972343445},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.25450000166893005},{"id":"https://openalex.org/C125411270","wikidata":"https://www.wikidata.org/wiki/Q18653","display_name":"Encoding (memory)","level":2,"score":0.25369998812675476},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.2515000104904175},{"id":"https://openalex.org/C99221444","wikidata":"https://www.wikidata.org/wiki/Q1532069","display_name":"Private information retrieval","level":2,"score":0.25099998712539673}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tifs.2025.3640876","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tifs.2025.3640876","pdf_url":null,"source":{"id":"https://openalex.org/S61310614","display_name":"IEEE Transactions on Information Forensics and Security","issn_l":"1556-6013","issn":["1556-6013","1556-6021"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Information Forensics and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.7012346982955933,"id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G1382511481","display_name":null,"funder_award_id":"52494974","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":48,"referenced_works":["https://openalex.org/W1964421503","https://openalex.org/W1970026646","https://openalex.org/W1970409510","https://openalex.org/W2049870103","https://openalex.org/W2070246124","https://openalex.org/W2081580037","https://openalex.org/W2168356776","https://openalex.org/W2535690855","https://openalex.org/W2795435272","https://openalex.org/W2952604841","https://openalex.org/W2970482702","https://openalex.org/W2970641574","https://openalex.org/W2989219518","https://openalex.org/W3096738375","https://openalex.org/W3186492090","https://openalex.org/W3204112174","https://openalex.org/W3214437258","https://openalex.org/W4287891464","https://openalex.org/W4288057780","https://openalex.org/W4308410483","https://openalex.org/W4308410741","https://openalex.org/W4377197101","https://openalex.org/W4385245566","https://openalex.org/W4385571358","https://openalex.org/W4386230986","https://openalex.org/W4387321091","https://openalex.org/W4388887013","https://openalex.org/W4389520084","https://openalex.org/W4389520257","https://openalex.org/W4389520406","https://openalex.org/W4390486238","https://openalex.org/W4391876619","https://openalex.org/W4392240262","https://openalex.org/W4393263716","https://openalex.org/W4399745717","https://openalex.org/W4401857375","https://openalex.org/W4402665833","https://openalex.org/W4402671828","https://openalex.org/W4403429068","https://openalex.org/W4404181272","https://openalex.org/W4404782475","https://openalex.org/W4404782717","https://openalex.org/W4404782964","https://openalex.org/W4404784117","https://openalex.org/W4405181769","https://openalex.org/W4409361722","https://openalex.org/W4410609238","https://openalex.org/W4415800460"],"related_works":[],"abstract_inverted_index":{"Membership":[0],"inference":[1],"attacks":[2],"(MIAs)":[3],"against":[4,33,64],"in-context":[5],"learning":[6],"(ICL)":[7],"serve":[8],"as":[9,91,190],"essential":[10],"tools":[11],"for":[12,28,132,194],"privacy":[13],"risk":[14,41],"assessment":[15],"and":[16,77,100,120,125,139],"intellectual":[17],"property":[18],"safeguarding":[19,102,195],"due":[20],"to":[21,178,205],"the":[22,59,71,79,157],"use":[23],"of":[24,73,156,159],"small,":[25],"private":[26],"datasets":[27,128],"adaptation.":[29],"However,":[30],"most":[31],"MIAs":[32],"language":[34],"models":[35,115,123,171],"require":[36],"unrealistic,":[37],"internal":[38],"access":[39],"or":[40],"triggering":[42],"built-in":[43],"security":[44],"mechanisms.":[45,103],"In":[46],"this":[47],"paper,":[48],"we":[49,182],"propose":[50],"Falcon":[51,68,141,164],"(Flexible":[52],"Attack":[53],"on":[54,107],"Language":[55],"Context":[56],"via":[57],"ObfuscatioN),":[58],"first":[60],"task-aware":[61],"MIA":[62],"framework":[63],"text-only":[65],"model":[66,160],"APIs.":[67],"fully":[69],"exploits":[70,165],"complexity":[72],"text":[74,137],"obfuscation":[75],"techniques":[76],"leverages":[78],"model\u2019s":[80],"discrepancies":[81],"in":[82],"reconstructing":[83],"obfuscated":[84],"texts":[85],"from":[86,129],"seen":[87],"versus":[88],"unseen":[89],"data":[90],"a":[92,166,191],"strong":[93],"membership":[94],"signal,":[95],"successfully":[96],"bypassing":[97],"application":[98],"constraints":[99],"LLM":[101,196],"Through":[104],"extensive":[105],"experiments":[106],"six":[108],"widely":[109],"used":[110],"LLMs,":[111],"including":[112,134],"four":[113],"open-source":[114],"(Llama-2,":[116],"Llama-3,":[117],"Qwen-2.5,":[118],"Ministral)":[119],"two":[121],"commercial":[122],"(GPT-3.5,":[124],"GPT-4o-mini),":[126],"five":[127],"various":[130],"domains":[131],"tasks":[133],"question":[135],"answering,":[136],"classification":[138],"summarization,":[140],"generally":[142],"achieves":[143],"over":[144],"95%":[145],"attack":[146],"success":[147],"rates,":[148],"significantly":[149],"outperforming":[150],"existing":[151],"methods.":[152],"An":[153],"in-depth":[154],"analysis":[155],"impact":[158],"scale":[161],"shows":[162],"that":[163,170],"capacity-induced":[167],"vulnerability,":[168],"indicating":[169],"with":[172],"higher":[173],"capabilities":[174],"are":[175],"more":[176],"susceptible":[177],"our":[179],"attack.":[180],"Additionally,":[181],"explore":[183],"three":[184],"defense":[185],"methods,":[186],"highlighting":[187],"role":[188],"validation":[189],"potential":[192],"mechanism":[193],"privacy.":[197],"We":[198],"have":[199],"open-sourced":[200],"Falcon\u2019s":[201],"modular,":[202],"extensible":[203],"codebase":[204],"support":[206],"future":[207],"research.":[208]},"counts_by_year":[],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-12-05T00:00:00"}