{"id":"https://openalex.org/W4416549604","doi":"https://doi.org/10.1145/3719027.3765103","title":"<i>DCMI:</i> A Differential Calibration Membership Inference Attack Against Retrieval-Augmented Generation","display_name":"<i>DCMI:</i> A Differential Calibration Membership Inference Attack Against Retrieval-Augmented Generation","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549604","doi":"https://doi.org/10.1145/3719027.3765103"},"language":null,"primary_location":{"id":"doi:10.1145/3719027.3765103","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765103","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765103","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765103","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xinyu Gao","orcid":"https://orcid.org/0009-0001-1709-8644"},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinyu Gao","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, China"],"raw_orcid":"https://orcid.org/0009-0001-1709-8644","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, China","institution_ids":["https://openalex.org/I80143920"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101791970","display_name":"Xiangtao Meng","orcid":"https://orcid.org/0009-0006-5613-8932"},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiangtao Meng","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, China"],"raw_orcid":"https://orcid.org/0009-0006-5613-8932","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, China","institution_ids":["https://openalex.org/I80143920"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111279850","display_name":"Yingkai Dong","orcid":"https://orcid.org/0009-0001-6245-1240"},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]},{"id":"https://openalex.org/I34949971","display_name":"University of Jinan","ror":"https://ror.org/02mjz6f26","country_code":"CN","type":"education","lineage":["https://openalex.org/I34949971"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yingkai Dong","raw_affiliation_strings":["Department of Engineering Software, School of Civil Engineering, Shandong University, Jinan, China"],"raw_orcid":"https://orcid.org/0009-0001-6245-1240","affiliations":[{"raw_affiliation_string":"Department of Engineering Software, School of Civil Engineering, Shandong University, Jinan, China","institution_ids":["https://openalex.org/I154099455","https://openalex.org/I34949971"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101809231","display_name":"Zheng Li","orcid":"https://orcid.org/0000-0002-4466-7523"},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheng Li","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, China, State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China, and Shandong Key Laboratory of Artificial Intelligence Security, Shandong University, Qingdao, China"],"raw_orcid":"https://orcid.org/0000-0002-4466-7523","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, China, State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China, and Shandong Key Laboratory of Artificial Intelligence Security, Shandong University, Qingdao, China","institution_ids":["https://openalex.org/I80143920"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5084460856","display_name":"Shanqing Guo","orcid":"https://orcid.org/0000-0003-3367-0951"},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shanqing Guo","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, China, State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China, and Shandong Key Laboratory of Artificial Intelligence Security, Shandong University, Qingdao, China"],"raw_orcid":"https://orcid.org/0000-0003-3367-0951","affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, China, State Key Laboratory of Cryptography and Digital Economy Security, Shandong University, Qingdao, China, and Shandong Key Laboratory of Artificial Intelligence Security, Shandong University, Qingdao, China","institution_ids":["https://openalex.org/I80143920"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.17155174,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"4184","last_page":"4198"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.2720000147819519,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.2720000147819519,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.14169999957084656,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.13850000500679016,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.70169997215271},{"id":"https://openalex.org/keywords/limiting","display_name":"Limiting","score":0.5817000269889832},{"id":"https://openalex.org/keywords/calibration","display_name":"Calibration","score":0.5340999960899353},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.41999998688697815},{"id":"https://openalex.org/keywords/differential-privacy","display_name":"Differential privacy","score":0.3700999915599823},{"id":"https://openalex.org/keywords/interference","display_name":"Interference (communication)","score":0.36579999327659607},{"id":"https://openalex.org/keywords/information-leakage","display_name":"Information leakage","score":0.3643999993801117},{"id":"https://openalex.org/keywords/information-sensitivity","display_name":"Information sensitivity","score":0.351500004529953}],"concepts":[{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.70169997215271},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6152999997138977},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.5817000269889832},{"id":"https://openalex.org/C165838908","wikidata":"https://www.wikidata.org/wiki/Q736777","display_name":"Calibration","level":2,"score":0.5340999960899353},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.5200999975204468},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.41999998688697815},{"id":"https://openalex.org/C23130292","wikidata":"https://www.wikidata.org/wiki/Q5275358","display_name":"Differential privacy","level":2,"score":0.3700999915599823},{"id":"https://openalex.org/C32022120","wikidata":"https://www.wikidata.org/wiki/Q797225","display_name":"Interference (communication)","level":3,"score":0.36579999327659607},{"id":"https://openalex.org/C2779201187","wikidata":"https://www.wikidata.org/wiki/Q2775060","display_name":"Information leakage","level":2,"score":0.3643999993801117},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3540000021457672},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.35190001130104065},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.351500004529953},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.349700003862381},{"id":"https://openalex.org/C93226319","wikidata":"https://www.wikidata.org/wiki/Q193137","display_name":"Differential (mechanical device)","level":2,"score":0.3456000089645386},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.3271999955177307},{"id":"https://openalex.org/C3017597292","wikidata":"https://www.wikidata.org/wiki/Q25052250","display_name":"Privacy protection","level":2,"score":0.28610000014305115},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.28189998865127563},{"id":"https://openalex.org/C113336015","wikidata":"https://www.wikidata.org/wiki/Q574010","display_name":"Complete information","level":2,"score":0.27570000290870667},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.2711000144481659},{"id":"https://openalex.org/C2988105877","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference system","level":5,"score":0.25999999046325684},{"id":"https://openalex.org/C46743427","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference engine","level":3,"score":0.2547000050544739}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3719027.3765103","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765103","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765103","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3719027.3765103","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3765103","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3719027.3765103","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1654584704","display_name":null,"funder_award_id":"ZR2022LZH013","funder_id":"https://openalex.org/F4320324174","funder_display_name":"Natural Science Foundation of Shandong Province"},{"id":"https://openalex.org/G1738542756","display_name":null,"funder_award_id":"ZR2021LZH007","funder_id":"https://openalex.org/F4320324174","funder_display_name":"Natural Science Foundation of Shandong Province"},{"id":"https://openalex.org/G2987532448","display_name":null,"funder_award_id":"No. 62372268","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G3253313070","display_name":null,"funder_award_id":"2021GXRC084","funder_id":"https://openalex.org/F4320324174","funder_display_name":"Natural Science Foundation of Shandong Province"},{"id":"https://openalex.org/G6062977081","display_name":null,"funder_award_id":"ZR2021LZH007","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6855559198","display_name":null,"funder_award_id":"62372268","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6870109061","display_name":null,"funder_award_id":"No. ZR2022LZH013, No. ZR2021LZH007","funder_id":"https://openalex.org/F4320324174","funder_display_name":"Natural Science Foundation of Shandong Province"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320324174","display_name":"Natural Science Foundation of Shandong Province","ror":null}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416549604.pdf","grobid_xml":"https://content.openalex.org/works/W4416549604.grobid-xml"},"referenced_works_count":18,"referenced_works":["https://openalex.org/W2535690855","https://openalex.org/W2795435272","https://openalex.org/W2930926105","https://openalex.org/W2947469743","https://openalex.org/W3099700870","https://openalex.org/W3138815606","https://openalex.org/W4288057780","https://openalex.org/W4307079201","https://openalex.org/W4308361270","https://openalex.org/W4385476046","https://openalex.org/W4388650545","https://openalex.org/W4388778348","https://openalex.org/W4391376033","https://openalex.org/W4392193048","https://openalex.org/W4401042773","https://openalex.org/W4405181420","https://openalex.org/W4405181769","https://openalex.org/W4415800460"],"related_works":[],"abstract_inverted_index":{"While":[0],"Retrieval-Augmented":[1],"Generation":[2],"(RAG)":[3],"effectively":[4],"reduces":[5],"hallucinations":[6],"by":[7,131],"integrating":[8],"external":[9,30],"knowledge":[10],"bases,":[11],"it":[12],"introduces":[13],"vulnerabilities":[14],"to":[15,89,171],"membership":[16],"inference":[17],"attacks":[18],"(MIAs),":[19],"particularly":[20],"in":[21,158,185],"systems":[22,160],"handling":[23],"sensitive":[24],"data.":[25],"Existing":[26],"MIAs":[27],"targeting":[28],"RAG's":[29],"databases":[31],"often":[32],"rely":[33],"on":[34,44,135],"model":[35],"responses":[36],"but":[37],"ignore":[38],"the":[39,62,71,91,98,122,128,150,163,172,181],"interference":[40,99],"of":[41,65,93,175],"non-member-retrieved":[42,66,101],"documents":[43,79,95],"RAG":[45,123,137,159,188],"outputs,":[46],"limiting":[47],"their":[48],"effectiveness.":[49],"To":[50],"address":[51],"this,":[52],"we":[53],"propose":[54],"DCMI,":[55],"a":[56,146],"differential":[57],"calibration":[58,88],"MIA":[59],"that":[60,109],"mitigates":[61],"negative":[63],"impact":[64],"documents.":[67,102],"Specifically,":[68],"DCMI":[69,110,144],"leverages":[70],"sensitivity":[72],"gap":[73],"between":[74],"member":[75],"and":[76,118,142,161],"non-member":[77],"retrieved":[78],"under":[80,104],"query":[81],"perturbation.":[82],"It":[83],"generates":[84],"perturbed":[85],"queries":[86],"for":[87,165],"isolate":[90],"contribution":[92],"member-retrieved":[94],"while":[96],"minimizing":[97],"from":[100],"Experiments":[103],"progressively":[105],"relaxed":[106],"assumptions":[107],"show":[108],"consistently":[111],"outperforms":[112],"baselines\u2014for":[113],"example,":[114],"achieving":[115],"97.42%":[116],"AUC":[117],"94.35%":[119],"Accuracy":[120],"against":[121,180],"system":[124],"with":[125],"Flan-T5,":[126],"exceeding":[127],"MBA":[129],"baseline":[130],"over":[132,149],"40%.":[133],"Furthermore,":[134],"real-world":[136],"platforms":[138],"such":[139],"as":[140],"Dify":[141],"MaxKB,":[143],"maintains":[145],"10%-20%":[147],"advantage":[148],"baseline.":[151],"These":[152],"results":[153],"highlight":[154],"significant":[155],"privacy":[156],"risks":[157,184],"emphasize":[162],"need":[164],"stronger":[166],"protection":[167],"mechanisms.":[168],"We":[169],"appeal":[170],"community's":[173],"consideration":[174],"deeper":[176],"investigations,":[177],"like":[178],"ours,":[179],"data":[182],"leakage":[183],"rapidly":[186],"evolving":[187],"systems.":[189]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-11-23T00:00:00"}