{"id":"https://openalex.org/W4416036638","doi":"https://doi.org/10.18653/v1/2025.emnlp-main.551","title":"Identifying Unlearned Data in LLMs via Membership Inference Attacks","display_name":"Identifying Unlearned Data in LLMs via Membership Inference Attacks","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4416036638","doi":"https://doi.org/10.18653/v1/2025.emnlp-main.551"},"language":null,"primary_location":{"id":"doi:10.18653/v1/2025.emnlp-main.551","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.emnlp-main.551","pdf_url":"https://aclanthology.org/2025.emnlp-main.551.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://aclanthology.org/2025.emnlp-main.551.pdf","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5042903304","display_name":"Akshay Deepak","orcid":"https://orcid.org/0000-0001-6854-8599"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Advit Deepak","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5071343470","display_name":"Mingyue Mou","orcid":"https://orcid.org/0000-0002-1930-4413"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Megan Mou","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5079589666","display_name":"Jing Huang","orcid":"https://orcid.org/0000-0001-5464-3990"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jing Huang","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5089413311","display_name":"Diyi Yang","orcid":"https://orcid.org/0000-0003-1220-3983"},"institutions":[{"id":"https://openalex.org/I97018004","display_name":"Stanford University","ror":"https://ror.org/00f54p054","country_code":"US","type":"education","lineage":["https://openalex.org/I97018004"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Diyi Yang","raw_affiliation_strings":["Stanford University"],"affiliations":[{"raw_affiliation_string":"Stanford University","institution_ids":["https://openalex.org/I97018004"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5042903304"],"corresponding_institution_ids":["https://openalex.org/I97018004"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.18600993,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"10884","last_page":"10903"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.1809999942779541,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.1809999942779541,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11719","display_name":"Data Quality and Management","score":0.08659999817609787,"subfield":{"id":"https://openalex.org/subfields/1803","display_name":"Management Science and Operations Research"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.07050000131130219,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.569100022315979},{"id":"https://openalex.org/keywords/inference-system","display_name":"Inference system","score":0.2596000134944916},{"id":"https://openalex.org/keywords/pattern-recognition","display_name":"Pattern recognition (psychology)","score":0.25540000200271606},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.25099998712539673},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.2443999946117401}],"concepts":[{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.569100022315979},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5231000185012817},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4986000061035156},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26660001277923584},{"id":"https://openalex.org/C2988105877","wikidata":"https://www.wikidata.org/wiki/Q1341685","display_name":"Inference system","level":5,"score":0.2596000134944916},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.25540000200271606},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.25099998712539673},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2443999946117401},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.22830000519752502},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.2273000031709671}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.18653/v1/2025.emnlp-main.551","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.emnlp-main.551","pdf_url":"https://aclanthology.org/2025.emnlp-main.551.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.18653/v1/2025.emnlp-main.551","is_oa":true,"landing_page_url":"https://doi.org/10.18653/v1/2025.emnlp-main.551","pdf_url":"https://aclanthology.org/2025.emnlp-main.551.pdf","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416036638.pdf","grobid_xml":"https://content.openalex.org/works/W4416036638.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Unlearning":[0,86],"evaluation":[1,83],"has":[2],"traditionally":[3],"followed":[4],"the":[5,26,46,60,64,69,112,134],"retrieval":[6],"paradigm,":[7],"where":[8],"adversaries":[9],"attempt":[10],"to":[11,22,108,142,158],"extract":[12],"residual":[13],"knowledge":[14,30],"of":[15,28,72],"an":[16,35],"unlearning":[17,99,120],"target":[18],"by":[19,155],"issuing":[20],"queries":[21],"a":[23,81],"language":[24],"model.However,":[25],"absence":[27],"retrievable":[29],"does":[31],"not":[32,148],"necessarily":[33],"prevent":[34],"adversary":[36],"from":[37,93],"inferring":[38],"which":[39],"targets":[40],"have":[41],"been":[42],"intentionally":[43],"unlearned":[44,127],"in":[45,63,111,133,150],"post-training":[47],"optimization.Such":[48],"inferences":[49],"can":[50,105,137],"still":[51],"pose":[52],"significant":[53],"privacy":[54,77,146],"risks,":[55,78],"as":[56],"they":[57],"may":[58],"reveal":[59],"sensitive":[61],"data":[62],"model's":[65],"training":[66],"set":[67,136],"and":[68,129],"internal":[70],"policies":[71],"model":[73],"creators.To":[74],"quantify":[75],"such":[76],"we":[79,115],"propose":[80],"new":[82],"framework":[84],"Forensic":[85],"Membership":[87],"Attacks":[88],"(FUMA),":[89],"drawing":[90],"on":[91,122],"principles":[92],"membership":[94,110],"inference":[95],"attacks.FUMA":[96],"assesses":[97],"whether":[98],"leaves":[100],"behind":[101],"detectable":[102],"artifacts":[103],"that":[104,131],"be":[106,138],"exploited":[107],"infer":[109],"forget":[113,135],"set.Specifically,":[114],"evaluate":[116],"four":[117],"major":[118],"optimization-based":[119],"methods":[121],"258":[123],"models":[124],"across":[125],"diverse":[126],"settings":[128],"show":[130],"examples":[132],"identified":[139],"with":[140],"up":[141],"99%":[143],"accuracy.This":[144],"highlights":[145],"risks":[147],"covered":[149],"existing":[151],"retrieval-based":[152],"benchmarks.We":[153],"conclude":[154],"discussing":[156],"recommendations":[157],"mitigate":[159],"these":[160],"vulnerabilities.":[161]},"counts_by_year":[],"updated_date":"2026-03-09T07:00:12.390032","created_date":"2025-11-08T00:00:00"}