{"id":"https://openalex.org/W7162393521","doi":"https://doi.org/10.48550/arxiv.2605.24312","title":"Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment","display_name":"Five Queries Are Enough: Query-Efficient and Surrogate-Free Membership Inference Attacks on RAG via Entailment","publication_year":2026,"publication_date":"2026-05-23","ids":{"openalex":"https://openalex.org/W7162393521","doi":"https://doi.org/10.48550/arxiv.2605.24312"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.24312","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.24312","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.24312","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5118986511","display_name":"Nguyen Linh Bao Nguyen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen, Nguyen Linh Bao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5011383481","display_name":"Wanlun Ma","orcid":"https://orcid.org/0000-0002-6305-1740"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Wanlun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137056431","display_name":"Viet Vo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vo, Viet","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137017572","display_name":"Alsharif Abuadbba","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Abuadbba, Alsharif","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137055290","display_name":"Minghong Fang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fang, Minghong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137082173","display_name":"Jun Zhang","orcid":"https://orcid.org/0000-0003-1706-1611"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Jun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137054245","display_name":"Yang Xiang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xiang, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.24089999496936798,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.24089999496936798,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.19189999997615814,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.13750000298023224,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.7167999744415283},{"id":"https://openalex.org/keywords/logical-consequence","display_name":"Logical consequence","score":0.6729000210762024},{"id":"https://openalex.org/keywords/limiting","display_name":"Limiting","score":0.6082000136375427},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.5936999917030334},{"id":"https://openalex.org/keywords/relevance","display_name":"Relevance (law)","score":0.41609999537467957},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.376800000667572},{"id":"https://openalex.org/keywords/textual-entailment","display_name":"Textual entailment","score":0.3555000126361847},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.3305000066757202}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7287999987602234},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.7167999744415283},{"id":"https://openalex.org/C134752490","wikidata":"https://www.wikidata.org/wiki/Q374182","display_name":"Logical consequence","level":2,"score":0.6729000210762024},{"id":"https://openalex.org/C188198153","wikidata":"https://www.wikidata.org/wiki/Q1613840","display_name":"Limiting","level":2,"score":0.6082000136375427},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5936999917030334},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.41609999537467957},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.376800000667572},{"id":"https://openalex.org/C95318506","wikidata":"https://www.wikidata.org/wiki/Q6588467","display_name":"Textual entailment","level":3,"score":0.3555000126361847},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3483000099658966},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3425999879837036},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.3305000066757202},{"id":"https://openalex.org/C3746660","wikidata":"https://www.wikidata.org/wiki/Q1068763","display_name":"Rule of inference","level":2,"score":0.3255999982357025},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.30709999799728394},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.2985999882221222},{"id":"https://openalex.org/C117797892","wikidata":"https://www.wikidata.org/wiki/Q286363","display_name":"Shadow (psychology)","level":2,"score":0.2953999936580658},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.28940001130104065},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.28769999742507935},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.2694999873638153},{"id":"https://openalex.org/C3020493868","wikidata":"https://www.wikidata.org/wiki/Q55631277","display_name":"Real world data","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.26249998807907104},{"id":"https://openalex.org/C160920958","wikidata":"https://www.wikidata.org/wiki/Q7662746","display_name":"Synthetic data","level":2,"score":0.2623000144958496},{"id":"https://openalex.org/C113336015","wikidata":"https://www.wikidata.org/wiki/Q574010","display_name":"Complete information","level":2,"score":0.26190000772476196},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.2549999952316284}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.24312","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.24312","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.24312","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.24312","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.736038327217102,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Retrieval-augmented":[0],"generation":[1],"(RAG)":[2],"has":[3],"become":[4],"central":[5],"to":[6,19,107,148,160,196,200],"large":[7,137],"language":[8],"model":[9,30,123],"(LLM)":[10],"deployments,":[11],"grounding":[12],"responses":[13,124],"in":[14,39,218],"enterprise":[15],"or":[16,65,180],"proprietary":[17],"data":[18],"reduce":[20],"hallucinations.":[21],"However,":[22],"this":[23],"design":[24],"introduces":[25],"a":[26,82,100],"new":[27],"privacy":[28,216],"risk:":[29],"outputs":[31],"may":[32],"signal":[33],"the":[34,40,130,204,211,223],"presence":[35],"of":[36,213],"specific":[37],"documents":[38],"retrieval":[41,228],"corpus,":[42],"enabling":[43],"membership":[44,88],"inference":[45,89],"attacks":[46,202],"(MIAs)":[47],"that":[48,103],"leak":[49],"sensitive":[50],"information.":[51],"Existing":[52],"MIAs":[53],"are":[54],"feasible,":[55],"but":[56],"they":[57],"often":[58],"rely":[59],"on":[60],"easily":[61],"detected":[62],"templated":[63],"queries":[64,183],"require":[66],"many":[67],"non-templated":[68,92],"yet":[69],"costly":[70,133],"and":[71,86,119,125,136,143,221,229],"repetitive":[72],"queries,":[73,154],"limiting":[74],"practicality.":[75],"We":[76,94],"ask:":[77],"Can":[78],"an":[79],"adversary":[80],"launch":[81],"limited-budget,":[83],"surrogate-free,":[84],"stealthy,":[85],"defense-agnostic":[87],"attack":[90,192,206],"using":[91],"queries?":[93],"present":[95],"MEntA":[96,128,145,179,189],"(Membership":[97],"Entailment":[98],"Attack),":[99],"query-efficient":[101],"MIA":[102],"leverages":[104],"natural-language":[105],"entailment":[106,121],"maximize":[108],"information":[109],"gained":[110],"per":[111],"query.":[112],"By":[113],"asking":[114],"low-cost,":[115],"broad,":[116],"information-seeking":[117],"questions":[118],"measuring":[120],"between":[122],"candidate":[126],"documents,":[127],"eliminates":[129],"need":[131,225],"for":[132,226],"shadow":[134],"models":[135],"query":[138],"budgets.":[139],"Across":[140],"NFCorpus,":[141],"SCIDOCS,":[142],"TREC-COVID,":[144],"achieves":[146],"up":[147,159,195],"0.991":[149],"AUC":[150,162],"with":[151],"only":[152],"5":[153],"outperforming":[155],"prior":[156],"methods":[157],"by":[158,194],"0.42":[161],"under":[163,169,203],"equivalent":[164],"conditions.":[165],"It":[166],"remains":[167],"effective":[168],"state-of-the-art":[170],"(SOTA)":[171],"RAG":[172,219],"defenses,":[173],"while":[174],"current":[175],"detectors":[176],"either":[177],"miss":[178],"flag":[181],"benign":[182],"at":[184],"high":[185],"rates.":[186],"Regarding":[187],"cost,":[188],"reduces":[190],"total":[191],"cost":[193],"65$\\times$":[197],"lower":[198],"compared":[199],"SOTA":[201],"same":[205],"setting.":[207],"Our":[208],"findings":[209],"expose":[210],"feasibility":[212],"realistic,":[214],"low-cost":[215],"leakage":[217],"systems":[220],"highlight":[222],"urgent":[224],"privacy-aware":[227],"defense":[230],"mechanisms.":[231]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-27T00:00:00"}