{"id":"https://openalex.org/W7163401517","doi":"https://doi.org/10.48550/arxiv.2606.03354","title":"ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generation","display_name":"ImageAuditor: Membership Inference Attack against Image-based Retrieval-Augmented Generation","publication_year":2026,"publication_date":"2026-06-02","ids":{"openalex":"https://openalex.org/W7163401517","doi":"https://doi.org/10.48550/arxiv.2606.03354"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.03354","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.03354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.03354","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137730175","display_name":"Jinghuai Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Jinghuai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137748737","display_name":"Pengyue Yu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yu, Pengyue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026203001","display_name":"Zhexiao Lin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lin, Zhexiao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137714770","display_name":"Kunlin Cai","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cai, Kunlin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5026365218","display_name":"Fnu Suya","orcid":"https://orcid.org/0000-0002-3334-6257"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Suya, Fnu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137781482","display_name":"Yuan Tian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tian, Yuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.47429999709129333,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.47429999709129333,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10627","display_name":"Advanced Image and Video Retrieval Techniques","score":0.1940000057220459,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.05730000138282776,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.7372999787330627},{"id":"https://openalex.org/keywords/generator","display_name":"Generator (circuit theory)","score":0.6583999991416931},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.582099974155426},{"id":"https://openalex.org/keywords/aggregate","display_name":"Aggregate (composite)","score":0.5016000270843506},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.474700003862381},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.461899995803833},{"id":"https://openalex.org/keywords/cluster-analysis","display_name":"Cluster analysis","score":0.45249998569488525},{"id":"https://openalex.org/keywords/relevance","display_name":"Relevance (law)","score":0.38440001010894775},{"id":"https://openalex.org/keywords/audit","display_name":"Audit","score":0.35269999504089355}],"concepts":[{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.7372999787330627},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7028999924659729},{"id":"https://openalex.org/C2780992000","wikidata":"https://www.wikidata.org/wiki/Q17016113","display_name":"Generator (circuit theory)","level":3,"score":0.6583999991416931},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.582099974155426},{"id":"https://openalex.org/C4679612","wikidata":"https://www.wikidata.org/wiki/Q866298","display_name":"Aggregate (composite)","level":2,"score":0.5016000270843506},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.474700003862381},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.461899995803833},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4616999924182892},{"id":"https://openalex.org/C73555534","wikidata":"https://www.wikidata.org/wiki/Q622825","display_name":"Cluster analysis","level":2,"score":0.45249998569488525},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3871999979019165},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.38440001010894775},{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.35269999504089355},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.35089999437332153},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.3260999917984009},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.31189998984336853},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.3102000057697296},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.30799999833106995},{"id":"https://openalex.org/C92757383","wikidata":"https://www.wikidata.org/wiki/Q382497","display_name":"Affine transformation","level":2,"score":0.30730000138282776},{"id":"https://openalex.org/C2780226545","wikidata":"https://www.wikidata.org/wiki/Q6888030","display_name":"Modality (human\u2013computer interaction)","level":2,"score":0.3018999993801117},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.28870001435279846},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.28130000829696655},{"id":"https://openalex.org/C2164484","wikidata":"https://www.wikidata.org/wiki/Q5170150","display_name":"Core (optical fiber)","level":2,"score":0.2784000039100647},{"id":"https://openalex.org/C100776233","wikidata":"https://www.wikidata.org/wiki/Q2532492","display_name":"Bridge (graph theory)","level":2,"score":0.2782000005245209},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.26589998602867126},{"id":"https://openalex.org/C1667742","wikidata":"https://www.wikidata.org/wiki/Q10927554","display_name":"Image retrieval","level":3,"score":0.25529998540878296},{"id":"https://openalex.org/C165064840","wikidata":"https://www.wikidata.org/wiki/Q1321061","display_name":"Matching (statistics)","level":2,"score":0.2502000033855438}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.03354","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.03354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.03354","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.03354","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Reduced inequalities","score":0.665995180606842,"id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Image-based":[0],"Retrieval-Augmented":[1],"Generation":[2],"(IRAG)":[3],"conditions":[4],"a":[5,161,184],"frozen":[6],"generator":[7,121],"on":[8],"reference":[9],"images":[10,40,92,136],"retrieved":[11],"from":[12,187],"an":[13,165],"external":[14],"database,":[15],"supporting":[16],"both":[17],"text-to-image":[18],"(T2I)":[19],"and":[20,30,164,196,204,224,227,233,263],"question":[21],"answering":[22],"(Q&A)":[23],"tasks.":[24,235],"Because":[25],"these":[26],"databases":[27],"are":[28],"opaque":[29],"web-scraped,":[31],"copyright":[32],"holders":[33],"need":[34],"ways":[35],"to":[36,52,59,61,64,104,122,152,190,201,216],"audit":[37,53],"whether":[38],"specific":[39],"appear":[41],"in":[42,89,133],"them.":[43],"While":[44],"prior":[45],"work":[46],"employs":[47],"membership":[48,116,246],"inference":[49],"attacks":[50],"(MIAs)":[51],"uni-modal,":[54],"text-based":[55],"RAG,":[56],"they":[57],"fail":[58,103],"transfer":[60],"IRAG":[62,90,134,250],"due":[63],"two":[65],"key":[66],"challenges.":[67],"First,":[68],"cross-modal":[69,193],"retrieval:":[70],"text-RAG":[71,113],"MIAs":[72,114],"force":[73],"retrieval":[74,162],"of":[75,212,220],"the":[76,84,106,120,127,148,192,210,213,218,221],"target":[77,128],"passage":[78],"by":[79,118],"injecting":[80],"its":[81],"content":[82],"into":[83,96,160],"query,":[85],"which":[86,155,182],"is":[87],"unavailable":[88],"since":[91],"cannot":[93],"be":[94],"embedded":[95],"text":[97],"queries;":[98],"even":[99],"accurate":[100],"image":[101,262],"captions":[102],"bridge":[105],"modality":[107],"gap.":[108],"Second,":[109],"discriminative":[110],"signal":[111],"extraction:":[112],"extract":[115],"signals":[117,238],"prompting":[119,222],"answer":[123],"multiple":[124],"questions":[125],"over":[126],"passage,":[129],"whereas":[130],"T2I":[131,232],"generators":[132],"produce":[135],"rather":[137],"than":[138],"follow":[139],"Q&A":[140,234],"commands.":[141],"To":[142],"fill":[143],"this":[144],"gap,":[145],"we":[146,176,208],"introduce":[147],"first":[149],"MIA":[150,214],"tailored":[151],"IRAG,":[153],"ImageAuditor,":[154],"decomposes":[156],"each":[157,172],"attack":[158],"query":[159],"segment":[163],"extraction":[166],"segment,":[167],"enabling":[168],"dedicated":[169],"optimization":[170],"for":[171,231,244],"challenge.":[173],"For":[174,206],"retrieval,":[175],"propose":[177],"Reward-Guided":[178],"Policy":[179],"Optimization":[180],"(RGPO),":[181],"updates":[183],"stochastic":[185],"policy":[186],"reward-ranked":[188],"candidates":[189],"navigate":[191],"embedding":[194],"landscape":[195],"admits":[197],"finite-sample":[198],"optimality":[199],"guarantees":[200],"balance":[202],"exploration":[203],"exploitation.":[205],"extraction,":[207],"analyze":[209],"distribution":[211],"score":[215],"guide":[217],"co-design":[219],"strategy":[223],"scoring":[225],"rule,":[226],"derive":[228],"task-specific":[229],"instantiations":[230],"We":[236],"aggregate":[237],"across":[239,266],"queries":[240,259],"via":[241],"K-means":[242],"clustering":[243],"reliable":[245],"decisions.":[247],"Across":[248],"various":[249],"systems,":[251],"ImageAuditor":[252],"exceeds":[253],"80%":[254],"AUROC":[255],"with":[256],"only":[257],"four":[258],"per":[260],"audited":[261],"remains":[264],"robust":[265],"diverse":[267],"settings.":[268]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-04T00:00:00"}