Membership inference attacks: how attackers learn which training data a model used

Mindgard released a guide explaining how membership inference attacks determine whether a given record appears in a model's training set, and noted that fine-tuned models and RAG retrieval stores are the main exposure surfaces. The shadow-model attack by Shokri et al. in 2017 achieved 93.5% precision on the Google prediction API; in December 2024, Opinion 28/2024 adopted by the European Data Protection Board listed membership inference as one of the methods for assessing model anonymity. Duan et al. in 2024 measured on the 12B-parameter Pythia that AUC in most domains was only 0.475 to 0.582, close to random guessing, which the authors attributed to each sample appearing only once during pretraining; whereas ICP-MIA achieved 0.942 AUC on Llama-3.2-3B-Instruct fine-tuned on HealthCareMagic.