{"id":"0360782e-6d86-4102-ba13-e64fa2dbd97b","arxiv_id":"2411.11424","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Long-context language models leak membership of documents in their input context, detectable via snippet-based generation loss and semantic similarity attacks.","lead":"The authors show that long-context AI models can reveal whether a specific document was included in their input, through six attack methods. This matters because systems that load private documents into context may be leaking membership information.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported attack F1 is confounded by cross-dataset non-members; same-distribution control required before the claim can be accepted.","rationale":"The reader's weakest_assumption correctly identifies the same-distribution confound as the most load-bearing issue. The paper's contribution—demonstrating membership leakage in LCLM input contexts—must be validated against a control where members and non-members are indistinguishable except for their presence in the context. The current design violates this condition, so the headline F1 is not interpretable as evidence of membership leakage. The concern is not about internal inconsistency or a wrong derivation; it is an evaluation validity problem. The proposed attacks are plausible, and the idea of using generation loss and semantic similarity is reasonable, but the empirical support is incomplete. The reader's CONDITIONAL verdict is appropriate, and no change is needed. The concrete test would definitively resolve the concern by isolating membership from dataset identity.","tokens_in":7885,"tokens_out":3521,"duration_ms":35627,"concrete_test":"Rerun the evaluation on Multi-Document QA (e.g., NaturalQuestions) with members and non-members sampled from the same document pool: randomly place half the documents into the long context as members and hold out the other half as non-members, matching topic and length distributions. Recompute all six attack F1-scores, especially Meta-Classifier. If F1 drops substantially from 90.66%, the original result reflected dataset separation rather than membership inference. Additionally, train a simple classifier on document-source labels without querying the LCLM; if it matches the attack's accuracy, the attack is not probing context membership.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The core empirical claim (e.g., 90.66% F1 for Meta-Classifier on Multi-document QA) rests on an evaluation where non-members are documents from another dataset, as stated in Section 4.1: 'The non-members come from documents in another dataset.' This conflates membership status with dataset/topic identity. The attack measures generation loss on document continuations and semantic similarity against generated text; if the non-member dataset differs in topic, style, or vocabulary, high loss and low similarity for non-members are expected even when the model has no contextual membership signal. The reported separation in loss and BERTScore/BLEU may therefore reflect dataset classification rather than leakage of context membership. The paper provides no same-distribution control, no description of the non-member dataset, and no error bars. The central claim is not refuted, but the current evidence cannot distinguish between 'the model knows this document is in its context' and 'the model can tell this document comes from a different corpus.'","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes membership inference attacks (MIAs) against long-context language models (LCLMs), aiming to determine whether a given document appears in the model's input context. The authors introduce six attack strategies: Logits Attack, Loss Attack, Meta-Classifier (probability-based), and Inquiry, BERTScore, and SacreBLEU Attacks (text-only). The core intuition is that documents present in the context produce lower generation loss and higher semantic similarity with model continuations when prompted with document snippets. Experiments on Multi-document QA datasets with LongChat-7b-v1.5-32k report high attack F1-scores, e.g., 90.66% for the Meta-Classifier on 30-document QA. The paper claims to present the first MIA targeting LCLM contexts and argues that context integration creates a sensitive repository vulnerable to membership leakage.","tokens_in":8031,"tokens_out":1745,"duration_ms":18419,"significance":"If the reported results are robust, this work addresses an important and underexplored privacy risk of long-context LLMs, which are increasingly used in retrieval-augmented and question-answering systems. The proposed attacks are practical in that several operate text-only without access to model probabilities. The paper also connects membership leakage to the model's retrieval and generation behavior, offering a plausible mechanism. However, the current evaluation has a significant confound in the construction of non-members, and the empirical evidence is presented only for a single model and dataset in the provided text, weakening the strength of the claims until these issues are resolved.","major_comments":[{"comment":"The non-members are described as 'documents in another dataset,' which creates a domain-shift confound: the attack may be detecting corpus-level differences (topic, style, vocabulary) rather than contextual membership. The reported separation in loss and BERTScore/BLEU could then reflect dataset classification rather than membership leakage. The manuscript does not identify the non-member dataset, characterize its similarity to the member dataset, or provide a same-distribution control where non-members are documents from the same corpus that are simply not placed in the context. This control is essential to support the central claim, because the threat model requires members and non-members to be distinguishable only by their presence in the context. Please add such a control (e.g., holding out same-domain documents as non-members) and report the resulting attack performance.","section":"Section 4.1, Attack Setting"},{"comment":"The Loss Attack, BERTScore Attack, and SacreBLEU Attack require a decision threshold to classify a document as member or non-member, but the manuscript does not state how these thresholds are chosen (e.g., fixed percentile, Youden's J, or threshold tuned on the reference set). If the threshold is tuned on the reference set and then applied to the test set, this is legitimate but should be stated; if thresholds are chosen to maximize test-set performance, the reported F1-scores are optimistic. Please report the threshold selection procedure explicitly for each attack.","section":"Section 3 and Section 4.1"},{"comment":"The main results table shows only LongChat-7b-v1.5-32k on Natural Question Multi-Document QA, despite the abstract and Section 4.1 claiming evaluation on multiple LCLMs and tasks (KV-retrieval, LongBench, six models). The full text does not provide results for the other models or tasks, nor error bars or variance across random seeds. The claim that 'extensive experiments' support the conclusions is therefore not verifiable from the manuscript as provided. Please include complete results for all models and datasets, or clearly state that additional results appear in an appendix if it is missing from this version.","section":"Table 1 and Section 4.2"}],"minor_comments":[{"comment":"There are several typographical errors, including 'Quesion-answering', 'effiencicy', 'Oringial', 'Attck', 'Scare BLEU', and 'Accrucy'. These should be corrected.","section":"Abstract and Section 1"},{"comment":"The description of datasets is minimal: Multi-Document QA and KV-retrieval are attributed to [7], and LongBench to [29], but the number of samples, document lengths, and the identity of the 'another dataset' for non-members are not specified. This information is needed to assess the validity of the evaluation and the potential for dataset-shift effects.","section":"Section 4.1, Datasets"},{"comment":"The system prompt in Section 2.4 appears to be copied from the 'lost in the middle' benchmark. The manuscript should clarify whether this is the exact prompt used for all models and datasets, or whether prompts were adapted per dataset.","section":"Section 2.4, System Prompt"},{"comment":"The Meta-Classifier is described as using '2, 4, 6, 8, and 10 pieces' and collecting loss, BERTScore, and BLEU for each, yielding 15 features. The description is clear, but the training details (e.g., optimizer, number of epochs, and whether the attack model is trained once per victim model or per dataset) are omitted and should be included for reproducibility.","section":"Section 3, Meta-Classifier"},{"comment":"The claim that the Logits and Inquiry attacks suffer from 'position bias' is plausible, but the manuscript does not provide evidence for this interpretation. If this explanation is retained, please support it with an analysis or cite specific prior work beyond [35].","section":"Section 4.2.1"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and relevant privacy issue, but the evaluation needs a same-distribution control to rule out domain-shift confounds, and the full results across models and datasets should be made available. I also note that the 'first MIA against LCLMs' claim should be checked against prior RAG-specific MIAs (e.g., [23,24]) to ensure the novelty statement is precise; the authors do cite these works, but the distinction between RAG and LCLM contexts could be drawn more sharply."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read this for the new attack surface: it targets membership in the external context of long-context LLMs, which is genuinely different from training-data MIA and RAG database membership. The six attack designs are concrete and simple enough to reimplement, and the core intuition—a member document makes the model's continuations lower-loss and more semantically similar—is plausible. The paper is the first to my knowledge to pose the question in this setting, and that is worth something.\n\nWhat undercuts the headline results is the evaluation. Section 4.1 states that non-members come from documents in another dataset. If that dataset differs in topic or style, loss and BERTScore/BLEU separation will appear even when the model has no membership signal at all. The attack could be classifying datasets, not detecting context presence. There is no same-distribution control, no description of the non-member corpus, no error bars, and no stated decision thresholds for the Loss/Bert/BLEU attacks. Only LongChat-7b results are shown in the main text, though the abstract promises multiple LCLMs. These are fixable, but they are not cosmetic.\n\nThe central claim is not refuted. It may even be right. But the current evidence cannot discriminate between 'the model knows this document is in its context' and 'the model knows this document comes from corpus X.' The related-work coverage looks adequate, and the limitations are not hidden—the cross-dataset choice is stated openly, which I read as a sign of honest reporting rather than an attempt to conceal a weakness.\n\nI would send this to peer review because the question is important and the setting is new. I would not cite it as established evidence until the confound is fixed. It would make a good reading-group example of how easy it is to build an evaluation that looks strong but hasn't isolated the property it claims to measure.","headline":"A genuinely new MIA setting with a plausible attack family, but the headline F1 rests on a cross-dataset control that may measure domain separation rather than context membership.","tokens_in":8572,"tokens_out":2712,"would_cite":false,"duration_ms":27636,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that membership in a long-context language model's input context leaks through generation loss and semantic similarity, and that six proposed attacks infer membership accurately, reaching 90.66% F1.","keywords":["membership inference attack","long-context language models","privacy leakage","generation loss","semantic similarity","multi-document question answering","text-only attack","context membership"],"falsifier":"Run the same six attacks with non-members drawn from the same document pool and topic distribution as members, with only context inclusion differing. If attack F1 falls to near chance, the reported leakage is dataset discrimination rather than membership inference.","tokens_in":7665,"feed_emoji":"🕵️","tokens_out":5009,"duration_ms":51212,"temperature":0.7,"pith_summary":"This paper argues that long-context language models expose membership information about the documents placed in their context windows. It presents the first membership inference attacks specifically designed for these models, asking whether a given document or sequence was part of the model's input context. The core idea is that an in-context document lowers the model's generation loss and raises the semantic similarity of its continuations, which an attacker can measure by prompting with a snippet of the target document. The authors propose six attack strategies, including text-only versions that require no access to internal probabilities, and report attack F1-scores above 85% across several models and datasets, with a best of 90.66% F1 on Multi-document QA with LongChat-7b-v1.5-32k.","feed_headline":"First membership attack on long-context LLMs reaches 90.66% F1","feed_subtitle":"Probing with a snippet exposes hidden context through generation loss and semantic similarity, even with text-only access.","key_machinery":"The load-bearing mechanism is the conditioning contrast between members and non-members in the model's generation behavior. The attacker inserts a snippet of the target document as a completion prompt and measures how well the resulting continuation matches the withheld suffix: low generation loss or high BERTScore/SacreBLEU indicates the document was likely in context. The Meta-Classifier amplifies this by averaging these signals over prefixes of different lengths and training a fully connected layer on the resulting feature vectors, using 1,000 labeled reference samples.","core_discovery":"The central discovery is that long-context language models leak membership through their retrieval-and-completion behavior rather than through training-set overfitting. Even though the model is not trained on the documents in its context, when a target document is present the model tends to retrieve it and generate continuations that are more coherent with and semantically closer to that document. The paper shows that this signal can be extracted by splitting a target document into a prefix and suffix, asking the model to complete the prefix, and then measuring the generation loss, BERTScore, or SacreBLEU between the generated continuation and the true suffix. The strongest variant, the Meta-Classifier, combines these scores across multiple split lengths into a feature vector and trains a simple attack model on 1,000 reference samples, reaching attack F1-scores above 90%. Direct yes/no prompts are weaker, below 70% accuracy, because they underuse the model's retrieval capability and suffer from position bias.","pith_inferences":["A stricter, untested control would draw non-members from the same document pool and topic distribution as members; if the 90% F1 survives that control, the leakage is truly membership rather than dataset discrimination.","The attack's reliance on exact continuation similarity suggests a defense direction: force the model to paraphrase or reason indirectly, or perturb outputs, since the signal depends on lexical and semantic closeness to the gold suffix.","If the effect transfers to production retrieval-augmented systems, the same snippet-completion probe could reveal which retrieved documents were in the context, enabling confirmation of sensitive records such as medical histories or personal identities.","A natural extension is testing paraphrased target documents: if the attack degrades sharply when lexical overlap is removed, the signal is partly verbatim memorization rather than pure semantic awareness."],"forward_implications":["An adversary with only black-box text access can infer membership nearly as well as an adversary with token-level probabilities: the Sacre BLEU and BERTScore attacks exceed 85% F1 in text-only scenarios.","The Meta-Classifier, combining generation loss, BERTScore, and SacreBLEU across multiple prefix/suffix splits, achieves the highest accuracy on Multi-document QA, showing these signals are complementary.","Direct yes/no prompts are the weakest attack form, below 70% accuracy, because single-token answers underuse the model's retrieval capabilities and are influenced by position bias.","The leakage is not caused by training-set overfitting: the model reveals membership of documents it only saw in its context during inference.","The attack transfers across multiple open-source long-context models and general long-context benchmarks, not just a single model or dataset."],"supporting_citations":[{"why":"Supplies the Multi-Document QA and KV-retrieval datasets and the gold-document positioning used in the main experiments.","marker":"[7]"},{"why":"Prior LLM membership inference via neighbourhood comparison, which this work distinguishes as sentence-level rather than context-level.","marker":"[11]"},{"why":"Prior LLM membership inference for pretraining data, showing the sentence-level focus this paper moves beyond.","marker":"[12]"},{"why":"Provides the direct inquiry attack prompt and prior MIA against retrieval-augmented generation that the paper adapts.","marker":"[24]"},{"why":"Prior MIA against in-context learning, whose query setting motivates the snippet-completion attack.","marker":"[25]"},{"why":"Defines BERTScore, the semantic similarity metric used by the Bert Score Attack.","marker":"[27]"},{"why":"Defines SacreBLEU, the lexical similarity metric used by the Sacre BLEU Attack.","marker":"[28]"},{"why":"Provides the LongBench benchmark used to evaluate the attacks on general long-context tasks.","marker":"[29]"},{"why":"Provides the LongChat victim models on which the headline results are measured.","marker":"[30]"}],"fun_headline_variants":["Long-context LLMs leak membership via retrieval clues, 90% F1","Probe reveals if a document sits in long-context LLM memory","Membership attack exploits context retrieval, not training data","90% F1 attack: detect docs in LLM context without training access","Long-context LLMs spill secrets: membership attack hits 90.66% F1"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's validity rests on the assumption that members and non-members differ only in whether they were placed in the model's context, not in topic or style.","fun_headline_variants_meta":{"raw":{"variants":["Long-context LLMs leak membership via retrieval clues, 90% F1","Probe reveals if a document sits in long-context LLM memory","Membership attack exploits context retrieval, not training data","90% F1 attack: detect docs in LLM context without training access","Long-context LLMs spill secrets: membership attack hits 90.66% F1"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000244,"raw_usage":{"total_tokens":1579,"prompt_tokens":1037,"completion_tokens":542,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":653,"completion_tokens_details":{"reasoning_tokens":443}},"tokens_in":653,"tokens_out":542,"duration_ms":5137,"temperature":1.0,"reasoning_tokens":443,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:30:49.163530+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same six attacks with non-members drawn from the same document pool and topic distribution as members, with only context inclusion differing. If attack F1 falls to near chance, the reported leakage is dataset discrimination rather than membership inference.","supporting_citations":[{"cited_title":"Bertscore: Evaluating text generation with bert,","cited_arxiv_id":null,"evidence_quote":"Defines BERTScore, the semantic similarity metric used by the Bert Score Attack."},{"cited_title":"Membership inference attacks against language models via neighbourhood comparison,","cited_arxiv_id":null,"evidence_quote":"Prior LLM membership inference via neighbourhood comparison, which this work distinguishes as sentence-level rather than context-level."},{"cited_title":"Lost in the middle: How language models use long contexts,","cited_arxiv_id":null,"evidence_quote":"Supplies the Multi-Document QA and KV-retrieval datasets and the gold-document positioning used in the main experiments."},{"cited_title":"Detecting pretraining data from large language models,","cited_arxiv_id":null,"evidence_quote":"Prior LLM membership inference for pretraining data, showing the sentence-level focus this paper moves beyond."},{"cited_title":"A call for clarity in reporting bleu scores,","cited_arxiv_id":null,"evidence_quote":"Defines SacreBLEU, the lexical similarity metric used by the Sacre BLEU Attack."},{"cited_title":"How long can context length of open-source llms truly promise?","cited_arxiv_id":null,"evidence_quote":"Provides the LongChat victim models on which the headline results are measured."}],"review_version":1}