{"id":"b7da949c-1723-4329-bdb2-472a1a935050","arxiv_id":"2502.03692","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Document-level membership inference for DocVQA models is achieved by measuring parameter fine-tuning distance (and step count) per question-answer pair, in white-box and distilled black-box settings.","lead":"This paper proposes membership inference attacks that can tell whether a given document was part of a DocVQA model's training set, using only the document's question-answer pairs. The method fine-tunes the model (or a distilled copy) on each pair and uses the parameter change and step count as privacy signals, without needing auxiliary datasets.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Black-box DocMIA is evaluated on the same documents used to distill the proxy, so reported gains may be a transductive artifact rather than a transferable auxiliary-data-free attack.","rationale":"I agree with the reader that the evaluation protocol makes the reported numbers optimistic, and I would keep the CONDITIONAL verdict. Where the reader's stated weakest assumption is the reliability of Delta and hyperparameters tuned on Dtest, the more load-bearing issue in my reading is the black-box distillation protocol: the proxy is trained on target outputs for the exact 600 documents that are later attacked. This does not mean the attack is impossible or the white-box analysis is wrong; the paper provides code, ablations, a rephrased-question robustness study, and a DP-SGD analysis, and the white-box distance intuition has independent plausibility. But if the black-box results do not survive a disjoint evaluation, then a central claimed contribution, the auxiliary-data-free black-box attack, is not yet demonstrated. The concrete split test above isolates exactly this. The white-box hyperparameter tuning issue is real but secondary; it inflates reported numbers rather than undermining the transferability of the method. My recommendation is therefore unchanged from the reader's CONDITIONAL: require the holdout evaluation (and ideally holdout hyperparameter selection) before relying on the SOTA claim.","tokens_in":25912,"tokens_out":8833,"duration_ms":88100,"concrete_test":"Split the balanced 600-document Dtest into a distillation set Q (300 documents: 150 member, 150 non-member) and a held-out attack set A (300 documents, balanced). Train the proxy Fp as in Section 4.3 and Appendix D.1, but generate Dquery by querying the target only on Q. Run FL, FLLoRA, and IG on A using the Table 7 hyperparameters, and compare Balanced Accuracy, F1, and TPR@3%FPR with SCORE-UAall and Table 3. Repeat over at least 3 random splits. If held-out F1 stays within about 1 point of Table 3, the black-box concern is resolved; if it drops by more than about 5 points or to the baseline level, the black-box evaluation must be rerun on a disjoint attack set before claiming a transferable auxiliary-data-free black-box MIA.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The black-box half of the central claim, that DocMIA methods outperform existing state-of-the-art MIAs with no auxiliary data, is not established by the current protocol. Section 4.3 constructs Dquery from Dtest and trains the proxy Fp to maximize the likelihood of the target model's predictions F_theta_t(x_i, q_j) on those same documents. Section 5.2 then applies the tuned hyperparameters to black-box attacks, and Table 3 reports results against the same 600 documents. The proxy is therefore fit to the exact member and non-member documents it later classifies; the optimization-distance feature of Eq. 3 can simply encode how well the proxy memorized each document's target answers. Appendix F.3 is consistent with this reading: attack accuracy rises as proxy training loss on Dquery approaches zero. A transferable auxiliary-data-free distillation would train the proxy on target outputs for one set of documents and evaluate membership on a disjoint set. Without that separation, reported F1 of about 82 and TPR@3%FPR of about 23 may be self-labeling artifacts rather than evidence for the stated SOTA claim.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces DocMIA, a document-level membership inference attack for DocVQA models. Two settings are considered: white-box attacks (FL, FLLoRA, IG) that fine-tune a single layer, LoRA parameters, or the document image and extract optimization-distance, step-count, and utility features; and a black-box attack that first distills a proxy model from the target model's outputs and then applies the white-box attack to the proxy. The authors report improved balanced accuracy and F1 over several score-, loss-, and gradient-based baselines across DocVQA and PFL-DocVQA and three model families, claiming state-of-the-art membership inference without auxiliary data.","tokens_in":26052,"tokens_out":3566,"duration_ms":32839,"significance":"If the empirical claims held, DocMIA would be a useful contribution: it is the first document-level MIA for DocVQA, it avoids shadow-training, and it addresses auto-regressive outputs in a structured way. The paper ships code, includes extensive ablations (hyperparameters, layer selection, feature ablation, rephrased questions, DP defenses), and evaluates across several models and datasets. These strengths make the work worth serious consideration. However, the evaluation protocol for the black-box setting has a transductive leak, and the white-box hyperparameters are tuned on the evaluation set; both issues undermine the strength of the reported numbers and the SOTA claim.","major_comments":[{"comment":"The black-box evaluation is transductive: Dquery is constructed from Dtest, the very same 600 documents later classified, and the proxy F_p is trained to maximize the likelihood of the target model's outputs on those documents. The proxy is therefore fit to the exact member and non-member documents it subsequently attacks; the optimization-distance feature Δ (Eq. 3) can simply encode how well the proxy memorized each document's target answers. Appendix F.3 and Figure 10(a) are consistent with this reading, as attack accuracy tracks the proxy's training loss approaching zero. To support the stated auxiliary-data-free claim, the proxy must be distilled on outputs for one set of documents and evaluated on a disjoint set of member/non-member documents.","section":"§4.3, §5.2, Table 3"},{"comment":"The hyperparameters α, τ, and layer L are selected by maximizing attack accuracy on Dtest, the same 600 documents used to report the headline numbers in Tables 2–4 and 11–16. Although the final clustering step is unsupervised, the hyperparameter search is supervised by the evaluation metric on the evaluation set. This makes the reported accuracies optimistic and the comparison to baselines (which use fixed rules, e.g., threshold at the average score) unfair. A validation split disjoint from the test documents should be used for hyperparameter selection, or the paper should report results with hyperparameters fixed a priori.","section":"Appendix C, Table 7"},{"comment":"The black-box DocMIA results do not consistently beat the baselines. For example, with the VT5 proxy on DVQA/VT5, FL gives −0.84 ACC and −1.10 F1 versus the best SCORE-UA baseline, and with the Donut proxy on DVQA/VT5, FL gives −4.34 ACC and −4.36 F1. The abstract's claim of outperforming state-of-the-art attacks across all models and datasets is therefore supported only for a subset of configurations (notably when the proxy architecture matches the target or when the target is Pix2Struct). Please report a clear win/loss count and a statistical comparison across seeds, or soften the claim.","section":"Table 3"},{"comment":"The paper's central intuition is that the optimization-distance feature Δ is a reliable membership signal, but the feature-ablation tables show Δ alone is not discriminative on several targets: for Donut/DocVQA, AVG(Δ) gives F1 57.34 versus AVG(NLS) 76.88, and AVG(s) alone gives only 60.32. The large improvement from switching AVG to Φall (+9.24 F1 on Donut/DocVQA) indicates that the headline results are driven by feature combination and aggregation rather than by the optimization-distance premise per se. The paper should identify which features actually carry the signal and temper the narrative that optimization-based distance is the key novel ingredient.","section":"Appendix F.1, Tables 14/15"}],"minor_comments":[{"comment":"The header contains a typo: 'Hyperaremeters' should be 'Hyperparameters'.","section":"Table 7"},{"comment":"The early-stopping condition on line 8, (L(θ) − l) < τ, is described in the text as stopping when 'no further improvements is observed,' but the condition as written stops when the loss decrease is below a threshold. Please clarify the intended sign and whether the check uses the current loss or the previous loss.","section":"Algorithm 1"},{"comment":"The caption says 'Training:' for the first panel, which is likely a typo for 'Train' or 'Training phase'; please adjust for clarity.","section":"Figure 1"},{"comment":"The discussion of the proxy model training to near-zero loss should be moved or summarized in the main text, since it directly affects the interpretation of the black-box results and the transductive concern raised above.","section":"Appendix F.3"}],"recommendation":"major_revision","confidential_remarks":"The black-box evaluation flaw is load-bearing and should be fixed with a disjoint distillation set before the paper's core claim can be accepted. The white-box hyperparameter tuning on the evaluation set is also a serious protocol issue, though it is fixable. The paper's code release and extensive ablations are assets. I do not see grounds for rejection if the evaluation is corrected, but the current version overstates the empirical support."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"DocMIA is the first document-level membership inference attack for DocVQA, and the white-box half is genuinely useful. The idea of fine-tuning the target model on a single question-answer pair and using the parameter distance, step count, and utility trajectory as membership features is a sensible adaptation of known gradient/distance ideas to the multi-modal document setting. The paper is clearly written, the ablations are extensive (layer choice, learning rate, threshold, feature ablations, rephrased questions, DP defense), and the code is available. For the white-box setting, the claims of outperforming the listed baselines largely hold up.\n\nThe black-box setting is where the evaluation gets shaky. Section 4.3 builds Dquery from Dtest, and the proxy model is trained on those same 600 documents that are later classified. The proxy is therefore fit to the exact member and non-member documents it is then used to attack; the optimization-distance feature of Equation 3 can simply encode how well the proxy memorized each document's target answers. Appendix F.3 is consistent with this reading: attack accuracy rises as proxy training loss on Dquery approaches zero. A transferable auxiliary-data-free distillation would train the proxy on one set of documents and evaluate on a disjoint set. Without that separation, the reported F1 around 82 and TPR@3% FPR around 23 may be self-labeling artifacts rather than evidence for the stated SOTA claim. This is the load-bearing flaw for the black-box half.\n\nThere is also a smaller but real issue: hyperparameters (alpha, tau, layer) are tuned on the same Dtest used for reporting (Section 5.2, Appendix C). The number of tuned knobs is small and the chosen values look robust across models, so this is not fatal, but a held-out validation split would make the numbers credible.\n\nFinally, the \"consistently outperform state-of-the-art\" claim is stronger than the evidence even in the white-box setting: at low FPR some proposed attacks trail simple baselines (e.g., Table 4, Donut proxy on DVQA Donut), and Delta alone underperforms the plain score on some targets (Table 14: F1 57.34 vs 76.88 for Donut/DocVQA). The combined feature set is what works.\n\nWho is this for? Anyone auditing privacy in document-processing multimodal LLMs. The white-box attack is a useful tool; the black-box attack needs a proper disjoint-set evaluation before I would trust the transferability claim. The paper deserves peer review — it opens a new problem and the methodology is mostly sound — but it needs a revision that separates proxy training from attack evaluation and adds a validation split.","headline":"First document-level MIA for DocVQA, with a solid white-box story and a black-box evaluation that overstates transferability because the proxy is fit to the same documents it later classifies.","tokens_in":26688,"tokens_out":3390,"would_cite":true,"duration_ms":28420,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A new membership-inference attack can tell whether a specific document was used to train a DocVQA model, with no auxiliary data.","keywords":["membership inference attack","DocVQA","document-level privacy","optimization-based features","white-box attack","black-box attack","differential privacy defense"],"falsifier":"Run the FL attack using only the $\\Delta$ feature against a DocVQA model trained with strong regularization so that the train-test score gap is near zero and no document appears more than once; if balanced accuracy does not beat the average-score baseline, the claimed optimization-distance signal is not an independent membership signal.","tokens_in":25619,"feed_emoji":"🕵️","tokens_out":8864,"duration_ms":78615,"temperature":0.7,"pith_summary":"The paper tries to establish that document-level membership inference against DocVQA models is practical without auxiliary data. It introduces DocMIA, which fine-tunes the target model (or a distilled proxy) on a single question-answer pair from a suspect document and measures how far the parameters move, how many steps convergence takes, and how the answer quality evolves. Aggregating these signals across a document's questions and clustering the result separates training documents from non-training documents. The authors report that these optimization-based features outperform existing membership-inference baselines across three DocVQA model families and two datasets, with balanced accuracy around 80% and F1 around 82% in the strongest cases. If correct, a white-box adversary, or a black-box adversary with query access and a proxy model, can audit or exploit whether confidential documents were in a DocVQA service's training data.","feed_headline":"Fine-tuning one Q-and-A pair reveals a document's training status","feed_subtitle":"DocMIA reads parameter movement to detect training membership without auxiliary data, reaching ~80% balanced accuracy.","key_machinery":"The load-bearing object is the optimization-based distance feature $\\Delta = \\|\\theta_0 - \\theta_*\\|_2$, the L2 norm of the parameter change when the target model is fine-tuned on one question-answer pair starting from its current weights. Together with the number of optimization steps $s$ and the aggregated DocVQA utility $u$, it forms a document-level descriptor after aggregation over the document's questions. The paper implements the fine-tuning in three variants: optimizing a single layer (FL), a LoRA adapter on that layer (FLLoRA), and the document image pixels (IG). In the black-box setting the machinery is a distillation step: the target model's answers on the suspect documents are used to train a public-checkpoint proxy, and the white-box features are extracted from the proxy to recover the membership signal.","core_discovery":"The central claim is that the optimization trajectory of a model on a single document-question-answer example is a membership signal. For a member document, fine-tuning the trained model on one of its question-answer pairs converges quickly and moves the parameters a small L2 distance, while a non-member document requires a larger parameter change; the number of steps and the DocVQA utility score supply supporting signals. The attack assigns each document a feature vector built from these quantities aggregated over its questions, then uses unsupervised clustering to label the cluster with the larger parameter distance as non-members. In the black-box setting the adversary first distills the target model's predictions into a proxy model and applies the same procedure to the proxy. The reported results show the strongest variants reaching roughly 80% balanced accuracy and 82% F1, exceeding loss-based, score-based, gradient-based, and token-probability baselines on the evaluated targets.","pith_inferences":["If parameter-space distance is the real leakage channel, then any training procedure that shortens the optimization path for held-out points, such as flatter minima or stronger regularization, should reduce membership-inference success; this is a testable defense target.","The same optimization-based recipe could transfer to other auto-regressive multimodal tasks such as general VQA or OCR-free document parsing, wherever per-sample fine-tuning is computationally feasible.","Because the authors tune hyperparameters per target model using the evaluation set, a realistic adversary without labeled member and non-member documents would likely see lower performance; evaluating with a fixed, untuned protocol would clarify the practical threat.","The black-box distillation result suggests the membership signal survives a prediction-only bottleneck; a useful extension would measure how much signal remains when the API returns only a top-1 answer without confidence scores."],"forward_implications":["A white-box adversary holding a suspect document can determine its training status with reported balanced accuracy up to about 80% and F1 up to about 82% on the evaluated models, without needing any auxiliary data.","A black-box adversary with API access can achieve similar leakage by distilling the target's answers into a proxy model; matching proxy and target architectures helps, but cross-architecture attacks still work in the reported experiments.","Documents with multiple question-answer pairs are exposed at the document level, so repeated exposure in training data amplifies membership leakage beyond single-example MIA.","The reported defense of training with DP-SGD at $\\varepsilon = 8$ cuts the F1 of the strongest attack to about 55%, but at the cost of roughly halving DocVQA utility, so the defense is not free.","The attack remains partially effective when the adversary has only rephrased questions rather than the exact training questions, though all compared methods decline in that setting."],"supporting_citations":[{"why":"Defines membership inference attacks and the shadow-model paradigm that the paper's no-auxiliary-data setting explicitly avoids.","marker":"(Shokri et al., 2017)"},{"why":"Supplies the loss-threshold attack baseline (LOSS-TA) and the overfitting connection the paper measures against.","marker":"(Yeom et al., 2018)"},{"why":"Provides the gradient-norm white-box attack baseline (GRADIENT-UA) that the paper compares with its optimization-based features.","marker":"(Nasr et al., 2019)"},{"why":"Prior provider-level DocVQA attack, the SCORE-UA black-box baseline, and the PFL-DocVQA dataset the paper extends.","marker":"(Tito et al., 2024)"},{"why":"Establishes the low-FPR evaluation methodology, TPR at 1% and 3% FPR, used to report attack success.","marker":"(Carlini et al., 2022)"},{"why":"Introduces LoRA, the parameter-efficient adapter used in the FLLoRA attack variant.","marker":"(Hu et al., 2021)"},{"why":"Supplies the Min-K% token-probability baseline adapted to the document-level setting.","marker":"(Shi et al., 2023)"},{"why":"Supplies the Min-K%++ token-probability baseline improved with z-score normalization.","marker":"(Zhang et al., 2024)"},{"why":"Defines the DocVQA task and dataset used as the primary evaluation benchmark.","marker":"(Mathew et al., 2021)"}],"fun_headline_variants":["One Q&A fine-tune reveals training membership without extra data","Probe training membership with one fine-tune step","Fine-tune on one Q&A to expose training membership","DocVQA privacy: one fine-tune detects training membership","DocMIA: Training membership from one Q&A's parameter change"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's success depends on the premise that the L2-norm of the parameter change after fine-tuning a single question-answer pair reliably separates member from non-member documents; the paper's own ablation shows that this distance alone underperforms a simple score on some targets, so the combined features and hyperparameters tuned on the evaluation set are what carry the result.","fun_headline_variants_meta":{"raw":{"variants":["One Q&A fine-tune reveals training membership without extra data","Probe training membership with one fine-tune step","Fine-tune on one Q&A to expose training membership","DocVQA privacy: one fine-tune detects training membership","DocMIA: Training membership from one Q&A's parameter change"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001604,"raw_usage":{"total_tokens":6385,"prompt_tokens":933,"completion_tokens":5452,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":549,"completion_tokens_details":{"reasoning_tokens":5368}},"tokens_in":549,"tokens_out":5452,"duration_ms":30622,"temperature":1.0,"reasoning_tokens":5368,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T04:06:08.959984+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the FL attack using only the $\\Delta$ feature against a DocVQA model trained with strong regularization so that the train-test score gap is near zero and no document appears more than once; if balanced accuracy does not beat the average-score baseline, the claimed optimization-distance signal is not an independent membership signal.","supporting_citations":[{"cited_title":"Membership inference at- tacks against machine learning models","cited_arxiv_id":null,"evidence_quote":"Defines membership inference attacks and the shadow-model paradigm that the paper's no-auxiliary-data setting explicitly avoids."},{"cited_title":"Privacy risk in machine learn- ing: Analyzing the connection to overfitting","cited_arxiv_id":null,"evidence_quote":"Supplies the loss-threshold attack baseline (LOSS-TA) and the overfitting connection the paper measures against."},{"cited_title":"Mem- bership inference attacks from first principles","cited_arxiv_id":null,"evidence_quote":"Establishes the low-FPR evaluation methodology, TPR at 1% and 3% FPR, used to report attack success."}],"review_version":1}